New 'bank account' login change for millions of DWP, DVLA and HMRC users

The Government has provided an update on a 'bank account' login change for a system used by around 23 million Britons. The One Login platform allows people to access services including DWP for reviewing state pension and benefits , and HMRC for examining tax records and National Insurance information. The system can also be used to renew your DVLA driving licence, access childcare provision and other matters. It was launched to provide people with a single account for accessing government services online.

However, concerns have been raised by senior MPs that the scheme could be susceptible to hackers - with one describing it as "scandalously insecure". Now the Department for Digital, Culture, Media and Sport - which maintains it actually reduces fraud - has provided an update on the platform that is designed to make it safer and quicker to access, and it involves your bank account. The new statement follows the department being questioned by one MP about the "adequacy of the One Login system for people with difficulties using that system, such as due to difficulties confirming their identity."

Speaking on Friday in response to the enquiry from Devon MP Martin Wrigley, Stephanie Peacock, a minister in the department, stated: "Government is committed to ensuring GOV.UK One Login is accessible as possible, while protecting users and the government from the risks of fraud. GOV.UK One Login offers multiple ways for users to prove their identity: through the app, online security questions or in-person via the Post Office." She then outlined the upcoming changes.

"We are expanding the ways people can prove their identity, including a new option launching next year that will enable users to prove their identity by securely logging into their bank account," she said. "People receiving Personal Independence Payment ( PIP ) can already use information about their benefit to help prove their identity. We are working with DWP to extend this to a wider range of benefits. Where users cannot or choose not to use GOV.UK One Login, government services are required to provide alternative routes."

The DWP revealed in May that the platform could be used for issues around several benefits, reports Wales Online . At the time, it stated: "You can now get proof of your DWP benefits or State Pension online." Claimants were advised they could download a benefits letter to their device, or request a printed copy through the post. One Login can be used for benefits including: the State Pension adult DLA JSA Attendance Allowance Pension Credit Income Support ESA The Government revealed in September that passkeys were being introduced across One Login.

Ministers say these allow individuals to log in securely using their PIN, Face ID or fingerprint instead of typing in or remembering a password. The Government says that passkey logins are up to eight times quicker than signing in with username, password and two-step verification code. Officials say that passkeys can help safeguard people from phishing and other cyber threats. Veteran Tory MP David Davis has long been a fierce opponent of the scheme, previously branding One Login as "scandalously insecure".

During a Westminster Hall debate towards the end of last year, he described the single log-in system as a "strategic weakness", condemning the government's management of it as a "disaster". Mr Davis, a staunch civil liberties campaigner, warned that the system would leave every Brit vulnerable to 'malevolent actors', including hackers and criminals. He suggested the fallout could prove even more damaging than the Horizon scandal, which saw postmasters across the UK wrongfully imprisoned due to catastrophic IT failures they were incorrectly held responsible for.

He said: "As early as 2022, the information assurance team responsible for ensuring the security of the system raised concerns that it was being developed on unsecured workstations, by contractors in Romania who did not have security clearance. When it ran a red-team operation to see how secure it was, they broke into the system easily. They would have been able to install malware, and they were not even detected by the people running the system.

"What will happen when this system comes into effect is that the entire population's entire data will be open to malevolent actors-foreign nations, ransomware criminals, malevolent hackers and even their own personal or political enemies. As a result, this will be worse than the Horizon scandal." The government has dismissed this analysis, stating the system will provide Brits with a straightforward, so-called one-stop shop for accessing government services.

During the same debate, Iqbal Mohamed MP declared that the country had been "crying out for joined-up government for decades". However, he said: "My constituents and millions across this country are opposed to the scheme because they see the breach of their civil liberties but do not see the benefits of the scheme." In response to these criticisms, the government said the platform hosts dozens of services and is already being used by millions.

A spokesperson said at the time : "One Login follows the highest security standards used across government and the private sector and is fully compliant with UK data protection and privacy laws. The system undergoes regular security reviews and testing, including by independent third-parties, to ensure security remains strong and up to date." Speaking in September, Jonathon Ellison, NCSC Director for National Resilience, said: "The introduction of passkeys for GOV.UK One Login will give users a faster, simpler and more secure way to sign in to many public-facing government services while leaving password headaches behind.

"Cyber criminals often look for the easiest route to access important accounts, which means login details remain a common target. But passkeys offer a highly phishing-resistant alternative to passwords, frustrating attackers and saving the public time. "We strongly encourage users to set up a passkey for GOV.UK One Login and to do so wherever passkeys are available across digital services. By taking this small but significant step, you can help protect your online accounts and raise our collective resilience, making the UK safer."

For further information on One Login, head to the government web page on the subject .