Jump to content
House Price Crash Forum

Archived

This topic is now archived and is closed to further replies.

Bruce Banner

H M R C Online - New Security.

Recommended Posts

Has anyone else who uses HMRC Online had problems with the new (over the top) security?

I complained and a month later received an email.....

Hello xxxxxx xxxxxxx

Thank you for your enquiry about confirming your identity. Please refer to our Frequently Asked Questions below:
Why have you introduced an identity check?
HMRC is required to adapt to changing security threats and has taken action to maintain the security of our customers online.
Can I opt out of an identity check?
No, it is an essential security requirement to maintain the security of your tax account.
What questions do you ask?
We may ask you one or more questions from a variety of sources. Not everyone will be asked the same questions. You can only answer the questions you are asked.
What kind of passport can I use to verify my identity?
You must use a current UK passport. If you do not have a current UK passport you cannot confirm your identity this way. You should enter the expiry date of the passport and not your date of birth.
What kind of bank account can I use to verify my identity?
You may be asked to verify your identity by entering details of the bank account that your Child Benefit, Tax Credits or State Pension is or was paid into, or a bank account that pays (or has paid) you interest. The account may be a bank, building society or post office account that you have held; it may not be your current (regular) bank account and could be an account that you no longer use.
How do I verify my identity using a bank account?
You must enter the last 4 numbers of the account reference. You will find the number on your statement and it may be on some bank cards. It is not the long number in the middle of your bank card.
How do I verify my identity using pay and tax details?
You should enter details from any one of your last 3 payslips. You must include pence, zero is accepted.
How do I verify my identity using P60 details?
You should enter the amounts on either your 2014/15 or 2015/16 P60 certificate or a P45 if you left employment during the year.
What if I am retired, I do not have a P60?
If you receive a private pension your pension provider should give you a P60 showing how much tax you paid.
What If I have more than P60 or have more than one employment?
You should enter the amounts from one of the P60s. If we cannot verify you from this, try entering the amounts from another P60. Do not add the amounts together from the certificates. Zero cannot be entered.
What happens if I cannot answer the questions or provide incorrect information to verify my identity?
You will not be able to access your account until you can verify. You can try again, but if you enter incorrect details more than 5 times in an hour or 8 times within 24 hours you will be locked out for 7 days and will not be able to try again until your account is unlocked.
I cannot verify my identity online with HMRC, are there other Verification providers?
Yes, for some HMRC services you may be able to use a certified company. For details, check the GOV. UK website
I cannot verify online with either HMRC or a certified provider, are there other ways to contact HMRC?
Check the GOV.UK website for details. You will then need to use the search facility to find the service you require.
In my case they asked for details from P60 and Payslip, neither of which I had.

Share this post


Link to post
Share on other sites

They asked me the P60, too. Guess what? I've mislaid it. I wrote them an irate message.

Fortunately I was able to get the number in question from my March 2015 pay slip, which was in the right place. So now I can access the service.

FWIW, the principle of better identity checking makes sense, and these questions have merit in bootstrapping the process. But now they just send an OTP by text whenever I login: a method that's demonstrably unsafe. What we really should have for this kind of thing is a cryptographic identity.

Share this post


Link to post
Share on other sites

After a lot of digging around in the garage I managed to get the number in question too, guess what it didn't work, just returned "incorrect information" although it was exactly what was requested.

As for the security number they send by SMS every time you try to log in, that just got me to the P60 question so I phoned them and, at their suggestion, had my mobile number reset and now answer that I don't have a mobile as, according to HMRC support, the SMS code may not work if you are abroad as some mobile operators block the texts when roaming. I explained I'm away a lot so anything that means I have to check documents other than my driving licence or passport effectively locks me out of my account. They were very sympathetic and suggested that I explain that in the written contact facility which I did but in the end the only thing that happened was that, a month later, I received today's email.

Eventually, I managed to get into my account, by the back door, by entering an old HTTPS login from my browser history followed by user name and password, which I can still do, and would have been able to file my tax return if all of the banks had provided tax certificates but one didn't until the day after I left so my tax rebate will have to wait until I get back.

What a nightmare, a day wasted on the phone and searching for documents. I said to one of the numerous HMRC staff I spoke to that day "This is crazy, are a lot of people having the same problem as me?" the answer was an knowing" I couldn't possibly comment". The only good thing was that all the HMRC staff I spoke to were very polite and genuinely tried to be helpful but the new system beat them.

Share this post


Link to post
Share on other sites

The only good thing was that all the HMRC staff I spoke to were very polite and genuinely tried to be helpful

I've found that and have heard several other people say similar, there are a lot of places that could learn from their phone service. I suppose they've figured out that they'll get more tax paid if they're helpful.

Share this post


Link to post
Share on other sites

To be fair I went through this process about a month ago (I was after my NI records) and it all worked for me first time.

Having said that there's still no sign of my NI records.

Share this post


Link to post
Share on other sites

Was this to look at your state pension entitlement? Because on that section you can easily examine the years you have contributed, which ones you are missing etc. I was impressed actually. The security thing was okay - only a minor hassle thus far. And the info was presented very clearly and simply.

I went for both; the NI records are (allegedly) being sent by post.

The pension entitlement went well until failing at the last hurdle and saying that I couldn't have it because of an error. This could be because of my age; I had read elsewhere that it wouldn't work if you're under 50 (as I am) but there was nothing on the site to say that (I checked) so I guessed that they may have enhanced it but it seems not.

Share this post


Link to post
Share on other sites

Can you browse your NI records online or just request a statement?

Regarding HMRC website security, I've been registered for years and find it really useful being able to see exactly what I've paid each year right back to 1997.

My beef is that the new security system asks questions that you may not have the documents to be able to answer and if you haven't you can't ask for a different question like on most sites, no answer to the question that is asked and that's it, no access to your account.

Share this post


Link to post
Share on other sites

I've found that and have heard several other people say similar, there are a lot of places that could learn from their phone service. I suppose they've figured out that they'll get more tax paid if they're helpful.

I've found that on occasion, too.

On the other hand ...

Share this post


Link to post
Share on other sites

Can you browse your NI records online or just request a statement?

Regarding HMRC website security, I've been registered for years and find it really useful being able to see exactly what I've paid each year right back to 1997.

My beef is that the new security system asks questions that you may not have the documents to be able to answer and if you haven't you can't ask for a different question like on most sites, no answer to the question that is asked and that's it. no access to your account.

Request a statement for NI.

I think with HMRC you now know so can have them to hand next time; I have a tax file next to my desk so it was all there.

I had a worse one with NS&I a few weeks ago. They ask two security questions from their random list for which you've given the answers. One of them each time was date of a sibling's birthday. Now I know what that is, so could answer it correctly, but I equally know that I didn't set that up as a security question so whatever answer they were expecting it wasn't the right one. I had to go through some text procedure to be able to eventually populate it with the right answer.

Share this post


Link to post
Share on other sites

My beef is that the new security system asks questions that you may not have the documents to be able to answer and if you haven't you can't ask for a different question like on most sites, no answer to the question that is asked and that's it, no access to your account.

Yes, that's annoying. On the other hand, giving you lots of different tries would make it much easier for a fraudster, who would then only need one piece of your information.

I believe you can also get in through the "main" government portal by asserting your identity through a provider from their approved list. Though I don't know the details of what those providers require of you to bootstrap: I imagine the ultimate fallback would be to visit in person with your passport.

Share this post


Link to post
Share on other sites

Request a statement for NI.

I think with HMRC you now know so can have them to hand next time; I have a tax file next to my desk so it was all there.

I had a worse one with NS&I a few weeks ago. They ask two security questions from their random list for which you've given the answers. One of them each time was date of a sibling's birthday. Now I know what that is, so could answer it correctly, but I equally know that I didn't set that up as a security question so whatever answer they were expecting it wasn't the right one. I had to go through some text procedure to be able to eventually populate it with the right answer.

No, it's not that easy if one of the question is a number from your P60 which you've thrown away because you can get all the information you need online......... er, no you can't, not without your P60. Paperless records that require a piece of paper to access.

Share this post


Link to post
Share on other sites

Was this to look at your state pension entitlement? Because on that section you can easily examine the years you have contributed, which ones you are missing etc. I was impressed actually. The security thing was okay - only a minor hassle thus far. And the info was presented very clearly and simply.

Has anyone got a yes or no for tax year 2015-6 yet? They must presumably have all the data by now.

I went for both; the NI records are (allegedly) being sent by post.

What do the NI records tell you that the online summary doesn't?

Share this post


Link to post
Share on other sites

No, it's not that easy if one of the question is a number from your P60 which you've thrown away because you can get all the information you need online......... er, no you can't, not without your P60. Paperless records that require a piece of paper to access.

Got you. So what you're saying is that I share a similar mindset to HMRC in that I assume that everybody will have to hand their last few years' P60s.

I'll have to think about that but I think it's probably an insult!

(Re P60s I have always found it odd that it's the only document where it specifically says not to lose it because you can't have another copy - why ever not?)

Share this post


Link to post
Share on other sites

Yes, that's annoying. On the other hand, giving you lots of different tries would make it much easier for a fraudster, who would then only need one piece of your information.

I believe you can also get in through the "main" government portal by asserting your identity through a provider from their approved list. Though I don't know the details of what those providers require of you to bootstrap: I imagine the ultimate fallback would be to visit in person with your passport.

I wonder if they would waive the fine for a late PAYE return if you left it to the last minute and found that you could not log into your account because of the new security measures.

Also, surely site security should not be at the expense of being able to get in?

Share this post


Link to post
Share on other sites

Has anyone got a yes or no for tax year 2015-6 yet? They must presumably have all the data by now.

What do the NI records tell you that the online summary doesn't?

It didn't give me a NI summary online; it said they will send it.

And as noted I could not get the online pension records because I'm under 50.

Share this post


Link to post
Share on other sites

Got you. So what you're saying is that I share a similar mindset to HMRC in that I assume that everybody will have to hand their last few years' P60s.

I'll have to think about that but I think it's probably an insult!

(Re P60s I have always found it odd that it's the only document where it specifically says not to lose it because you can't have another copy - why ever not?)

The thing that added insult to injury for me was that when I managed to find my P60, in a cardboard box in the garage, and input the requested figure the answer was that it was incorrect.

Share this post


Link to post
Share on other sites

I wonder if they would waive the fine for a late PAYE return if you left it to the last minute and found that you could not log into your account because of the new security measures.

I was brought up never to leave things to the last minute.

Where there are tangible penalties involved, I think that makes sense.

Share this post


Link to post
Share on other sites

I was brought up never to leave things to the last minute.

Where there are tangible penalties involved, I think that makes sense.

In my case, I was trying to get it done, as always, a few days into the new tax year. Now I'll have to wait until September for my tax rebate.

Edit: You're not part of the HMRC online security team are you?

Share this post


Link to post
Share on other sites

In my case, I was trying to get it done, as always, a few days into the new tax year. Now I'll have to wait until September for my tax rebate.

Edit: You're not part of the HMRC online security team are you?

:D

Share this post


Link to post
Share on other sites
Edit: You're not part of the HMRC online security team are you?

Did you read the link I posted earlier about my experience with them?

But I do think a lot about issues of online security and identity. It's what I (on a good day) get paid for. So I guess I've thought more than you about the kind of issues they're trying to deal with.

Share this post


Link to post
Share on other sites

But there has to be a balance. A site that you can't get onto because of excess security is as much use as a chocolate teapot and judging from some of the comments I got from HMRC staff I am not alone in my frustration.

Turning up at the HMRC office with my passport is not a sensible option.

Come to think of it, the fact that the second of the FAQs in their email to me was

Can I opt out of an identity check?
No, it is an essential security requirement to maintain the security of your tax account.
speaks volumes.
Why can't we opt out of the highest level security if we wish, it's our personal information after all.

Share this post


Link to post
Share on other sites

But there has to be a balance. A site that you can't get onto because of excess security is as much use as a chocolate teapot and judging from some of the comments I got from HMRC staff I am not alone in my frustration.

Turning up at the HMRC office with my passport is not a sensible option.

Come to think of it, the fact that the second of the FAQs in their email to me was

No, it is an essential security requirement to maintain the security of your tax account.
speaks volumes.
Why can't we opt out of the highest level security if we wish, it's our personal information after all.

Quite.

My personal annoyance are websites that require particular combinations of letters, numbers, cases and length that suit neither my everyday password nor my security password so I have to make one up which I won't remember (or even try to remember) and know that every time I visit I will need to go through a password reset procedure.

As per your case they should not be applying these rules. If I wish to use as my password "password" then that's up to me. (I don't).

Share this post


Link to post
Share on other sites

Quite.

My personal annoyance are websites that require particular combinations of letters, numbers, cases and length that suit neither my everyday password nor my security password so I have to make one up which I won't remember (or even try to remember) and know that every time I visit I will need to go through a password reset procedure.

As per your case they should not be applying these rules. If I wish to use as my password "password" then that's up to me. (I don't).

I'm sure the answer from the person in charge of HMRC site security would be...

"No, you'll do as you're told, it's for your own good".

Share this post


Link to post
Share on other sites

And what about this one?

What if I am retired, I do not have a P60?
If you receive a private pension your pension provider should give you a P60 showing how much tax you paid.
What if you're retired and don't have a private pension? You will not be able to log onto your HMRC account if they ask a question about your P60 because one will not have been issued one.
What was it they use to say? "Tax doesn't have to be taxing".

Share this post


Link to post
Share on other sites

  • Recently Browsing   0 members

    No registered users viewing this page.

  • The Prime Minister stated that there were three Brexit options available to the UK:   62 members have voted

    1. 1. Which of the Prime Minister's options would you choose?


      • Leave with the negotiated deal
      • Remain
      • Leave with no deal

    Please sign in or register to vote in this poll. View topic


×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.