Guidance

How to accept a vouch as evidence of someone’s identity

Published 22 October 2020

When you need to prove and verify someone’s identity, you must get evidence about the ‘claimed identity’ (who the person says they are).

A ‘vouch’ is one of the types of evidence you can collect. A person vouches for someone else by declaring they know them as the claimed identity. In this context, it’s not a guarantee of their character or financial status.

Example Sarah wants to use an online service to see her prescription history and reorder her medication. The receptionist at her GP’s office can give her access, but first the receptionist must check that Sarah is who she says she is.

If Sarah does not have her ID with her, one of the practice nurses can tell the receptionist that she recognises Sarah and is willing to vouch for her. In this case the receptionist can give Sarah access without asking for any further evidence.

You can combine a vouch with other evidence to get a higher level of confidence in someone’s identity.

A vouch can also be used as proof that the claimed identity has existed over time.

Accepting a vouch

You can accept a vouch that’s done using one or more of these methods:

• a secure digital system
• over the phone
• a written or printed document, like a letter or form
• an email
• face to face

Example Someone is opening a bank account, and they ask their employer to vouch for them. The employer will need to fill in a digital or paper form, then later take a call from the bank on a landline phone.

Accepting a vouch as evidence of someone’s identity

Vouches, along with other types of evidence, help you work out how confident you can be about someone’s identity. To do this, you must:

• check the information on the vouch and how it’s presented (do a ‘strength’ check)
• make sure the vouch is not forged or counterfeited (do a ‘validity’ check)

Physical vouches, such as letters, will usually be less reliable than digital vouches. Most digital vouches are created and shared using a secure system, which makes them harder to forge or counterfeit.

You can decide how recently a vouch must have been created before you will accept it. Vouches (including face to face vouches) can usually be used for up to 6 months after they are created.

Make sure the person who’s vouching knows what can happen if they vouch for someone that they know is using a synthetic or stolen identity. It’s up to you how to respond in that situation - for example, if you think the person gave a false vouch on purpose, you might decide to prosecute them or give them a fine. You’ll need to agree your response with your legal advisers before you can warn people about it.

Accepting a vouch as evidence an identity has existed over time

You can use a vouch to check the claimed identity has existed over time.

This is known as an ‘activity history’ check. It means you’re less likely to give access to a ‘synthetic’ (made up) identity.

When you cannot accept a vouch

You cannot use a vouch to do all parts of the identity checking process. You must separately check the identity:

• is not at risk of identity fraud (an ‘identity fraud’ check)
• belongs to the person who’s claiming it (a ‘verification’ check)

If you discover a vouch is for a synthetic or stolen identity, you cannot accept it.

Who can vouch for someone’s identity

You can only accept a vouch from someone when all of the following statements apply:

• they have an existing relationship with the claimed identity
• they are sure the claimed identity is who they say they are
• they are in a position of authority in their community
• they’ve proved their own identity to you

A vouch will be more reliable if the person who’s vouching has known the claimed identity over time. This is because it’s hard for someone to maintain a fraudulent identity over time without it being detected.

There’s no rule about how long a person has to know someone before they can vouch for them, but they must know the claimed identity well enough to be comfortable doing it.

Example A secondary school teacher can vouch for the identity of a pupil who’s applying for a proof of age card. They would have consistently seen this same pupil in school over a period of a few years.

The teacher can be sure that the pupil’s identity is real and that no one has pretended to be the pupil during their time at the school.

When you decide to accept vouches, you can set requirements for the relationship between the claimed identity and the person who’s vouching. This can include how long they’ve known each other for.

Example To vouch for someone’s photo when they’re applying for a British passport, the person who’s vouching must have known them for at least 2 years.

The person who’s vouching must also be in a position of authority in their community.

People in positions of authority are less likely to vouch for synthetic or stolen identities. They could risk damaging their reputation or losing their position if they do.

Examples of people who are in a position of authority include:

• teacher
• doctor
• solicitor
• company director

Check the complete list of people who can vouch for someone’s identity.

You can still accept a vouch from someone in a position of authority if their relationship with the claimed identity is not professional.

Example A solicitor can vouch for the identity of their neighbour. The solicitor knows this person is who they say they are because they’ve lived next door to them over a period of a few years. It does not matter that they’re not one of the solicitor’s clients.

You must check the identity of the person who’s doing the vouch before you accept their vouch. You can trust a vouch more if you have greater confidence in the identity of the person who’s vouching, but you might not always need a high level of confidence.

Who cannot vouch for someone’s identity

You must not accept a vouch from anyone who:

• is related to the claimed identity by birth, marriage or another family relationship (such as adoption)
• is in a relationship with the claimed identity
• lives at the same address as the claimed identity
• you know has given a false vouch in the past 5 years

Face to face vouches

A face to face vouch can take place in person or remotely.

A face to face vouch must involve:

• the claimed identity
• the person who’s vouching
• whoever’s accepting the vouch

You cannot accept a face to face vouch without the claimed identity being present, even if the person who’s vouching has a photo of them. If this happens, you should treat it as a vouch done by another method, for example a letter.

Everyone present must know the vouch is happening and actively take part.

How face to face vouches work

The person who’s vouching must prove their identity to whoever’s accepting the vouch. They then declare that they know the person they are vouching for is the claimed identity.

While everyone’s still present, whoever’s accepting the vouch must record:

• their own name and position
• the time and date
• who was there
• who made the declaration and what they said

Example Someone who works for a credit union might be able to vouch for a customer who wants to set up a bank account.

The person who works for the credit union will need to accompany the customer to the bank. They will need to take some documents with them, such as the customer’s birth certificate or proof of any transactions they’ve had with the credit union.

Once the person who’s vouching has proved they work for the credit union, the bank will ask them to confirm that:

• the documents belong to the customer
• they believe the customer is the claimed identity

The bank must keep a record of the identity of the person who works for the credit union, the claimed identity and any documents they brought with them.

They can use this record as evidence of the customer’s identity and set up an account for them.

The official record of a face to face vouch is evidence of the claimed identity. Once you have a record of a face to face vouch, you must check it for strength and check it for validity.

If you use a face to face vouch straight away, it will probably be more reliable than any other type of vouch. This is because you can be confident it’s genuine and has not expired.

Rules for face to face vouches

You must always be able to clearly see the claimed identity’s face during the vouch. This will lower the risk of accepting a vouch for someone who’s wearing a mask, makeup or prosthetics to pretend to look like the claimed identity. They must not:

• wear a head covering (unless it’s for religious or medical reasons)
• have their eyes closed
• have anything covering their face or eyes (such as shadows or their hair)

If someone is wearing a face covering to help prevent the spread of coronavirus, you can ask them to take it off to be identified. You can also choose to do the process remotely instead.

If the vouch is taking place remotely, the video of the claimed identity must:

• be clear and in focus
• be in colour
• show them in clear contrast to the background

Situations that are not vouches or cannot be used as evidence of someone’s identity

Some things are similar to a vouch. They are useful in particular contexts but cannot be used as evidence of someone’s identity in the same way that a vouch can.

A parent or guardian applying for something on behalf of a child is not a vouch.

Example Jermaine takes his 12-year-old daughter to the bank to open an account in her name. As part of the application process, Jermaine will have to prove his identity.

Although this situation is similar to a face to face vouch, it’s either a custodial application or a joint one (depending on the type of account).

An organisation cannot vouch for someone’s identity.

Example A secondary school teacher can vouch for the identity of a pupil who’s applying for a proof of age card. The school itself cannot vouch for the pupil’s identity.

The vouch has to be created by a named person. This means they can answer questions if the claimed identity turns out to be false. It also helps to make sure that the person who’s doing the vouch is in a position of authority and has an existing relationship with the claimed identity - for example, it’s only appropriate for the teacher to vouch for a pupil they recognise.

Confirming an attribute can also be referred to as ‘vouching’. It’s not the same thing as vouching for someone’s identity, and the person who’s vouching does not need to have an existing relationship with the claimed identity.

Example Agnieszka works in HR and is vetting someone who’s applied for a job. As part of the process she has to check the applicant’s education history.

Agnieszka contacts an administrator at the applicant’s university, and the administrator confirms the applicant’s degree and dates of study. The administrator uses the school’s records to do this because they do not know the applicant personally.

This type of vouch cannot be used as evidence of someone’s identity, but it can be used as evidence that the claimed identity has existed over time.

Vouches that confirm an attribute can be done by an individual or by someone representing an organisation.