Impossible extra security checks with government Gateway doing SA

[Bouleversee]

I don't know how to record the call. I don't have a smart phone. Just using my house phone, one of a Panasonic trio. I doubt if one can record on those.

[JohnB]

My second level complaint contact got back to me today, an excerpt from their message is

because cyber-crime is on the increase, we need to make sure that our customers’ data is secure and identity questions are a key way that we do this.  To access the online service, it is now mandatory for customers to verify their identity by answering verification questions from 2 identity sources. We did conduct intensive user testing before upgrading our security measures and the ones that we introduced are ‘industry standard’ and used by other companies. We are continuously looking at ways to improve our service and have already introduced additional sources to allow more customers to get through the identity check. We have now introduced a method that allows those who can’t complete identification to still be able to file their return online if they have previously enrolled for the online Self-Assessment service and filed Income Tax Returns online previously. Please login using the following link

So they have introduced a 'backdoor' which blows their security model open. I don't think its appropriate for me to quote the URL they gave me here. They have not addressed my concerns about indirect age discrimination about their choice of security questions.

As I've just submitted a paper tax return, I'm not in the mood at present to see if the link works.

[uspaul666]

We've all got till 28th Feb to submit returns...
BBC News - HMRC waives penalty for late filing of self-assessments
https://www.bbc.co.uk/news/business-55802865

[Bouleversee]

[quote="JohnB"]My second level complaint contact got back to me today, an excerpt from their message is: "because cyber-crime is on the increase, we need to make sure that our customers’ data is secure and identity questions are a key way that we do this.  To access the online service, it is now mandatory for customers to verify their identity by answering verification questions from 2 identity sources. We did conduct intensive user testing before upgrading our security measures and the ones that we introduced are ‘industry standard’ and used by other companies. We are continuously looking at ways to improve our service and have already introduced additional sources to allow more customers to get through the identity check. We have now introduced a method that allows those who can’t complete identification to still be able to file their return online if they have previously enrolled for the online Self-Assessment service and filed Income Tax Returns online previously. Please login using the following link"

So they have introduced a 'backdoor' which blows their security model open. I don't think its appropriate for me to quote the URL they gave me here. They have not addressed my concerns about indirect age discrimination about their choice of security questions.

As I've just submitted a paper tax return, I'm not in the mood at present to see if the link works.
(total recs 1)


I wish I had seen that before I spent ages (after 3 long calls on the phone) downloading the Self Assessment forms and supplementary pages and reading all the notes etc. OTOH the alternative they suggest might just have been that Verify procedure mentioned in other posts. (I'd be grateful if you would pm me the link they gave you in case my son gets stuck on his return, though he has had no problem logging in for that so far, and I might even try it myself out of curiosity.)

The third time I rang today, I was fortunate to get a highly intelligent and very helpful lady who at first said it was probably due to too many people using the system so near Jan. 31 but when I pointed out that my son wasn't having any problems getting on to his acct. asked what computer and browser he was using (apparently Chrome can cause problems). She suggested that if he had submitted his own details (I later established he hadn't) the computer memory might have stored them and reacted to the change. She suggested he should delete all his browser history and try again. He did this, also (since he has recently had a new computer) tried the exercise on the laptop he used last year, which is now in family use) and finally on my laptop and with each attempt things got worse.

The message you received suggests that everyone is being asked for extra security which simply is not true so why are old ladies the subject of this inquisition? Is it some half-baked attempt to prevent us, assuming we are all non compos mentis, from being defrauded of our money or getting tax refunds we are not really due to which fraudsters will somehow get their hands on? No idea but the system isn't working so I hope, John B, that you will persist in trying to get some sensible changes as I will. Many years ago, I campaigned intensively to get independent taxation for wives' investment income after finding that mine was taxed at my husband's marginal rate. You would not now believe that could ever have been the case, but it was; I found I was paying 70% (because my husband's family business had. rarely, had a particularly good year while Labour were in power), on any profit I made on letting a flat which I had bought and lived in before I married and borrowed to keep on as an investment after we started a family and needed more space. I think you will all agree that it was worth protesting about that and it is only if people are prepared to put in the time and effort that things will change.

Whatever the problem is with submitting tax returns on line needs to be resolved so anyone who has difficulties should alert the powers that be to the problem. I shall be writing to my MP as well as complaining to HMRC.

[XFool]

My second level complaint contact got back to me today, an excerpt from their message is

because cyber-crime is on the increase, we need to make sure that our customers’ data is secure and identity questions are a key way that we do this.  To access the online service, it is now mandatory for customers to verify their identity by answering verification questions from 2 identity sources.

Strange.

Does "To access the online service" mean to register to use the online service, or to log on to the online service?
Does "it is now mandatory for customers to verify their identity by answering verification questions from 2 identity sources." mean to verify identity to register to use the online service, or to log on to the online service? (Not via GG.)

We did conduct intensive user testing before upgrading our security measures and the ones that we introduced are ‘industry standard’ and used by other companies. We are continuously looking at ways to improve our service and have already introduced additional sources to allow more customers to get through the identity check. We have now introduced a method that allows those who can’t complete identification to still be able to file their return online if they have previously enrolled for the online Self-Assessment service and filed Income Tax Returns online previously. Please login using the following link

"We have now introduced a method that allows those who can’t complete identification to still be able to file their return online if they have previously enrolled for the online Self-Assessment service and filed Income Tax Returns online previously."

Yes. Surely that is simply log on using GG credentials! As I have just done.

https://www.gov.uk/log-in-file-self-assessment-tax-return/sign-in/prove-identity

How do you want to sign in?
You’ll need an account to prove your identity and complete your Self Assessment.

Sign in with Government Gateway
You’ll have a user ID if you’ve registered for Self Assessment or filed a tax return online before.

Sign in with GOV.UK Verify
You’ll have an account if you’ve already proved your identity with either Barclays, Digidentity, Experian, Post Office or SecureIdentity.

or

Register for Self Assessment
You must register before you can file your first tax return.

I still feel something is missing here.

[Bouleversee]

It sure is, XFool. I've submitted my return online without any difficulty for the past 2 years. Their explanation just does not stack up.

[mutantpoodle]

I submitted mine and my wifes again online for 19/20.......no exra security asked for.....no problems encountered
my son did his...just 2 weeks ago.........no extra security requested
will be interesting for daughter...as she has done online for years but for 19/20 had 'extras' so had to ask for paper form..
which all done...'next' year 20/21 she will be back for online return....we wait and see!

[bluedonkey]

Best to do tax returns earlier, say in June or July.

[dealtn]

Best to do tax returns earlier, say in June or July.

Why?

In my case the required inputs aren't available then, so I would be using estimates, which would need correcting later.

How is that better?

[Alaric]

You’ll have an account if you’ve already proved your identity with either Barclays, Digidentity, Experian, Post Office or SecureIdentity.

I tried the prove Identity thing and failed with some of these providers several years ago. Their systems seemed designed to fail as many as possible. From memory, they couldn't cope if you only had a paper driving licence from the 1980s or earlier, if your Android mobile phone didn't have one of the more recent Android versions and even if your credit cards all had marginally different versions of your name such as full name, partial full name with one initial, two initials or one initial.

On the other hand, Government Gateway, which I had signed up with before the Identity scheme, worked then and continues to work now.

[Bouleversee]

The incomprehensible thing about all this is that as well as inputting the correct id and password and putting in the access code they sent to my house phone, I found I have voice identification ("my voice is my password") which worked when I was put through to them on the phone yesterday so why didn't they just send me a message to ring them and use that instead of asking those idiotic questions? I couldn't submit my account online even after my voice had been recognised. The IT system seems to be divorced from the customer service system and the employees don't understand how the problems arise (though they are able to see how many times one has tried to get through these extra security questions and when access codes have been sent etc.) and can't override them in any way. They don't seem to be alerting the technical staff to the problems either so far as I can gather.

It can't just be due to system overload as others are able to log in and file returns without any problems and without being asked these extra questions.

[Bouleversee]

An article from Love Money re the deadline extension for on-line filing to February 28 has just popped up in my emails. It says the extension has bee granted because people are late on account of Covid. No hint that anything might be amiss at HMRC's end and no mention of these extra security questions. https://www.lovemoney.com/news/19520/ho ... e3headline

[JohnB]

The 'backdoor' did work for Mum, but as I don't believe in advertising security holes, I won't be quoting the URL. I have rejected the second level complaint justification I quoted before, and have escalated it to third level.

[Alaric]

I won't be quoting the URL

The regular Government Gateway for tax returns is
https://www.access.service.gov.uk/login/signin/creds
which I believe is the same as it's always been.

[Bouleversee]

The 'backdoor' did work for Mum, but as I don't believe in advertising security holes, I won't be quoting the URL. I have rejected the second level complaint justification I quoted before, and have escalated it to third level.

Very wise. I'm sure sending it to me by private message, as requested, would have been a huge security risk.

[Bouleversee]

I won't be quoting the URL

The regular Government Gateway for tax returns is
https://www.access.service.gov.uk/login/signin/creds
which I believe is the same as it's always been.

That is different from the one we have been using:

www.gov.uk/log-in-file-self-assessment-tax-return. Then scroll down to green button and sign in. This has worked fine in previous years. I imagine we got it from the gov. website. Certainly didn't make it up and son is still able to progress his return via that log-in address.

No point in asking JB whether the one that worked for his Mum was either this or yours or something different. As I have spent so long and so much coloured ink in printing out the forms, I shall press on with the paper return now I've finished my essential chores for the day and pay what I estimate to be the tax due and then I might have a shot with yours, Alaric. Thanks for sharing.

[Lootman]

Best to do tax returns earlier, say in June or July.

Why? In my case the required inputs aren't available then, so I would be using estimates, which would need correcting later. How is that better?

What inputs take that long? The only documents that have taken a long time for me are K-1 reports from US-traded LLPs and MLPs. So I got rid of those as it was annoying. My approach is that any investment that is complicated from a tax perspective goes in a tax-sheltered account.

I have most of my information each April 6th. My consolidated tax certificates arrive in early May. I wait 30 days after April 5th to be sure there are no trades in the same security within 30 days.

Then figure my accountant takes 3 weeks to complete the return. So early June is the norm although last year it was late due to Covid and both me and my accountant being slower.

It is "better" because you do not have to rush and panic in January as some are doing here. And if you want to do a paper return, as I do, then you have less time to do that anyway.

[SalvorHardin]

What inputs take that long? The only documents that have taken a long time for me are K-1 reports from US-traded LLPs and MLPs. So I got rid of those as it was annoying. My approach is that any investment that is complicated from a tax perspective goes in a tax-sheltered account.

I have most of my information each April 6th. My consolidated tax certificates arrive in early May. I wait 30 days after April 5th to be sure there are no trades in the same security within 30 days.

Me too. The big difference is that I don't bother to wait for the consolidated tax certificates (I have no interest paying deposit accounts and keep detailed record of all dividends as they arise). Also I avoid anything that creates a K-1 like the plague (Brookfield Asset Management occasionally spins off a company as a LLP - these shares are sold as soon as possible).

As all of my income is dividends, these are put into a spreadsheet purely for tax purposes whenever they are paid. This spreadsheet also gives me the summaries for the foreign income return. CGT calculations are done throughout the year as they arise. The covering letter is updated throughout the year when needed; in it I include notes to make it easier for the Revenue (and to highlight things which may cause questions, in particular detailed CGT calculations for complex histories such as foreign company spinoffs).

Bck in the days when the local tax office was open, I once managed to deliver my tax return there on April 6th

[Bouleversee]

And I wouldn't mind betting that you both have someone else doing the housekeeping, shopping, gardening etc. and don't have medical problems which leave you too exhausted after all that to face doing the returns especially if you don't know how to do spreadsheets. One thing I could cut out which would save me time, though not energy, is reading and writing posts on TLF. Might well do that.

[Lootman]

What inputs take that long? The only documents that have taken a long time for me are K-1 reports from US-traded LLPs and MLPs. So I got rid of those as it was annoying. My approach is that any investment that is complicated from a tax perspective goes in a tax-sheltered account.

I have most of my information each April 6th. My consolidated tax certificates arrive in early May. I wait 30 days after April 5th to be sure there are no trades in the same security within 30 days.

Me too. The big difference is that I don't bother to wait for the consolidated tax certificates (I have no interest paying deposit accounts and keep detailed record of all dividends as they arise). Also I avoid anything that creates a K-1 like the plague (Brookfield Asset Management occasionally spins off a company as a LLP - these shares are sold as soon as possible).

As all of my income is dividends, these are put into a spreadsheet purely for tax purposes whenever they are paid. This spreadsheet also gives me the summaries for the foreign income return. CGT calculations are done throughout the year as they arise. The covering letter is updated throughout the year when needed; in it I include notes to make it easier for the Revenue (and to highlight things which may cause questions, in particular detailed CGT calculations for complex histories such as foreign company spinoffs).

Back in the days when the local tax office was open, I once managed to deliver my tax return there on April 6th

Yes, I miss the walk-in tax offices. Everything was so easy back then.

There are two reasons I would not submit on April 6th. The first is what I said earlier. Unless I made no trades in the last 30 days of the tax year, I would want to be certain there isn't a new trade that invokes the 30-day rule. This could even be something involuntary like a corporate action. I got caught out that way once.

The second thing is that if I was keeping a spreadsheet of dividends and planning on using that for my return, which I do not, then I think I would still want to cross-check that against the CTC to reduce the risk of a transcription error finding its way into my return. (Of course, the CTC can be wrong as well).