IPS: Card Validation Service

David Moss · **Joined:** Sat, 07 Apr 2007 10:29:05 +0000 **Posts:** 2842

http://www.ips.gov.uk/cps/rde/xchg/ips_live/hs.xsl/1241.htm

Quote:

Card Validation Service

You may be aware that IPS already offers approved organisations the ability to validate British passports via our Passport Validation Service as part of our commitment to fight fraud and support UK business. From later this year approved organisations will also be able to validate identity cards against the National Identity Register maintained by IPS.

Introducing the Card Validation Service
The Card Validation Service allows approved organisations to check the validity of an identity card and helps prove the identity of the card holder. With the consent of the card holder, approved organisations will be able to contact IPS to check the card is genuine and to confirm the details against those held on our records. This service provides assurance of the validity of the document presented and helps prevent the use of lost, stolen or counterfeit identity cards.

Key benefits of the service:
* A simple call centre service providing excellent customer service
* Provides high level of assurance as checks are made against the issuing authority's records
* Real time verification - for the majority of checks, a straightforward response in minutes
* Dedicated fraud support services
* Easy to understand training material and no system development required

Find out more
If you would like to discuss CVS or future potential verification services, please contact the Market Development Team on 020 3356 8117 or email the team at IDservices@ips.gsi.gov.uk.

David Moss · **Joined:** Sat, 07 Apr 2007 10:29:05 +0000 **Posts:** 2842

Some details on the Passport Validation Service (PVS) referred to above, as opposed to the Card Validation Service, are available on the IPS website.

PVS has already been discussed a little on this forum. May I add this:

David Moss · **Joined:** Sat, 07 Apr 2007 10:29:05 +0000 **Posts:** 2842

Any commentator in the broadcast media or the press tempted to misinterpret Gordon Brown's speech at the Labour party conference last week, to the effect that Labour has now abandoned ID cards, may care to ask himself or herself why, in the same week, the card validation service was trailed and IDSmart was launched.

capnbob · **Posted:** Sun, 04 Oct 2009 10:13:19 +0000

IPS wrote:

With the consent of the card holder, approved organisations will be able to contact IPS to check the card is genuine and to confirm the details against those held on our records.

Is the approved organisation going to be required to hand the phone to me, so that I can confirm my mother's maiden name (or some other "shared secret")? If not, then how will they verify consent? The call could be a fishing expedition to find out if a stolen card still works.

When Chelsea used PVS, David, did PVS talk to you at all?

David Moss · **Joined:** Sat, 07 Apr 2007 10:29:05 +0000 **Posts:** 2842

capnbob wrote:

When Chelsea used PVS, David, did PVS talk to you at all?

No.

See How the Passport Validation Service works:

Quote:

As part of our commitment to supporting UK business, we operate the Passport Verification Service (PVS) to support public and private sector organisations in preventing fraud.

IPS operates a 'green, amber, red' system to establish the validity of a passport through PVS.

Our clients make enquiries to our central team either via a call centre or secure systems. If a passport is validated, we can confirm that the passport exists, matches our records, has not been reported lost/stolen and that we have no concerns over its issue.

If a passport is not validated, it may be because the passport is either expired or cancelled (e.g. due to a change of name). A 'not validated - retain if possible' response means that the document is fraudulent. In the event of an attempted fraud, our staff will direct customers to a member of the IPS Fraud Team who can further assist.

Government agencies use access our PVS via a highly secure, read-only system. This system uses the Government Secure Intranet (GSI) (and selected secure government networks) to access passport data, which is made available through a web browser. All access given to government departments is in accordance with the Data Protection Act 1998.

The dialogue is entirely between the building society's registration system and the GSI.

If his screen had displayed "retain if possible", presumably the manager would have had to decide whether he could overpower me or at least detain me for long enough to get a policeman into the office, or simply apologise that unfortunately he was not able to open the account.

Tenchy, not logged in · **Posted:** Sun, 04 Oct 2009 11:21:50 +0000

David Moss wrote:

Some details on the Passport Validation Service (PVS) referred to above, as opposed to the Card Validation Service, are available on the IPS website.

PVS has already been discussed a little on this forum. May I add this:

So an excellent reason to never use your passport to identify yourself. Use your driving licence (do DVLA offer a similar service?) Or better still, use some other form of identification. Have you noticed how the banks are now falling over themselves to accept as many different types of document as possible - presumably they've previously lost business as a result of the stupid requirements they had.

FishNChipPapers · **Joined:** Fri, 20 Jul 2007 14:56:11 +0000 **Posts:** 1948

Tenchy, not logged in wrote:

(do DVLA offer a similar service?)

None that my research investigating another DVLA-related issue (see http://forum.no2id.net/viewtopic.php?p=111427#111427) revealed. Bogtrotter1 may now otherwise.

FishNChipPapers · **Joined:** Fri, 20 Jul 2007 14:56:11 +0000 **Posts:** 1948

David Moss wrote:

Any commentator in the broadcast media or the press tempted to misinterpret Gordon Brown's speech at the Labour party conference last week, to the effect that Labour has now abandoned ID cards, may care to ask himself or herself why, in the same week, the card validation service was trailed and IDSmart was launched.

Any why only a few weeks before it announced the appointment of the commissioner and days before a new £554,000 advertising scheme.

Tenchy · **Posted:** Sun, 04 Oct 2009 17:11:09 +0000

The passport validation service is one that should be avoided if possible. In fact, it might be said to be "good practice" (apologies for use of that ridiculous term) to do so. Just imagine, you go into the bank to get some foreign currency, hand over your passport, they "validate" it, and there's an error - so they retain it! Bang goes your holiday!

Like I said above, use some other form of identification - never your passport - if this is the way institutions arr now carrying on. Anyway, if the modern passport can't be forged, why do they need to be validated?

JamesElsdon_Baker · **Joined:** Fri, 28 Mar 2008 16:50:58 +0000 **Posts:** 692

Tenchy wrote:

The passport validation service is one that should be avoided if possible. In fact, it might be said to be "good practice" (apologies for use of that ridiculous term) to do so. Just imagine, you go into the bank to get some foreign currency, hand over your passport, they "validate" it, and there's an error - so they retain it! Bang goes your holiday!

Like I said above, use some other form of identification - never your passport - if this is the way institutions arr now carrying on. Anyway, if the modern passport can't be forged, why do they need to be validated?

Quite, if ID cards can't be forged then the validation service is pointless. If they can be forged then seeing as most people won't use the service all the time they will make flash and dash fraud easier to committ.

Allready you have all these call centre staff involved in something that was just orginally going to be a biometric check. So instead we have this which is different than what we had allready with passports how?

capnbob · **Posted:** Sun, 04 Oct 2009 18:15:37 +0000

Woah, just a minute guys. Validation against central records is exactly what banks do with credit and debit cards; and yes, it does add security. Nothing wrong with validation as such.

The real question is whether we would trust IPS to do it competently, hold transaction records responsibly, and repair our identities swiftly if there were any problem. And, with good reason, we don't. That is the problem.

FishNChipPapers · **Joined:** Fri, 20 Jul 2007 14:56:11 +0000 **Posts:** 1948

capnbob wrote:

Woah, just a minute guys. Validation against central records is exactly what banks do with credit and debit cards; and yes, it does add security. Nothing wrong with validation as such.

Isn't there an important difference though. I would expect my bank to know about my credit card transactions - and that's all they should know about. I would not expect the IPS to know about my opening a new bank account; obtaining a mortgage etc. For any validation service to have value to both parties there must be an audit trail to address disputes and provide additional security.

capnbob · **Posted:** Mon, 05 Oct 2009 13:04:13 +0000

Agreed, Fishy, hence my second para!

FishNChipPapers · **Joined:** Fri, 20 Jul 2007 14:56:11 +0000 **Posts:** 1948

Sorry if I misunderstood. I took your comments to be highlighting the question of whether or not we can trust IPS to manage the data effectively and to deal with problems arise as a result of failure in that management rather than the fact that a consequence of the validation service is that IPS maintains an audit trail which allows them to track activities beyond the issuance of passports and ID cards (in contrast to the situation with the bank)

Kibby · **Posted:** Mon, 05 Oct 2009 14:21:54 +0000

Can anyone confirm if the IPS retain data relating to each approved organisation enquiry? And if they do what information is retained?
I have a feeling (and all respects to David) that there is nothing by way of an electronic trail created and the conversation between the organisation and the IPS is...
" I have a passport number here with such and such name and DOB attached-can you confirm that is correct?"
...and not as in Where Eagles Dare, "Ask him where he got the scar on his forearm?"

I hope I am right and this is a non story.

David Moss · **Joined:** Sat, 07 Apr 2007 10:29:05 +0000 **Posts:** 2842

Kibby wrote:

Can anyone confirm if the IPS retain data relating to each approved organisation enquiry?

Good question.
FOI request submitted to hqenquiries@ips.gsi.gov.uk:

Quote:

Re: Passport Validation Service (PVS), http://www.ips.gov.uk/cps/rde/xchg/ips_ ... sl/563.htm

Suppose that someone opens an account with a building society which uses PVS. Suppose that that person's passport number is sent to PVS and the passport is validated.

Does the Identity & Passport Service retain the name of the building society and the passport number, together with the date and time of the application to PVS and the response from PVS?

If so, for how long is this data retained? Is this linked to the National Identity Register and/or is it proposed that it should be linked to the National Identity Register? And who has access to the data?

If not, what data is retained and for how long?

Guest · **Posted:** Mon, 05 Oct 2009 15:09:59 +0000

FishNChipPapers wrote:

capnbob wrote:

Woah, just a minute guys. Validation against central records is exactly what banks do with credit and debit cards; and yes, it does add security. Nothing wrong with validation as such.

Isn't there an important difference though. I would expect my bank to know about my credit card transactions - and that's all they should know about. I would not expect the IPS to know about my opening a new bank account; obtaining a mortgage etc. For any validation service to have value to both parties there must be an audit trail to address disputes and provide additional security.

You could also argue about the difference between a private validation service that users and organizations trust and choose to use and a bureaucratic monopoly enforced by the state.

David Moss · **Joined:** Sat, 07 Apr 2007 10:29:05 +0000 **Posts:** 2842

Answer for Kibby.

Received by email, 18 November 2009 18:49 (about 12 days late):

Quote:

Reference: FOICR 12976/09

Date: 17 November 2009

Dear Mr Moss

FREEDOM OF INFORMATION REQUEST

Thank you for your email of 5 October in which you asked for information about the Passport Verification Service (PVS).

I am pleased to be able to disclose the information that you requested to you.

... <text of request> ...

The Identity and Passport Service (IPS) response is:-

1. IPS retains details of passport checks carried out by legal and financial services firms through the Passport Validation Service (PVS) call centre. This includes the organisation name, the passport number, the date and time of the passport check and the outcome.

2. The current process is for the data to be retained by IPS 36 months from the date of enquiry; after which it is destroyed.

3. Access to this data is restricted to IPS staff that has responsibilities for the delivery of PVS.

4. Data may be held for longer periods and shared more widely, if required, for the purposes of the investigation and detection of crime and/or passport fraud, and the protection of national security.

5. Data held for passport purposes is not currently linked to the National Identity Register (NIR). However, at some point in the future, it is intended that passports will be designated under the Identity Cards Act 2006. Where an individual applies for a designated document, the Identity Card Act requires that individual to also make an application to be entered on to the NIR.

...

FishNChipPapers · **Joined:** Fri, 20 Jul 2007 14:56:11 +0000 **Posts:** 1948

Interesting. Does point 4 potentially allow them to retain the information indefinitely just in case a crime is committed after the 36 months or do they only retain it beyond 36 months to support investigations that are ongoing at the time the data should be destroyed.

Also, does 5 actually answer the question. Having to be registered on the NIR because a passport is designated doesn't indicate whether or not their is linkage between the databases.

Harlequin · **Joined:** Fri, 24 Jun 2005 22:49:50 +0000 **Posts:** 1248

capnbob wrote:

IPS wrote:

With the consent of the card holder, approved organisations will be able to contact IPS to check the card is genuine and to confirm the details against those held on our records.

Is the approved organisation going to be required to hand the phone to me, so that I can confirm my mother's maiden name (or some other "shared secret")? If not, then how will they verify consent? The call could be a fishing expedition to find out if a stolen card still works.

When Chelsea used PVS, David, did PVS talk to you at all?

I assume what will happen is that the line taken will be that by virtue of requesting organisation contacting the IPS in order to conduct the validation process, you will have by that stage have given your consent.

In practice, it will go something like this ...

[REQUESTING ORGAISATION]: "In order to continue with this service/sell you this product (delete as appropriate), we will need to validate your identity. Do we have you consent to conduct to do so?"

[IDENTITY SUBJECT]: "Errm, yes, OK"

[online validateion process conduct, with positive result returned]

[product/service sold to identity subject]

Of course what this scenario doesn't address is whether, having established this validation service and then making it available to private businesses, said business will then be allowed to make the offering of your consent to conduct an ID validation (note I didn't say "authentication" as these two things are logically distinct) a condition of sale.

Doubtless a great many businesses will do so and will argue that you have a choice about where you shop and they have a right to impose the aforesaid condition to any sales.

I for one wont be patronising any business that insists on this - even if it later becomes the case that there is a legal obligation to do so.

Harlequin · **Joined:** Fri, 24 Jun 2005 22:49:50 +0000 **Posts:** 1248

David Moss wrote:

Answer for Kibby.

Received by email, 18 November 2009 18:49 (about 12 days late):

Quote:

Reference: FOICR 12976/09

Date: 17 November 2009

Dear Mr Moss

FREEDOM OF INFORMATION REQUEST

Thank you for your email of 5 October in which you asked for information about the Passport Verification Service (PVS).

I am pleased to be able to disclose the information that you requested to you.

... <text of request> ...

The Identity and Passport Service (IPS) response is:-

1. IPS retains details of passport checks carried out by legal and financial services firms through the Passport Validation Service (PVS) call centre. This includes the organisation name, the passport number, the date and time of the passport check and the outcome.

2. The current process is for the data to be retained by IPS 36 months from the date of enquiry; after which it is destroyed.

3. Access to this data is restricted to IPS staff that has responsibilities for the delivery of PVS.

4. Data may be held for longer periods and shared more widely, if required, for the purposes of the investigation and detection of crime and/or passport fraud, and the protection of national security.

5. Data held for passport purposes is not currently linked to the National Identity Register (NIR). However, at some point in the future, it is intended that passports will be designated under the Identity Cards Act 2006. Where an individual applies for a designated document, the Identity Card Act requires that individual to also make an application to be entered on to the NIR.

...

On this basis .... I wont ever use my passport to open a new bank account.

NO2ID

IPS: Card Validation Service

Who is online