Understanding Good Practice Guide (GPG) 45: Advocating Stronger Identity Check Standards to Protect Against Fraud

The highest ever volume of identity fraud cases was recorded in 2022, up 23% from 2021.[1] As consumers embrace the shift toward online transactions necessitated by the COVID pandemic, identity thieves continue to exploit this trend in order to perpetrate digital crime.  

As a result of fraudsters’ increasing sophistication, the challenge of validating and verifying provided identities is a growing challenge for cross-sector organisations and government bodies. And without standard identity verification processes in place, each organisation must determine whether their identity verification and fraud prevention tools are sufficient to adequately defend both their business and customers. To allay these risks, the UK government introduced the Good Practice Guide (GPG) 45, which is designed to help businesses and government bodies who interact with UK consumers to better confirm digital identities and mitigate the risk of fraud.

In an age where 52% of UK consumers are concerned about falling victim to identity fraud, and a further 13% have been directly impacted by it, organisations that follow GPG 45 guidance and take proactive steps to mitigate the risks of this type of fraud using robust, multi-layered controls stand to win out over competitors and defend their existing client base in challenging economic times.

In this blog, we discuss what GPG 45 is, what it means for your organisation, and how tools such as TruValidate™ Activity History can help support stronger identity check standards. 

What is the Good Practice Guide (GPG) 45?

GPG 45 is guidance issued by UK Government Digital Services for any organisation or government body that needs to verify the identities of customers, employees or other third parties. It establishes a framework for consistent digital identity verification, which has an outcomes-based focus to result in fewer organisations and services being susceptible to identity fraud.

While the guidance is not law, it provides key advice on how businesses can prove and verify identities against a range of confidence levels: the higher the confidence level required, the more robust the checks need to be. This confidence level can be established via a risk assessment, the result of which will establish the necessary checks the business or trusted third party identity document validation expert will need to carry out. 

Why was GPG 45 introduced? 

In response to growing identity fraud trends, GPG 45 was established to protect government bodies and wider businesses when checking the identities of their employees, customers or third parties acting on behalf of their organisations.

That threat is still prevalent today ─ in 2021 there were 226,000  reported cases of identity theft in the UK alone, a 22% increase from the number of cases reported in 2020.[2] And with financial losses associated with identity theft in the UK estimated to be £4 billion per year,[3] compliance with GPG 45 guidance is of growing importance for many organisations.

Why is GPG 45 important for organisations and government bodies? 

GPG 45 is fast becoming the standard for digital identity verification, namely because the guide acts as a foundation upon which any public body or organisation can build a digital identity scheme to ensure a set of verification standards. 

Businesses that fail to adhere to these standards risk losing out to competitors that uphold them. As the issue of digital identity verification deepens, with identity theft accounting for 68% of all cases on the National Fraud Database (NFD)[4], consumers are consistently opting to transact with organisations who value the security of their personal data. In fact, the security of personal data is now the top concern for 49% of UK consumers,[5] with a further 78% stating confidence their personal data is secure is “very important.”[6]

Not only is GPG 45 compliance an important right-to-win in many sectors, failure to follow its guidance could also leave organisations open to higher fraud risks, reputational damages, and impacts to their bottom lines.

Several case studies demonstrate the benefits of GPG45 compliance:

·       A study by the UK's National Fraud Authority found that businesses that implemented GPG 45 saw a 20% reduction in fraud losses

·       The Association for Payment Clearing Services found that businesses that implemented GPG 45 saw a 15% increase in customer satisfaction

Balancing digital identity verification with friction-right consumer journeys 

While the importance of validating online identities cannot be underestimated, it is also vital that fraud prevention leaders to consider how this can impact on the customer experience. As our reliance on and usage of online products accelerates with the digital age, consumer expectations for convenient, secure transactions continues to rise. While consumers demand security of their personal data, their willingness to tolerate the friction this sometimes necessitates is minimal.

In fact, 49% of consumers have abandoned an online application for a product because it took too much time to fill out the form, while a further 30% of consumers did the same because they didn’t trust their personal data would be secure.[7]

These findings emphasise the need for organisations to create consumer journeys that strike a vital balance between security and ease of use that many organisations struggle to achieve in practice. 

How to meet GPG 45 standards without impacting on customer journeys

TransUnion TruValidate™ Identity Verification solution enables organisations and government bodies to conduct robust Anti-Money Laundering (AML) and identity checks that help minimise risk from fraud. Allowing fraud prevention teams to confirm the authenticity of consumer-provided information against rich online and offline datasets, the solution helps businesses improve conversion rates, automate processes, and reduce fraud whilst streamlining customer journeys.

However, as many organisations are aware, there is never one silver bullet when it comes to tackling fraud ─ especially in cases where the customer journey is a priority. That is why many organisations adopt a range of solutions from our wider TruValidate fraud and identity suite. Designed to suit the needs of your business, our expert team of fraud analysts can develop a bespoke, friction-right offering that fits seamlessly into your existing fraud prevention strategy.

Introducing Activity History

The newest addition to TruValidate™ Identity Verification solution is the Activity History module, which supports GPG 45 standards and adds an extra layer of verification to protect against synthetic identities and identity theft of the deceased.

Forming part of an AML and ID check, Activity History returns historic evidence data to confirm that the information presented matches the individual has existed over time. This provides businesses with the flexibility to make assessments within their organisation’s risk profile without adding additional friction to customer journeys.  

Results are provided in a configurable scorecard to simplify decisioning and support your identity verification and fraud strategies.

How to check someone’s identity in line with GPG 45

An identity is a combination of attributes ─ such as a name, an address and a date of birth ─ that belong to a person. While one of these attributes on its own may not be enough to distinguish one identity from another, a combination of these attributes usually is. By confirming these attributes, organisations and government bodies are usually able to determine if an individual is who they say they are.

In order to ensure this, the identity verification process under GPG 45 is made up of 5 parts:

Why TransUnion?

TransUnion is a global information and insights company that makes trust possible in the modern economy. We do this by providing a comprehensive picture of each individual so they can be reliably and safely represented in the marketplace.

Our TruValidate suite of fraud and identity solutions helps organisations from multiple sectors to confidently identify genuine consumers and engage with them securely at each stage of the customer journey. Drawing on our identity, device and behavioural insights, we enable businesses to discover anomalies, assess risks and make more informed decisions so they can drive conversions, reduce fraud losses, and deliver enhanced, friction-right user experiences. 

For more information on how our TruValidate Identity Verification solutions can enhance your fraud prevention strategy, contact a member of our team.

[1] Identity fraud cases reach all-time high as cost-of-living crisis bites | Cifas

[2] Identity Fraud Annual Report 2021, CIFAS

[3] Identity theft is costing the British £4bn a year - TechHQ

[4] Fraudscape 2023 - Cifas

[5] TransUnion State of Omnichannel Fraud Report

[6] TransUnion State of Omnichannel Fraud Report

[7] TransUnion State of Omnichannel Fraud Report