Understanding Good Practice Guide (GPG) 45: Advocating Stronger Identity Check Standards to Protect Against Fraud

Understanding GPG 45

The highest ever volume of identity fraud cases was recorded in 2022, up 23% from 2021.[1] As consumers embrace the shift toward online transactions necessitated by the COVID pandemic, identity thieves continue to exploit this trend in order to perpetrate digital crime.  

As a result of fraudsters’ increasing sophistication, the challenge of validating and verifying provided identities is a growing challenge for cross-sector organisations and government bodies. And without standard identity verification processes in place, each organisation must determine whether their identity verification and fraud prevention tools are sufficient to adequately defend both their business and customers. To allay these risks, the UK government introduced the Good Practice Guide (GPG) 45, which is designed to help businesses and government bodies who interact with UK consumers to better confirm digital identities and mitigate the risk of fraud.

In an age where 52% of UK consumers are concerned about falling victim to identity fraud, and a further 13% have been directly impacted by it, organisations that follow GPG 45 guidance and take proactive steps to mitigate the risks of this type of fraud using robust, multi-layered controls stand to win out over competitors and defend their existing client base in challenging economic times.

In this blog, we discuss what GPG 45 is, what it means for your organisation, and how tools such as TruValidate™ Activity History can help support stronger identity check standards. 


What is the Good Practice Guide (GPG) 45?

GPG 45 is guidance issued by UK Government Digital Services for any organisation or government body that needs to verify the identities of customers, employees or other third parties. It establishes a framework for consistent digital identity verification, which has an outcomes-based focus to result in fewer organisations and services being susceptible to identity fraud.

While the guidance is not law, it provides key advice on how businesses can prove and verify identities against a range of confidence levels: the higher the confidence level required, the more robust the checks need to be. This confidence level can be established via a risk assessment, the result of which will establish the necessary checks the business or trusted third party identity document validation expert will need to carry out. 


Why was GPG 45 introduced? 

In response to growing identity fraud trends, GPG 45 was established to protect government bodies and wider businesses when checking the identities of their employees, customers or third parties acting on behalf of their organisations.

That threat is still prevalent today ─ in 2021 there were 226,000  reported cases of identity theft in the UK alone, a 22% increase from the number of cases reported in 2020.[2] And with financial losses associated with identity theft in the UK estimated to be £4 billion per year,[3] compliance with GPG 45 guidance is of growing importance for many organisations.


Why is GPG 45 important for organisations and government bodies? 

GPG 45 is fast becoming the standard for digital identity verification, namely because the guide acts as a foundation upon which any public body or organisation can build a digital identity scheme to ensure a set of verification standards. 

Businesses that fail to adhere to these standards risk losing out to competitors that uphold them. As the issue of digital identity verification deepens, with identity theft accounting for 68% of all cases on the National Fraud Database (NFD)[4], consumers are consistently opting to transact with organisations who value the security of their personal data. In fact, the security of personal data is now the top concern for 49% of UK consumers,[5] with a further 78% stating confidence their personal data is secure is “very important.”[6]

Not only is GPG 45 compliance an important right-to-win in many sectors, failure to follow its guidance could also leave organisations open to higher fraud risks, reputational damages, and impacts to their bottom lines.

Several case studies demonstrate the benefits of GPG45 compliance:

·       A study by the UK's National Fraud Authority found that businesses that implemented GPG 45 saw a 20% reduction in fraud losses

·       The Association for Payment Clearing Services found that businesses that implemented GPG 45 saw a 15% increase in customer satisfaction


Balancing digital identity verification with friction-right consumer journeys 

While the importance of validating online identities cannot be underestimated, it is also vital that fraud prevention leaders to consider how this can impact on the customer experience. As our reliance on and usage of online products accelerates with the digital age, consumer expectations for convenient, secure transactions continues to rise. While consumers demand security of their personal data, their willingness to tolerate the friction this sometimes necessitates is minimal.

In fact, 49% of consumers have abandoned an online application for a product because it took too much time to fill out the form, while a further 30% of consumers did the same because they didn’t trust their personal data would be secure.[7]

These findings emphasise the need for organisations to create consumer journeys that strike a vital balance between security and ease of use that many organisations struggle to achieve in practice. 


How to meet GPG 45 standards without impacting on customer journeys

TransUnion TruValidate™ Identity Verification solution enables organisations and government bodies to conduct robust Anti-Money Laundering (AML) and identity checks that help minimise risk from fraud. Allowing fraud prevention teams to confirm the authenticity of consumer-provided information against rich online and offline datasets, the solution helps businesses improve conversion rates, automate processes, and reduce fraud whilst streamlining customer journeys.

However, as many organisations are aware, there is never one silver bullet when it comes to tackling fraud ─ especially in cases where the customer journey is a priority. That is why many organisations adopt a range of solutions from our wider TruValidate fraud and identity suite. Designed to suit the needs of your business, our expert team of fraud analysts can develop a bespoke, friction-right offering that fits seamlessly into your existing fraud prevention strategy.

Introducing Activity History

The newest addition to TruValidate™ Identity Verification solution is the Activity History module, which supports GPG 45 standards and adds an extra layer of verification to protect against synthetic identities and identity theft of the deceased.

Forming part of an AML and ID check, Activity History returns historic evidence data to confirm that the information presented matches the individual has existed over time. This provides businesses with the flexibility to make assessments within their organisation’s risk profile without adding additional friction to customer journeys.  

Results are provided in a configurable scorecard to simplify decisioning and support your identity verification and fraud strategies.


How to check someone’s identity in line with GPG 45

An identity is a combination of attributes ─ such as a name, an address and a date of birth ─ that belong to a person. While one of these attributes on its own may not be enough to distinguish one identity from another, a combination of these attributes usually is. By confirming these attributes, organisations and government bodies are usually able to determine if an individual is who they say they are.

In order to ensure this, the identity verification process under GPG 45 is made up of 5 parts:


Obtain evidence of the claimed identity 

TruValidate Identity Verification solutions confirm and verify the authenticity of consumer information against rich datasets including credit and non-credit data. These identity checks deliver robust evidence that a claimed identity is genuine, has existed over time and belongs to the individual making the claim.


Verify that the evidence is genuine or valid

TruValidate Document Verification and Facial Biometrics solution allows organisations to verify customers quickly and effectively by utilising passive liveness capture, NFC and auto capture and one-to-many matching.


Ascertain that the claimed identity has existed over time

TransUnion’s Activity History module evidences that an identity has existed over time by returning historic evidence data.


Assess whether the claimed identity is at high risk of identity fraud

Discern between risky transactions and trusted digital connections using device intelligence and behaviour technology using TruValidate Device Risk with Behavioural Analytics. Leverage device history, device-to-device and device-to account associations based on confirmed fraud reports from our global network alongside crowd level behavioural insights, powered by NeuroID.


Check that the identity belongs to the person who’s claiming it

The TruValidate fraud suite has several solutions to help verify that an identity belongs to the person who is claiming it:

  • Identity Verification – Utilises a configurable risk scorecard to simplify decisioning and help organisations to make accurate identity decisions that minimise fraud and money laundering risk.
  • Document Vericifcation & Facial Biometrics – quickly and effectively verify customers by analysing captured data to flag fraud concerns.
  • Email and phone verification – increases confidence in presented identities by verifying provided phone numbers and email addresses with no additional friction for genuine customers.


Why TransUnion?

TransUnion is a global information and insights company that makes trust possible in the modern economy. We do this by providing a comprehensive picture of each individual so they can be reliably and safely represented in the marketplace.

Our TruValidate suite of fraud and identity solutions helps organisations from multiple sectors to confidently identify genuine consumers and engage with them securely at each stage of the customer journey. Drawing on our identity, device and behavioural insights, we enable businesses to discover anomalies, assess risks and make more informed decisions so they can drive conversions, reduce fraud losses, and deliver enhanced, friction-right user experiences. 

For more information on how our TruValidate Identity Verification solutions can enhance your fraud prevention strategy, contact a member of our team.



[1] Identity fraud cases reach all-time high as cost-of-living crisis bites | Cifas

[2] Identity Fraud Annual Report 2021, CIFAS

[3] Identity theft is costing the British £4bn a year - TechHQ

[4] Fraudscape 2023 - Cifas

[5] TransUnion State of Omnichannel Fraud Report

[6] TransUnion State of Omnichannel Fraud Report

[7] TransUnion State of Omnichannel Fraud Report

If you’re a consumer with questions or issues related to your personal credit report, drivers history report, disputes, fraud, identity theft, credit report freeze or credit monitoring services, please visit our Customer Enquiries page for assistance.

Contact Us

TransUnion would like to send you original insight, commentary and research on data, software and analytics, early notifications of exclusive events and information about our products and services. If you would like to receive that information, please let us know using the following options:

Business enquiries: If you have a non-sales related query please call us on (+44) 0113 388 4300

Please read our privacy notice , which explains who we are, how we collect and use your personal information and how you can exercise your privacy rights.

We're sorry, your request failed. Please try again in a little while.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.