Editorial

To vouch or not to vouch…that is the question

Susan Morrow digital identity advisor to TDP, shares her thoughts on why ‘vouching’ can be a positive addition to an online identity service

Posted 12 December 2023 by Matt Stanley


I had a recent bad experience of vouching that I recorded in a blog post I wrote for Think Digital Partners; I spent a week going to and fro, trying to find an entity to vouch for my identity. Ironically, I have been involved in vouching systems going back a decade. My first foray into vouching was for the Skills Funding Agency (SFA). The underlying identity system had matching issues because the demographic (16-25) had ‘thin files,’ i.e., they could not be verified using conventional methods such as credit reference agency checks. So, alternative pathways had to be found. For the SFA, vouching options involved Face-to-Face (F2F) identity document presentation at the Post Office, or a letter sent to an address. Since then, technological and protocol advances have allowed vouching playing field options to expand. Here are some of the state-of-the-art in vouching.

Why do we need vouching?

Online identity has been revolutionary in creating a framework to allow digital government to thrive. But it only works for some, and governments must accommodate us all. Often, ‘edge cases’ require vouching as an alternative pathway for those that cannot be verified easily: citizens who don’t have a digital footprint, prefer not to interact online, or do not have a smartphone or access to the internet. Vouching offers these people an alternative way to prove their identity and interact safely with government services.

However, verifying people online has been shown to fail in comprehensive verification across the wide demographic covered by government services. Data insights into online verification from the National Audit Office (NAO) provide evidence of this failing, with statistics from GDS showing a “verification success rate of 48 percent at the beginning of February 2019, against a 2015 projection of 90 percent.”

A quick Google search shows up the reality of online verification for many:

I found this on the HMRC public forum:

https://community.hmrc.gov.uk/customerforums/sa/62bc0d18-9f80-ed11-97b2-00155d3ba57b

And the subsequent impact of handling disgruntled citizens on government staff is rarely recorded. 

Vouching is a positive addition to an online identity service as it typically increases match rates. When Avoco added F2F and post-based verification pathways to the online identity service, the match rates increased by around 10% from a baseline of 73%.

Reputation is a fundamental aspect of vouching

Reputation is an intrinsic aspect of human society; human behaviour has evolved to encourage group interactions that benefit the entire group. For example, cooperation depends on behaviours such as reputation, moral expectations, social pressures, kinship, and strategic positioning. Through these mechanisms, individuals recognise each other and act accordingly. Similarly, identity vouching uses reputation as a mechanism to assure that someone is who they say they are. As such, the vouching entity must have a high enough reputation to underpin the system. Doctors, schools, and solicitors spring to mind. However, any entity could potentially be co-opted into the system if they can offer evidence of a good reputation.

How this reputation is established is just one part of a more complex system of vouching. ‘Orchestration and decisioning’ technology is an essential part of this system. It provides the connectivity to pull all the system’s moving parts together: the vouching entity itself must be verified; individuals who act within the vouching entity must be verified. This verification chain must then be expressed in a service accessible by the citizens it is there to represent.

Reputation as a vouching entity sits in an apex position; once established, this entity then has the right to vouch.

The citizen and vouching channels

Reputational evidence to establish the right to vouch is one side of the vouching equation. The other side is why the system has been developed – to serve citizens. This is arguably the more complicated side of the equation, as you must offer multiple options to accommodate the wide demographic of vouchees. The answer lies in providing multiple ways to interact with a vouching entity and various accessible ways to identify them. Fortunately, for those in the digital identity space, protocols and applications have evolved to support a variety of interactive channels. Vouching channels include F2F, telephony, WhatsApp for Business, digital assistants, and even smart TVs. Methods of verification follow the channel of choice; for example, a doctor’s surgery could ask questions that include the date of your last visit to establish your identity. The type and level of assurance and the related verification method should not be prescriptive or unchanging. The technology behind the system must be flexible enough to adjust the rules of the service based on the specific use case. The devil, of course, is in the detail, but the most challenging part is capturing all the possible options in user journeys and applying technology to cover that design.

This article is a brief on vouching. The reality of creating an effective vouching system contains more moving parts than a short article can convey. One aspect of vouching that I’d like to emphasise is that vouching requires more than a single point of interaction. Vouching is truly a multi-level system that requires deep design thinking before development begins. However, using the right technology makes an effective vouching system achievable. Data orchestration and decisioning provide the framework to utilise the protocols, verification services, and channels to ensure that vouching work for all.

About the author:

Susan Morrow is Think Digital Partners digital identity advisor and also Head of R&D at Avoco Secure. Avoco is currently working with respected third parties to deliver vouching.

Event Logo

If you are interested in this article, why not register to attend our Think Digital Identity and Cybersecurity for Government conference, where digital leaders tackle the most pressing issues facing government today.


Register Now