If you have tried to access an HMRC service recently and been asked to prove who you are, you may have noticed the old security questions have gone. In early October 2026 HMRC withdrew the knowledge-based identity checks from one of its main online verification routes, saying the questions "no longer provide the level of assurance required". It is one more step in a wider move away from the ageing Government Gateway and towards GOV.UK One Login.
This guide explains what has changed, what GOV.UK One Login is, how to prove your identity with the GOV.UK ID Check app or in person, and whether existing Government Gateway users need to do anything yet. Everything here is verified against gov.uk so you can act with confidence and avoid the scam links that always follow a change like this.
What is changing with HMRC identity verification in 2026?
HMRC has removed the knowledge-based security questions from one of its online identity-verification journeys because those checks no longer give enough assurance that you are who you say you are. In their place you now prove your identity through GOV.UK One Login, either with a smartphone app, a set of online checks, or in person at a Post Office.
During the switch, some people briefly saw a "service unavailable" message on the old route before the option disappeared for good. If you hit a verification step now, you will be sent down the One Login path rather than asked for details from your payslip or passport off the top of your head. This change sits alongside HMRC's rollout of mandatory multi-factor authentication, which adds a one-time access code at sign-in. Identity verification and multi-factor authentication are two different things: one proves who you are when you first set up access, the other protects the account every time you log in.
What is GOV.UK One Login and how does it replace Government Gateway?
GOV.UK One Login is a single government sign-in that is gradually replacing the Government Gateway. It lets you use one email address and password to reach a growing list of government services, and it has a built-in way to prove your identity once rather than repeating the process for each department. HMRC is one of the biggest services moving across.
During 2026 HMRC began asking new individual customers to create a GOV.UK One Login instead of a Government Gateway account. If you already have Government Gateway credentials you can keep using them for now, and HMRC will contact you when it is your turn to move. The wider migration is expected to complete by the end of 2027, so this is a transition rather than an overnight switch.
| Feature | Government Gateway (old) | GOV.UK One Login (new) |
|---|---|---|
| Sign-in detail | 12-digit Government Gateway user ID | Your email address |
| Identity check | Knowledge-based security questions (being retired) | ID Check app, online checks or Post Office |
| Scope | Mainly HMRC and a few other services | One account across many government services |
| Status in 2026 | Still works; being phased out | Default for new HMRC customers |
If your question is specifically about getting into your VAT account, our guide to the HMRC VAT login walks through the screens, and you will need your Unique Taxpayer Reference to hand for Self Assessment.
How do you prove your identity with GOV.UK One Login?
There are three ways to prove your identity with GOV.UK One Login: with the GOV.UK One Login app (or the GOV.UK ID Check app when you reach it through Government Gateway), by answering a set of checks online, or in person at a Post Office. The app is the quickest for most people because it reads the chip in your photo ID and checks your face against it.
Using the GOV.UK ID Check app
The app confirms three things: that your photo ID is genuine, that you are a real person, and that you are the same person shown on the ID. You download it, sign in with your One Login details to link it to the website, scan your document and take a short video of your face. You need an iPhone 8 or newer on iOS 16.7 or higher, or a device on Android 10 or higher. Accepted photo ID is a UK passport, a UK photocard driving licence, a non-UK passport with a biometric chip, a UK biometric residence permit (BRP), a UK biometric residence card (BRC), or a UK Frontier Worker permit (FWP). The official steps are on gov.uk: using the GOV.UK ID Check app.
If you cannot use the app
You do not need a smartphone to prove your identity. You can answer questions online about things such as a bank account, a credit record, your Universal Credit or your Personal Independence Payment, backed up with details from a UK passport or driving licence. If that does not work, you can go to a Post Office that offers in-branch verification, where staff scan your photo ID and take your photo. All three routes are set out on gov.uk: proving your identity with GOV.UK One Login.
Do existing Government Gateway users need to do anything?
No, not immediately. If you already sign in with a Government Gateway user ID, you can carry on until HMRC tells you to move to GOV.UK One Login. The one thing to act on now is multi-factor authentication, which is already compulsory for individuals and organisations and is being switched on for tax agents in stages through 2026, so make sure HMRC has a current mobile number or an authenticator app set up for your account.
When your move to One Login does come, you will link your existing tax records to the new sign-in rather than losing anything. The process is the same identity check described above. If you run a company, the related but separate Companies House identity verification for directors and people with significant control is worth reading too, because many business owners will need to complete both. We help clients get set up with HMRC access as part of our Self Assessment service; if you are stuck, book a free call and we will walk you through it.
How to stay safe from scams during the switch
Any change to how people log in to HMRC is immediately copied by fraudsters, so treat every text, email or call about "verifying your HMRC identity" with suspicion. HMRC will not send you a link to prove your identity and then ask for your password or bank details on that page. Always go to gov.uk yourself and start from gov.uk: sign in to HMRC online services rather than tapping a link someone sent you.
If a message pressures you to act within hours, or asks for a fee to verify your identity, it is a scam. Genuine identity verification through GOV.UK One Login is free. When in doubt, close the message and reach HMRC through the contact details published on gov.uk.
Frequently asked questions
Why has HMRC removed the security questions for identity verification?
HMRC removed the knowledge-based security questions from one of its online identity routes in 2026 because those checks no longer provide enough assurance that you are the genuine account holder. You now prove your identity through GOV.UK One Login instead, using the ID Check app, online checks or a Post Office.
Is GOV.UK One Login the same as Government Gateway?
No. GOV.UK One Login is a newer single sign-in that uses your email address and is gradually replacing the Government Gateway, which used a 12-digit user ID. During 2026 new HMRC customers are set up with One Login, while existing Government Gateway users keep their old sign-in until HMRC moves them across.
What ID do I need for the GOV.UK ID Check app?
You can use a UK passport, a UK photocard driving licence, a non-UK passport with a biometric chip, a UK biometric residence permit, a UK biometric residence card, or a UK Frontier Worker permit. You also need an iPhone 8 or newer on iOS 16.7 or higher, or an Android 10 device or higher.
What if I do not have a smartphone to prove my identity?
You can still prove your identity without a smartphone. Answer the online checks about your financial record, Universal Credit or Personal Independence Payment, backed by a UK passport or driving licence, or visit a Post Office that offers in-branch verification where staff scan your ID and photograph you.
Do I have to move to GOV.UK One Login straight away?
No. Existing Government Gateway users can keep signing in as normal and HMRC will contact you when it is time to switch, with the wider migration expected to finish by the end of 2027. The priority for now is making sure multi-factor authentication is set up on your account.
