HMRC’s Mandatory Two-step Verification
Background
Individuals and businesses who use HM Revenue & Customs (“HMRC”) online services will be aware that for sometime now HMRC have been trying to encourage users when they login to register for 2 Step Verification (“2SV”). The reason for this, is that HMRC are keen to improve the digital security of online accounts by adding this additional security check. The 2SV registration has so far been voluntary, however, HMRC have recently announced that from September 2017, 2SV will become mandatory for individuals and businesses.
Detail
Currently when logging in to a HMRC online account it has been possible to skip the registration process for 2SV, but from September 2017 when logging in, an individual or business will be required to register for the security mechanism, if they are not already using it.
2SV is a system for adding another layer of security to the existing Government Gateway credentials. The process of registering is relatively quick and easy to setup, by following the on screen instructions.
The 2SV process involves providing HMRC with a mobile or landline number, then whenever anyone attempts to log into that account, a six-digit verification code will be sent to the number provided, which will be required to be input online when prompted, in addition to the existing user ID and password for the account.
A different verification code will be issued every time a user attempts to login to the online account. This means some thought will need to be given by businesses as to the most practical mobile or landline number to provide to HMRC, particularly if the individual whose number it is, is not always close to hand.
Whilst the aim by HMRC of introducing this additional access code is to strengthen online security, it may well mean some businesses will need to introduce new internal arrangements for accessing HMRC’s online services to ensure codes can be used promptly, given the six-digit code expires if not used within 15 minutes. This will be a particular issue where a business has previously allowed their accountant to access their online account using their business login rather than the accountant having access through the agent login service. The change to the 2SV system will make this arrangement more difficult in practice, as the agent will need to promptly receive the code from their client.
There is the option for an individual or a business to allow their accountant to access their online account as an agent and avoid the need for the agent to have the additional access code. However, not all online services, for example VAT and PAYE, are currently fully available for agents to access all information, and until HMRC expand agents services to include these, the convoluted arrangements between agents and their clients are likely to continue.
If you would like any further information or advice in connection with the above, or assistance appointing Muras Baker Jones as an agent, please contact our Tax Director, Jenny Marks.
To see our other news items please visit our Muras Baker Jones – Blog.