OTTAWA — Canada's tax agency has quietly tested a new way for Canadians to log in to their online accounts that should make it easier for Canadians to access government services while keeping would-be crooks out.
The new system could also be pushed into the private sector as the government and banks look to reduce the chances of identity fraud.
The online security company SecureKey and the CRA spent five months last year testing a service called Verified.Me that will allow government agencies and banks to share information securely and allow them to verify your identity quickly when you try to log in to their sites.
The system would also let a citizen walking into a government services office confirm their identity even if they forget the right documents at home.
The service won't be in place in time for this year's tax season because both the government and the company have more work to do.
"The goal of the project was ... to prove that we could actually solve the problem, that we could have citizens show up, be able to share their data in a privacy-enhanced way, be able to get services more expeditiously and have less fraud," Greg Wolfond, CEO of SecureKey Technologies, said in a recent interview. "It takes some time and the government has to go through its cycle on what does it want to do."
Federal officials have been looking at ways to make log-ins more secure to eliminate the possibility of fraud, if, for instance, a nefarious actor gets a password and logs in to someone else's account.
Banks are lobbying for a system to link federal and provincial databases that hold information like social-insurance numbers and drivers' licences, respectively, and use that to electronically authenticate identities using multiple digital reference points.
What the government and company tested, described in documents obtained by The Canadian Press under the federal access-to-information law, would fit the model of digital identification the Canadian Bankers' Association CEO Neil Parmenter advocated for in a speech earlier this week.
Those tests were conducted by the CRA and SecureKey to decide whether Verified.Me could help confirm the identity of someone logging into a CRA online account by tapping into a provincial licence database.
Similarly, the tests looked at whether information could be sent the other way, by having the CRA ship income data to a bank for a loan application.
"It lets you take data from parties you work with and trust — like your telco or your bank or government — and be able to share it with someone where you're trying to prove, hey, it is really me applying for this loan, or it is really me trying to get access to service," Wolfond said.
Both sides labelled the tests as a success.
In an emailed response to questions about the trial, a CRA spokesman said the agency wanted to test the technology because of its "potential to streamline digital service delivery" and replace some existing processes — among which is mailing out passwords for new CRA accounts.
Alexandre Igolkine said the agency is still working with the federal Treasury Board, which oversees the rules around government services, to see if Verified.Me can be used to ease logins and share information among governments and institutions for other government services, such as employment insurance.
