The Office for Digital Identities and Attributes (OfDIA) has commissioned the National Crime Agency’s National Assessments Centre to carry out an intelligence assessment into fraud threats aimed at businesses providing digital identity products and services, officials have confirmed.
Scope and purpose of the assessment
The NCA-led study will examine how fraudulent activity manifests within digital identity services, how components of the ecosystem can be exploited to facilitate fraud and the consequences for providers, end users and relying parties. Findings will inform strategic decision-making across both the NCA and OfDIA and will guide allocation of resources and targeted responses to emerging threats.
As part of the information-gathering phase, OfDIA has issued a survey to key stakeholders in the sector to collect intelligence on how the digital identity ecosystem is targeted and how it may unintentionally enable fraud. The survey requests details on roles and functions within the ecosystem, commonly observed attacker methods, supply-chain and third-party vulnerabilities, and measures used to detect, prevent and manage fraud. Responses were requested by 7 August 2026.
Deliverables and follow-up work
The intelligence assessment is scheduled to conclude in November 2026. After the survey responses are received, the NCA will conduct threat analysis and identify principal vulnerabilities to present to OfDIA.
OfDIA intends to use the intelligence to pinpoint priority fraud risks, reassess existing interventions such as requirements in the UK digital verification services trust framework, and shape future policy aimed at helping organisations guard against and respond to fraud.
In parallel, OfDIA has commissioned a separate, six-week system-level analysis of the UK’s digital verification services ecosystem. That study will map data flows across the sector and evaluate cyber security practices as the market expands.
- Commissioning body: Office for Digital Identities and Attributes (OfDIA)
- Analyst: National Crime Agency – National Assessments Centre
- Survey responses deadline: 7 August 2026
- Intelligence assessment due: November 2026
- Concurrent cyber/system review: six-week analysis of verification services
Context and implications for industry
Digital identity services underpin an increasing range of online interactions, from accessing public services to commercial transactions. As those services proliferate, regulators and law enforcement are intent on understanding where fraud risk concentrates and which controls are most effective. The NCA assessment and the system-level cyber review together aim to produce evidence that can be translated into practical requirements and policy changes.
OfDIA has already signalled that the vulnerabilities highlighted by the assessment will be used to evaluate the existing trust framework for digital verification services. That suggests potential regulatory tightening or clarification of obligations for providers, particularly where supply-chain dependencies or third-party integrations create exploitable gaps.
For firms operating in the space, the exercise represents both a warning and an opportunity: those that can demonstrate robust fraud detection and cyber security controls may find it easier to meet any future obligations; those relying on weak third-party arrangements or informal mitigations risk regulatory scrutiny.
| Milestone | Date / Duration |
|---|---|
| Survey responses requested by | 7 August 2026 |
| Assessment completion | November 2026 |
| System-level cyber analysis | Six weeks |
The information-gathering exercise will be of interest to a broad cross-section of the technology and finance sectors, as well as public bodies that rely on digital verification. It will also feed into law enforcement planning by clarifying where criminal actors are focusing effort and which countermeasures have the greatest impact.
Officials have not offered further public detail on the survey responses received or on any specific vulnerabilities identified to date. The NCA and OfDIA will use the completed assessment to shape operational priorities and to advise changes to the trust framework where necessary.
With digital identity increasingly central to the economy, the combined intelligence and system-level work seeks to reduce friction for legitimate users while tightening the net around fraudsters exploiting weaknesses in an evolving ecosystem.
