Is National Insurance number considered as something you have for 2 factor authentication as it is unique to each individual?

  • 4
    No. Something you have means that you must physically possess it, that it cannot be trivially copied. For example you could publicly disclose your insurance number and thus zeroing its usefulness. While a secure non-cloneable smartcard cannot be disclosed publicly. You must literally have physical access to the device in order to complete that part of the authentication.
    – Bakuriu
    Commented Sep 9, 2016 at 9:49
  • if a password reset solution needs to be considered then what will be the best practice if a hard token is not available? Commented Sep 9, 2016 at 11:15
  • Welcome to the stack, AvinashKaurBabra. Nice entry-level question. Commented Sep 9, 2016 at 15:53

4 Answers 4


No, something like National Insurance number is "something you know".

It could be considered as a factor of authentication, however not a very good one because it is often disclosed by an individual.

"Something you have" should be something that can't easily be copied. Ideally a hardware token, however recently mobile phones with authentication via SMS and smart phones with OTP's with sync'd seed keys have been considered to be "something you have", even though the SMS could be intercepted, or the OTP seed shared between devices.

This is a loose definition of the phrase, however it is usually more than adequate for most people's needs. SMS wouldn't be recommended to be used if government snooping is a threat, and OTPs in a phone application should be carefully considered if this is the case.

  • Don't forget to upvote anything that is helpful, and mark as accepted once you are happy with the best answer. You might want to leave it a day or so for all the answers to come in first. Commented Sep 9, 2016 at 11:11
  • Thanks, if a password reset solution needs to be considered then what will be the best practice if a hard token is not available? what type of authentication can be used? Commented Sep 9, 2016 at 11:15

Absolutely not since you have little control over who has access to it.

While it is (should be anyway) considered Personally Identifiable Data (PID) and treated accordingly, it will be available to a great many systems across many organisations.

In addition, you would do well to consider whether it is actually unique. If I remember rightly, in the UK, there have been quite a few times where systems have created duplicate numbers. This was one of the reasons that a new NHS Number scheme was created.

  • Thanks Julian for the information, if a password reset solution needs to be considered then what will be the best practice if a hard token is not available? Commented Sep 9, 2016 at 11:15
  • The standard approaches are to offer a number of validated out-of-band communications paths (phone, email) to allow the system to send a temporary token or link. The other main alternative is to allow access to the password reset capability via a set of security questions, normally a random selection of 3 out of 5 or something similar. You can, of course, combine these to create additional confidence. The NI number could be considered as one of the security questions if you have the confidence that the user will actually know it. Also note that the security of NIN/SSN will vary in other locn. Commented Sep 9, 2016 at 11:23
  • Yes, i am considering email capability along with that NI as one security question and 2 more security questions set up by the customers, will it be satisfactory endeavors for password security? Commented Sep 9, 2016 at 11:34
  • Personally, I don't see the value in using the NI. Since the "answer" cannot be changed, you loose a lot of security for little gain. Also having just 2-3 questions is not really best practice, but then it depends on just how secure you need this to be. I would also advise against having fixed questions. Allow the users to set both question and answer if you can and encourage them NOT to use things like mothers maiden name which are too easily sourced. Commented Sep 9, 2016 at 12:59
  • I probably should also have questioned whether this is for an OFFICIAL system (e.g. gov, health, etc). If gov, you must give consideration to the Cabinet Office standards. You might also need to use their citizen authentication infrastructure too. Commented Sep 9, 2016 at 13:01

No, the main reason for two-factor authentication is this:

Somebody listening on the network or through keyloggers or screenloggers etc. can steal your password AND everything else you provide with the login. The idea is to prevent an attacker from logging in even if he manages to get all the details of a single login session. Since the Insurance Number doesn't change you do not gain any security.

It is vitally important that the password/token used in the 2factor authentication changes everytime.


This is at least partially a UX answer but unless you work for HMRC (and probably not even then) you really can't guarantee that your user will have an NI number. If you don't work at HMRC (or in the payroll dept of the user's employer, or a few other cases) you don't really have any business storing it.

Also: it can take weeks to get an NI number on legitimate arrival to the UK as an adult. The process is made harder if other normal activities require an NI number (imagine if you needed one to get a mobile phone for an extreme case).

Thus if you do try to use it you need a fallback. If the fallback is less secure, that's an easy attack route. If the fallback is more secure, just use that. Realistically though, you don't get much less secure than an NI number. It can appear above your name in the address field of a letter (visible from the outside). It's often stored in databases with many and varied real users who aren't vetted, etc.

(this is intended to address the underlying question - the question in the title can be answered simply with "no", this goes into some of the "why")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .