DWP bank checks start with no names. The data that travels can belong to someone who never claimed.

The first Eligibility Verification Notice issued by the Department for Work and Pensions names nobody. It cannot. The law behind the checks forbids DWP from sharing personal data with a bank or other financial institution, so the notice a bank receives sets out criteria and asks the bank to find the accounts that meet them. The bank works out who matches from its own records, and DWP learns the names only when the bank sends them back.

Lilian Greenwood, the minister for innovation, fraud and data, told the House of Commons on 26 October 2026 that the first notice had been issued under the Public Authorities (Fraud, Error and Recovery) Act 2025. The DWP bank checks cover three benefits, Universal Credit, Pension Credit and New Style Employment and Support Allowance, in England, Scotland and Wales. The first use is a controlled test. DWP calls it a test-and-learn phase, with a small number of financial institutions, before any wider rollout. Greenwood told the Commons the measure was expected to save £1.2 billion over five years.

DWP gives the bank eligibility indicators drawn from the benefit rules. The Code of Practice, laid before Parliament in May 2026, gives two examples. For Universal Credit the indicator may be capital above £16,000, the upper capital limit, but DWP may set the ask lower, inside the £6,000 to £16,000 band where awards taper as capital rises. For time abroad, the indicator may be an account used outside the United Kingdom for longer than the benefit allows. Universal Credit can continue for one month abroad. Pension Credit can continue for four weeks, eight where a close relative has died, and 26 weeks for medical treatment. The Code fixes no indicators. They follow the benefit rules, so they change when the rules change, and the notice states which ones the bank must apply.

A joint account paid a benefit puts both holders in the file. The bank does not know which of the two claims, because DWP has sent it no personal data, so details of accounts held by both individuals may be shared with DWP where the criteria are met. Universal Credit is a household benefit. Both people’s capital can count. The boundary runs the other way for a linked joint account. If the claimant holds a joint account with someone else, the details of that account may be shared, but nothing about the other holder’s other accounts, because those are not held by the person who holds the benefit-receiving account. Children’s accounts are in scope in the same way where they are held on trust by a holder of the benefit-receiving account, or where the benefit is paid into them. Credit card accounts, current account mortgages, accounts held outside the United Kingdom and accounts that are not personal accounts are out of scope.

The same machinery reaches a personal appointee, the person who makes and maintains a claim for someone else. Where the benefit is paid into the appointee’s own personal account, the bank shares information about that account if it meets the criteria in the notice, even though the account belongs to someone other than the claimant. A private landlord is reached the same way where housing costs are paid directly into a personal account rather than a business account, for example where a claimant has asked DWP for help managing money. DWP then runs a matching process to establish whether the account holder and the claimant are the same person. Where the appointee or the landlord also claims one of the three benefits in their own right, the information goes to their own claim. DWP checks that claim instead.

Under the Sun’s Sun Savers post about the checks on Facebook, the first reactions did not start with the Code. Dean Hilton wrote: “DWP already knows what goes into your bank and who by if it gets paid in by PAYE or Bacs so they can calculate your deductions if earnings haven’t been declared or there is a discrepancy they have done this for years”. Sandy Grain answered the fraud framing directly: “The people I know that commit fraud are the ones who go to work.” Chevy Camaro read the measure as easy to sidestep: “open another account.the way i read it it’s only for people who have their benefits paid into the account so have two with different banks.”

Greenwood’s announcement line was sharper than any of that. “Benefit fraudsters should be looking over their shoulder,” she said. The Code sits between the two. It does not give DWP the spending history Hilton assumes it already holds, and it does not make the second account Camaro proposes the escape he imagines: the check starts with the account the benefit is paid into, and reaches the accounts linked to it. What the Code does not do is tell either of them. No individual notice follows a check. The destruction promise runs on DWP’s own determination that the information no longer serves a purpose.

Once the bank has sent the data, DWP checks it against its own systems and decides whether further enquiry is needed. Information that turns out not to be directly relevant to a claimant is not shared further and is not used by any DWP operational team. The Code says it must be securely destroyed, in line with DWP’s Information Management Policy, once DWP determines it no longer serves a purpose. No date is set for that destruction. No individual notice is given when it happens. DWP states in the Code that it will not inform account holders every time a bank shares information. Contact comes only where action is needed to verify an entitlement, and then DWP says it will explain what information led to the contact. The right to ask DWP or the bank for the personal information held, through a subject access request, is unchanged. DWP aims to act within one month. It starts by trying to contact the claimant.

The notice itself can keep running.

DWP may issue a periodic notice requiring returns at set intervals for up to one year. The data requested must not be more than one year old, but the bank may be asked for the date on which an account first began to meet an indicator, even if that date falls before the year, and for the most recent start date where an account has moved in and out of meeting it. The flowchart in the Code gives a minimum of 14 days for a bank to comply. A bank that fails to comply without a reasonable excuse faces a fixed penalty of up to £1,000. The daily rate then runs at up to £40 a day while the failure continues. After 30 days, DWP can ask the First-tier Tribunal to set a higher rate, up to £1,000 a day. The bank can ask for an internal review of a notice and can appeal to the Tribunal, and while an appeal runs it need not comply and no daily penalty can be charged. Separate penalties apply where a bank shares inaccurate information, or shares the transaction information and special category data the law forbids it to send.

What comes back from the bank starts an enquiry, nothing more. No decision rests on it alone. DWP must consider other information it holds before it uses investigative powers, suspends a payment or changes an entitlement. The Code gives disregards as the reason: a compensation payment that takes capital above the usual limit may be disregarded under the benefit rules, so the claimant stays eligible, and DWP says it will identify claims with known disregards. If enquiries find an underpayment, DWP corrects the claim. The data can also be used for research, analysis and evaluation of whether the measure works. And a flag on one benefit can reach a second one. Where Pension Credit is found to have been paid incorrectly and the claimant is also entitled to Housing Benefit, DWP may notify the local authority that issues it.

The independent reviewer examines each 12-month period after it ends. The reviewer is appointed through an open process, and the report must be published and laid before Parliament. The reviewer may meet the finance industry, claimants, charities, MPs and the Information Commissioner’s Office, and may make recommendations to the Secretary of State. DWP must hand over information the reviewer asks for, but the reviewer is not given uncontrolled access to DWP’s systems or data.