Identity verification checks whether a person is who they claim to be using evidence appropriate to the transaction and risk. It can combine documents, authoritative data, biometrics, device signals and direct confirmation.
What can be verified?
- Name and date of birth
- Government-issued identity document
- Address or contact channel
- Facial match or liveness where permitted
- Relationship to a business or account
- Control of a device or credential
How does verification work?
- Collect the minimum required identity attributes.
- Validate document and data integrity.
- Compare the evidence with trusted sources.
- Assess mismatches, fraud signals and confidence.
- Escalate uncertain or high-risk cases.
- Record the decision and retention basis.
Identity verification vs. authentication
Identity verification establishes or confirms who the person is. Authentication checks that a returning user controls an enrolled credential. Strong authentication does not correct a false identity established at onboarding.
What can create false confidence?
A genuine document can be used by an impostor, and a successful database match can refer to a different person. Controls should assess possession, document integrity, person-to-document match and context as required.
What should be governed?
Define permitted evidence, failure handling, manual review, data retention, accessibility and jurisdictional restrictions. Monitor fraud outcomes and false rejection rather than relying only on completion rate.
