Skip to main content

Identity Verification

Prerequisites

Before implementing identity verification, understand:

TL;DR
  • Identity verification = Confirming customers are who they claim to be
  • Methods (friction order): database checks → OTP/KBA → document + selfie
  • Use risk-based step-up: low-risk = passive only, high-risk = full document verification
  • Watch for: synthetic docs, deepfakes, photo replay attacks
  • Vendors: Jumio, Onfido, Veriff (full-stack); LexisNexis, Experian (database)

Confirming that customers are who they claim to be.

Identity Verification Methods​

Document Verification​

Verifying government-issued ID documents:

CheckDescription
AuthenticityIs the document real (not forged)?
ValidityIs it expired? Revoked?
TamperingHas it been altered?
ConsistencyDo fields match each other?

Document Types​

TypeTrust LevelNotes
Passport🔴 HighStandardized, hard to forge
Driver's license⚠️ MediumVaries by jurisdiction
State ID⚠️ MediumSimilar to DL
Utility bill⚠️ LowAddress only, easy to fake

Biometric Verification​

Matching faces to documents:

CheckPurpose
Face matchDoes selfie match ID photo?
LivenessIs this a real person (not photo/video)?
Age consistencyDoes apparent age match DOB?

Database Verification​

Cross-referencing against authoritative sources:

SourceWhat It Verifies
Credit bureausSSN, name, address history (key for synthetic identity detection)
DMVDriver's license validity
SSASSN issuance, name match
Death recordsIs person alive?
Sanctions listsOFAC, PEP status (see AML Basics)

Knowledge-Based Authentication (KBA)​

Questions only the real person should know:

TypeExampleReliability
Static"What was your first car?"Low (data breaches)
Dynamic"What was your mortgage payment in 2019?"Medium
Out-of-walletCredit bureau-sourced questionsMedium
KBA Limitations

Data breaches have compromised most KBA questions. Use as one factor, not sole verification.

Phone/Email Verification​

MethodWhat It Proves
OTP to phoneAccess to phone number
Email clickAccess to email
Phone ownershipNumber registered to individual
Email ageHow long email has existed

Verification Waterfall​

Order verification methods from least to most friction:

Risk-Based Verification​

When to Step Up​

SignalRecommended Action
New customer, low-risk profilePassive only
New customer, medium-risk (risk score 30-60)OTP/KBA
New customer, high-risk (risk score 60+)Document verification
High-value transactionStep up from baseline
Account change (address, phone)Re-verify (may indicate ATO)
Suspicious behavior detectedFull verification

Segment-Based Requirements​

SegmentMinimum Verification
Low-risk product, returning customerNone
Low-risk product, new customerBureau match + OTP
High-risk product, returning customerOTP
High-risk product, new customerDocument + biometric

Vendor Landscape​

CategoryExamples
Full-stackJumio, Onfido, Veriff
DocumentAuthentix, IDology
BiometriciProov, FaceTec
DatabaseLexisNexis, Experian
KBAIDology, LexisNexis

Fraud in ID Verification​

Attack Vectors​

AttackDescription
Synthetic docsAI-generated fake IDs
Photo replayPhoto of photo, not live person
DeepfakesAI-generated face videos
Document fraudAltered real documents
Credential sharingReal person helps fraudster

Countermeasures​

AttackDefense
Synthetic docsDocument forensics, database cross-ref
Photo replayLiveness detection (blink, turn head)
DeepfakesAdvanced liveness, multiple angles
Document fraudTamper detection, consistency checks
Credential sharingBehavioral analysis, ongoing verification

Next Steps​

Implementing identity verification?

  1. Design verification waterfall - Least to most friction
  2. Choose verification methods - Document, biometric, database
  3. Integrate with risk scoring - Step-up triggers

Setting up risk-based verification?

  1. Define step-up triggers - When to require more
  2. Set segment requirements - By product and customer
  3. Configure risk thresholds - Score-based routing

Defending against IDV fraud?

  1. Understand attack vectors - Synthetic docs, deepfakes
  2. Implement countermeasures - Liveness, forensics
  3. Evaluate vendors - Jumio, Onfido, etc.