Identity Verification
Identity verification is the process of establishing that a person is who they claim to be — checking a document, matching a face to it, testing that the face is live, and confirming the details against independent records. It is the first step of know-your-customer, the control that decides who gets an account, and a market whose vendors have been bought by the payments and credit-data groups at nine-figure prices.
- Also known as
- IDV, Identity proofing, ID verification
- Used at
- account opening, high-risk transactions, account recovery, and onboarding of merchants and business owners
- Binding
- yes — anti-money-laundering law in every major jurisdiction requires identity to be verified before a business relationship begins; the method is risk-based
- Typical methods
- document capture and authenticity checks, selfie-to-document face match, liveness detection, database checks (electoral roll, credit bureau, telecom), and in the EU, electronic identities under eIDAS
- Typical performance
- a well-run flow passes 85–95% of genuine applicants at first attempt; each extra step costs conversion
- Parties
- the regulated firm, its verification vendor, the customer, and the data sources behind the check
How identity verification works in practice
A modern flow has three questions. Is the document real: the vendor reads the passport or driving licence, checks its security features, fonts and machine-readable zone, and rejects the forged or the expired. Is the person holding it the person on it: a selfie compared with the document photo, with a liveness test — a turn of the head, a random phrase, or passive analysis of the image — to defeat a photograph of a photograph or, now, a deepfake. Does the identity exist: the name, date of birth and address checked against records the applicant cannot fabricate.
The design problem is the trade between fraud caught and customers lost. Every step drops some genuine applicants — the passport that will not scan, the face the camera cannot light — and fraud teams and growth teams fight over each one. The answer is usually risk-based: a light check for a low-limit account, a full document flow for credit, and step-up verification when behaviour changes.
The vendor market consolidated fast. Mastercard bought Ekata for $850m in 2021, GBG bought Acuant for $736m the same year, and Entrust bought Onfido in 2024, each buyer folding verification into a larger identity or payments stack. For a fintech, the choice of vendor is now a dependency a buyer will diligence: contract terms, data residency, and what happens to onboarding if the vendor is bought by a competitor.
Example
A neobank onboards 100,000 applicants a month. Its flow passes 88% at first attempt; 7% abandon at document capture, 3% fail the face match and 2% fail the database check. Of those who pass, 1.1% are later found to be fraudulent. Adding a passive liveness check cuts fraud among passes to 0.6% and costs a further 1.5% of applicants — 1,500 people a month, of whom the bank's model says 1,450 were genuine. At an expected lifetime value of £90 each, that is £130,000 a month of customers lost to prevent about 440 fraudulent accounts a month. Whether that trade is right depends on what a fraudulent account costs — and the bank only knows that if it measures it.
Common mistakes
- One flow for every product, so a prepaid card applicant faces the checks designed for a loan. - Measuring the vendor on fraud caught and never on genuine applicants lost. - A liveness test that stops photographs but has never been tested against a deepfake. - Verifying the person and not the business, so the director is real and the company is a shell. - Treating verification at onboarding as permanent; the account taken over a year later was verified perfectly.