What Is Identity Verification? How Online ID Checks Work

Identity verification: the three questions it answers

It helps to separate three questions that are often blurred together:

1. Does this identity exist? Is there a real person with this name, date of birth and address?
2. Does the evidence in front of me belong to that identity? Is the document genuine and unaltered?
3. Is the person presenting it the rightful owner, right now? Is this the holder, and are they physically present rather than a recording or a mask?

A strong check answers all three. Many failures happen when a process answers only one or two. A database match answers the first question but says nothing about who is typing. A selfie comparison answers the third but only against whatever photo you were handed.

The terms "ID verification", "identity verification" and "online ID verification" are used interchangeably in most product and policy writing. "Remote identity verification" emphasises that the person is not physically in front of you. It is the same goal, achieved with documents, biometrics and data instead of a counter clerk.

Why identity verification matters

There are three practical drivers, and they pull in different directions.

• Compliance. Regulated firms such as banks, payment providers, crypto businesses and gambling operators generally have to identify and verify customers as part of know your customer (KYC) and anti-money laundering obligations. FATF, the global standard-setter for AML, sets the customer due diligence principles that national laws build on, and has published guidance on using digital identity for it. Exact requirements differ by country and sector and change over time, so check the current rules with your regulator or legal counsel.
• Fraud prevention. Account opening is where stolen, synthetic and fabricated identities enter a business. Catching them at the door is cheaper than unwinding losses later.
• Trust and eligibility. Marketplaces, sharing-economy platforms and age-restricted services need to know a user is a real, eligible adult before granting access. See our age verification guide for that specific use case.

The tension is that each extra check adds friction. A process strict enough to stop organised fraud can also reject genuine customers with worn documents or poor cameras. Good design is about calibrating that trade-off, not maximising one side.

The main identity verification methods

Most production systems combine several methods. Each one proves something different and fails in a different way.

Document verification

The system captures the ID, checks its structure (layout, fonts, security features, machine-readable zone consistency) and extracts the data. For more detail, see document authentication and our guide to detecting forged IDs.

Biometric verification

A selfie or short video is compared with the portrait on the document, while liveness detection checks that a real person is present rather than a photo, screen or mask. Biometric verification is what links the document to the person holding the phone.

Database checks (eIDV)

Name, date of birth, address and other attributes are matched against authoritative or commercial data sources. Electronic identity verification is often used on its own for lower-risk cases, or alongside document checks for higher-risk ones.

Knowledge-based verification

KBV asks questions only the genuine person should be able to answer. It has declined in favour because much of the underlying personal data is now exposed through breaches. Treat it as a weak signal, not a primary control.

Digital ID

Government-backed or bank-issued digital identities let a user share a pre-verified credential. Availability varies widely by country, so most businesses need document and biometric checks as a fallback.

How an online identity check works, step by step

1. Collect the claim. The user supplies name, date of birth, address and sometimes email and phone number. Validating those contact points early removes obvious junk.
2. Capture the document. The user photographs the front and back of an ID, or reads an NFC chip where supported. Capture guidance matters: glare and blur are a leading cause of avoidable rejections.
3. Authenticate the document. The system checks for tampering, template mismatches, inconsistent data fields and expiry.
4. Match the face and test liveness. A selfie is compared to the document portrait, with checks that the capture is live and not injected or replayed.
5. Cross-check data. Extracted details are compared with database sources, and risk signals such as IP address and device characteristics are evaluated.
6. Screen where required. Regulated businesses typically add sanctions, PEP and adverse media screening at this stage.
7. Decide. The result is approve, decline or route to manual review, based on your risk policy.

ScreenlyyID's identity verification product covers document authentication, biometric and liveness checks and eIDV database checks through a single API, alongside address, email and phone validation and IP and device intelligence.

Accuracy and failure modes

Automated verification is not a single accuracy figure. Be sceptical of any vendor or article quoting one number without saying how it was measured. Outcomes depend on the document type, image quality, the population of users, the fraud you actually face and where you set thresholds. Test on your own traffic.

The errors that matter fall into two groups:

• False rejects. Genuine customers are declined or sent to review because of damaged documents, low light, older phones, name changes or limited data records. These cost you conversion and can raise fairness concerns if some groups are rejected more often.
• False accepts. Fraudulent users get through. Common routes include stolen genuine documents, high-quality forgeries, synthetic identities that pair real data with a fabricated person, and attacks on the camera feed itself (presentation attacks with screens or masks, and injection attacks that bypass the camera).

Two points are often overlooked. First, a synthetic identity can pass a database check precisely because the data elements are real, so database matching alone is weak against it. Second, identity verification is a point-in-time decision. It does not tell you whether the person who verified is the person who logs in next month, which is where authentication and ongoing monitoring come in.

Practical controls: use layered checks, keep a manual review path, track false reject and fraud outcomes separately by channel, and retest after changing thresholds or vendors. Fraud detection signals from device and IP intelligence help catch what a single document check cannot.

Identity verification vs authentication

Verification establishes who someone is when they first present themselves. Authentication confirms that a returning user is the same person who was verified, using a password, passkey, one-time code or biometric unlock. Verification is typically done once (and refreshed on risk triggers); authentication happens on every login.

The two connect at enrolment. The strength of later authentication is limited by the strength of the original verification: a passkey bound to a fraudulent identity is a very secure way to log in as a fraudster. This is why verification quality matters even if your day-to-day security is strong.

Choosing an assurance level (NIST IAL)

Not every journey needs the same rigour. The NIST Digital Identity Guidelines (SP 800-63) define identity assurance levels (IAL1 to IAL3) that describe how confident you should be that an applicant is who they claim to be, from minimal or self-asserted identity up to strong, in-person or supervised proofing. NIST publishes the full definitions and requirements (see SP 800-63A on enrolment and identity proofing), and they have been revised over time, so read the current edition rather than relying on summaries.

Even if you are not a US government service, the model is a useful way to structure decisions:

• Low risk (browsing, low-value accounts): email and phone validation plus device checks may be enough.
• Medium risk (most regulated onboarding): document authentication, a liveness-checked face match and a data cross-check.
• High risk (high-value, high-fraud or high-regulatory exposure): add screening, stronger evidence, manual review or in-person steps.

Map each journey to a level, document why, and set escalation rules for when risk signals change. Regulators generally expect a risk-based approach, and a written rationale helps you show one.

Where to go next

Go deeper on each layer: document authentication, biometric verification and eIDV, or read the broader KYC overview. For age-gated services, see the age verification guide.

Start verifying customers. ScreenlyyID offers an API with self-serve sign-up. See the pricing page to get started.

This article is general information, not legal advice. Verification requirements vary by jurisdiction and change, so confirm current obligations with your regulator or legal counsel.