Category: AML and KYC

Identity Verification

Also known as: IDV, identity proofing, ID verification

Simply put

Identity verification is the process an organization uses to confirm that a person is genuinely who they claim to be, typically by comparing the information or documents they present against records or credentials previously established. It is commonly performed when someone opens a bank account, applies for a loan, or otherwise seeks to do business with an organization. The process is intended to help reduce the risk of impersonation, but its effectiveness depends on how it is implemented.

Formal definition

Identity verification is the process of confirming or denying that a claimed identity is correct by comparing the credentials or identifying information presented by an individual against those previously proven or held on record. It supports establishing that personal information presented is authentic, valid, and belongs to the individual asserting it, and is applied at events such as account opening, loan application, or other onboarding. Identity verification is distinct from authentication, which confirms a returning party against previously established credentials, and from ongoing fraud detection controls; its assurance level and outcomes depend on the specific methods and validation used rather than on the label alone.

Why it matters

Identity verification sits at the front door of most financial relationships. When an organization confirms that a person is genuinely who they claim to be at events such as account opening or loan application, it helps reduce the risk that a fraudster can establish a relationship under a stolen or fabricated identity. Weak or absent verification at onboarding can allow impersonation to succeed before any transaction-level control ever engages, which is why the process is treated as foundational rather than incidental.

It is important to recognize what identity verification does and does not do. Confirming a claimed identity at onboarding is distinct from authenticating a returning party against previously established credentials, and it is distinct from ongoing fraud detection that monitors behavior after a relationship exists. Verification at account opening does not, on its own, prevent later account takeover or first-party fraud, and its assurance depends on the specific methods and validation used rather than on the label alone. A control described as identity verification may range widely in rigor, so its effectiveness should be evaluated against how it is implemented and what it actually validates.

Because identity verification helps establish that presented personal information is authentic, valid, and belongs to the individual asserting it, it is intended to raise the cost and difficulty of impersonation and synthetic identity attempts. It is best understood as one layer among several, working alongside authentication and fraud detection controls rather than replacing them, and no single verification step should be assumed to eliminate downstream fraud risk.

Who it's relevant to

Merchant risk and onboarding teams

Teams responsible for account opening and customer onboarding use identity verification to confirm that new applicants are who they claim to be before a relationship is established, helping reduce the risk of impersonation at the point of entry.

Fraud analysts

Fraud analysts treat identity verification as one layer that operates at onboarding, distinct from ongoing fraud detection. Understanding what verification did or did not validate helps them interpret later signals such as account takeover or synthetic identity indicators.

Compliance officers

Compliance officers engage with identity verification in the context of customer due diligence and onboarding controls. They are concerned with the assurance level a given method provides and whether the implementation actually validates the identity as intended.

Payment processors and acquirers

Processors and acquirers rely on identity verification during merchant and customer onboarding to establish that a claimed identity is authentic before granting access to services, recognizing that verification at onboarding is separate from authenticating returning parties.

Inside IDV

Identity Proofing

The process of collecting and validating attributes claimed by an applicant, such as name, address, date of birth, and government-issued identifiers, to establish confidence that a person is who they claim to be. In payment contexts this often occurs at account opening or merchant onboarding and is distinct from authentication of an already-established account.

Document Verification

Examination of identity documents (for example, government-issued IDs) for authenticity indicators, which may be paired with a liveness or selfie check. This helps reduce the risk of impersonation but is subject to false accepts and false rejects and does not by itself confirm ongoing control of an account.

Knowledge-Based Verification

Confirmation of identity by asking questions presumed to be known only to the legitimate individual. This method is increasingly viewed as weak on its own because such information may be exposed through breaches, and it is generally considered insufficient as a sole factor.

Attribute Validation Against Authoritative Sources

Cross-checking claimed attributes against issuing or authoritative data sources to corroborate consistency. Coverage, accuracy, and availability of these sources vary by region and provider, which affects verification reliability.

Relationship to Authentication

Identity verification establishes who a person is at enrollment or a given event; authentication (including multi-factor authentication and strong customer authentication) confirms that a returning party controls credentials or possesses expected factors. These address different points in the account lifecycle and should not be conflated.

Fraud Signals and Risk Scoring

Behavioral, device, and contextual signals may be combined with verification outcomes to score risk, which is relevant to detecting account takeover and synthetic identity fraud. Such scoring is probabilistic and carries inherent false-positive and false-negative trade-offs.

Common questions

Answers to the questions practitioners most commonly ask about IDV.

Is identity verification the same as authentication?

No. Identity verification (sometimes called identity proofing) is the process of establishing that a person is who they claim to be, typically at enrollment or account opening. Authentication is the separate process of confirming that a returning party controls previously established credentials or factors. Verifying an identity once does not authenticate every subsequent transaction, and strong authentication does not by itself prove that the underlying identity was ever genuine. Treating the two as interchangeable can leave gaps, for example allowing account takeover of a legitimately verified identity or onboarding of a synthetic identity that later authenticates cleanly.

Does identity verification prevent fraud?

It is intended to reduce certain fraud risks, particularly at onboarding, but it does not prevent fraud on its own. Identity verification may help mitigate synthetic identity fraud and some account-opening abuse, yet it addresses a different point in the lifecycle than transaction-level controls, and it has limitations. Verification checks can produce false positives that reject legitimate users and false negatives that pass fraudulent or synthetic identities. It also does not address risks that arise after enrollment, such as account takeover or first-party (friendly) fraud, which require additional controls. No single control eliminates fraud.

How does identity verification relate to PCI DSS scope?

Identity verification is generally an onboarding and risk process rather than a PCI DSS technical control, and by itself it does not change the scope of your cardholder data environment. Scope is determined by where account data is stored, processed, or transmitted and by how it is protected. If an identity verification workflow collects, transmits, or stores cardholder data, then those components may fall in scope and would need to be assessed against the current published PCI DSS requirements. Confirm the applicable controls against the standard in effect rather than assuming a fixed requirement number.

What data should we avoid collecting during identity verification?

Avoid collecting or retaining sensitive authentication data as part of identity verification. Sensitive authentication data such as full track data, the card verification value (CAV2/CVC2/CVV2/CID), and PINs or PIN blocks must not be stored after authorization, even when encrypted. If your verification flow touches this data at all, ensure it is not persisted. More broadly, minimize collection to what is necessary for the verification decision, and apply defined controls to any cardholder data (such as PAN, cardholder name, expiration date, or service code) that you do retain.

How can we reduce the exposure of any card data used in a verification step?

Where card data is involved, techniques such as tokenization, encryption, truncation, and masking transform or reduce the data differently and can lower exposure, but their effect on scope depends on how they are implemented and validated rather than on the label applied. For example, tokenization replaces a value with a surrogate, encryption renders data unreadable to those without keys, and truncation or masking removes or hides portions of the value. Assess each approach against your specific data flows and the current standard to confirm what remains in scope.

How should identity verification fit alongside authentication controls in an implementation?

Treat identity verification and authentication as complementary stages rather than substitutes. Use verification (identity proofing) to establish confidence in an identity at enrollment, then apply appropriate authentication controls, such as multi-factor authentication, to confirm control of the account on subsequent access. Recognize that transaction-oriented mechanisms like EMV chip authentication, 3-D Secure, and strong customer authentication address different risks at different points in a transaction and are distinct from identity proofing. Layering these controls, and tuning detection thresholds to balance false positives against false negatives, generally provides better coverage than relying on any single step.

Common misconceptions

Identity verification is the same as authentication.

Verification (identity proofing) seeks to establish who someone is, typically at enrollment or a specific event, while authentication confirms that a returning party controls established credentials or factors. Multi-factor authentication and strong customer authentication address the authentication problem and do not replace proofing, and vice versa.

Passing identity verification prevents fraud on the account.

Verification is intended to reduce impersonation and synthetic identity risk at a point in time; it does not eliminate later account takeover, friendly or first-party fraud, or chargeback fraud. No single control guarantees fraud prevention, and detection controls carry false-positive and false-negative trade-offs.

Identity verification is a PCI DSS requirement with a fixed control number.

Identity proofing of customers is largely a fraud, regulatory, and onboarding concern rather than a PCI DSS control per se. PCI DSS focuses on protecting cardholder data and sensitive authentication data; where access-related requirements apply, numbering and wording differ between versions, so readers should confirm against the current published standard rather than assuming a fixed requirement number.

Best practices

Distinguish identity proofing from authentication in your design, and pair enrollment-time verification with appropriate authentication controls such as multi-factor authentication for returning users, rather than treating either as a substitute for the other.

Avoid relying on knowledge-based verification as a sole factor, since such information may be exposed through breaches; combine multiple corroborating signals and authoritative-source checks where available.

Account for regional variation in authoritative data source coverage and in applicable regulatory requirements, and validate that your chosen methods perform acceptably for the populations you serve.

Tune verification and risk-scoring thresholds with explicit attention to false-positive and false-negative trade-offs, and monitor outcomes to detect drift over time.

Layer identity verification with ongoing fraud detection controls aimed at account takeover and synthetic identity fraud, recognizing that point-in-time proofing does not address later-stage fraud.

Handle any cardholder data or sensitive authentication data encountered during verification in accordance with the current published PCI DSS; never store sensitive authentication data after authorization, even when encrypted, and confirm requirement specifics against the current standard version.