Identity verification is how a service confirms that you are really who you say you are. Maybe you opened a bank account on your phone. Maybe you signed up for a government portal and were asked to photograph your passport. That quick moment of holding up an ID is a full online ID check, and a lot happens behind the screen.
This guide explains what identity verification means and how an online ID check works step by step. It covers what a selfie and liveness test actually do, where biometrics fit in, and how the IRS version differs from a bank sign-up. It also looks at the risks and the open debates.
What Is Identity Verification?
Identity verification means proving that a claimed identity belongs to a real person and that you are that person. It answers two questions. Does this identity exist? And is the person in front of the screen its rightful owner?
That is different from logging in. Signing in to an account you already have is authentication, which our guide to biometric authentication covers. ID verification happens earlier, when an account is first created or when a risky action needs extra proof.
How Identity Verification Online Works, Step by Step
Providers differ in the details, but most follow the same pattern. The US standards body NIST describes a process flow for remote identity proofing with four stages: resolution, validation, verification and enrollment.
Step 1: You hand over evidence
This is the part you see. You enter your name and date of birth and photograph a government ID such as a driver’s license or passport. Some services also ask for a number such as a Social Security number. This stage is called resolution because the service is narrowing down who you claim to be.
Step 2: The document is checked
Software reads the printed text and any barcode or chip data. It looks at security features, fonts and layout, and it checks that the document has not expired. In NIST terms this is validation: is the evidence authentic, accurate and valid? Details are often compared with records from trusted sources.
Step 3: You prove the ID is yours
A real ID is not enough, because a stolen ID is also real. So the service asks for a selfie or a short video and compares your face with the photo on the document. This is where biometrics enter the picture, and we come back to it below.
Step 4: Contact details are confirmed
Finally the service confirms you control the phone number, email or address you gave. That may be a one-time code by text or a letter by mail. Then your account is created or your request moves forward.
Selfies, Liveness Checks and the Biometric Part of an Online ID Check
The face match is a one-to-one comparison. The system asks whether the selfie matches the face on this one document. It does not search a giant database for you. If you want the background on how that kind of match works, see our explainer on biometric data.
Liveness detection is the anti-spoofing layer. It tries to tell a live person from a photo, a screen replay or a mask. NIST says remote services using biometrics must use presentation attack detection with an impostor attack presentation accept rate below 0.07, tested to the ISO/IEC 30107-3 standard. The same section sets a false match rate of 1 in 10,000 or better and a false non-match rate of 1 in 100 or better for the one-to-one check.
In plain words, the face check should wrongly accept a stranger very rarely. It may still reject the right person fairly often, so a retry is normal. Poor light, glasses and old ID photos are common reasons.
What Do Online ID Verification Services Check?
An online ID verification service is a company that runs these steps for banks, apps and employers. Different tasks need different strength. NIST groups its identity assurance levels in three tiers.
| Level | What it aims to stop | What it involves |
|---|---|---|
| IAL1 | Automated sign-ups and synthetic identities | Evidence or self-asserted details checked against credible sources |
| IAL2 | Scaled and targeted attacks, basic fake documents, social engineering | More evidence and stricter validation and verification |
| IAL3 | Advanced forgery and social engineering | A trained representative at an on-site session plus a collected biometric |
Source: NIST SP 800-63A. Most consumer apps sit near the middle of this range, while a low-risk newsletter may need almost none of it.
Identity Check Online With a Government: Login.gov Example
Government portals show the pattern clearly. Login.gov, the US federal sign-in service, describes four steps: photograph an accepted ID and maybe take a selfie, give your Social Security number, confirm your phone number with a code, then re-enter your password to save the result. If photos do not work, in-person checks at a US Post Office may be an option.
Notice that every step maps to the flow above. Evidence, validation, proof of ownership and contact confirmation are all there.
IRS Identity Verification: A Different Situation
Many people land on this topic after a letter from the tax agency. IRS identity verification usually starts when the agency sends a notice from the CP5071 series or letter 5447C. The IRS says its Identity and Tax Return Verification Service is only for people who received one of those.
You sign in to or create an IRS online account, then answer questions. Have the notice and the original or amended Form 1040 for the year named in it. After you verify, the IRS suggests waiting two to three weeks before checking a refund. Processing can take up to nine weeks.
If you did not file a return, the same service lets you tell the IRS that someone may have used your details. As always, only enter personal data on a real .gov site you reached yourself, not through a link in a text or email.
Benefits and Risks of Online ID Checks
Supporters say remote checks cut fraud, open services to people who cannot visit a branch, and save time. A bank that can verify you in minutes can serve customers anywhere. Our piece on biometrics in banking shows how this has spread.
Critics raise fair concerns. You hand a stranger your ID image and a face scan. Data may be stored for years. Face matching can work unevenly across people and conditions. Others answer that strong rules on consent and deletion, like those NIST lists, address much of this. Both views have evidence behind them.
- Privacy: Ask what is kept, for how long, and how to delete it.
- Fairness: A failed check should always have a human backup route.
- Fraud: Deepfakes and fake documents keep pushing providers to improve liveness tests.
- Access: People without a standard ID can be left out.
How to Stay Safe During an ID Check
- Start from the official app or site yourself. Do not follow a link in an unexpected message.
- Read what the service says it will do with your photos.
- Use good light and a plain background so you do not fail for no reason.
- Never share the one-time codes you receive with anyone.
- Look for a way to delete your data afterward.
FAQ
What is an online ID check?
It is a process where you photograph an ID, often take a selfie, and confirm contact details so a service can confirm your identity without meeting you.
Is ID verification the same as authentication?
No. Verification proves who you are when you enroll. Authentication proves you are the same person each time you come back. See our guide to uses of biometrics for more everyday cases.
How long does identity verification online take?
Automated checks often finish in minutes. Manual reviews, mailed codes or tax agency processing can take days or weeks.
Why did my identity check online fail?
Common causes include blurry photos, glare, an expired document, a name that does not match records, or a face that looks different from the ID photo. Try again with better light or use the backup option the service offers.
Is a selfie always required?
No. Some services check only records or documents. Higher-risk ones add a selfie and liveness test to confirm the ID belongs to you.
Questions to Think About
Would you trade a face scan for a faster sign-up? Who should hold the images, the app, the verifier or nobody after the check? And should every service offer a no-biometrics route, even if it is slower? Share your view in the comments.
Sources
- NIST SP 800-63A: Digital Identity Guidelines, Identity Proofing and Enrollment
- Login.gov: Verify your identity
- IRS: Identity and Tax Return Verification Service
