Identity Proofing and KYC Basics: A Secure Workflow for Verifying People Online

Overview

Identity verification and identity proofing are related but distinct. Identity verification usually means checking information or evidence against an existing claim. Identity proofing is the broader process of creating confidence that an identity belongs to a real person and that the person presenting it is the legitimate holder.

A useful workflow should match the strength of the checks to the consequence of failure. A low-risk account may need basic contact verification and device safeguards. A regulated onboarding process, high-value transaction, or privileged administrator account may require stronger evidence, manual review, and a documented decision trail. There is no single verification method that is appropriate for every situation.

Start by writing down four decisions:

• What are you protecting? Examples include an account, a payment process, a professional credential, or access to sensitive systems.
• What could go wrong? Consider impersonation, stolen documents, synthetic identities, account takeover, duplicate accounts, or an honest user being rejected.
• What evidence is necessary? Collect only the information needed to reach a defensible decision.
• What happens after a result? Define approval, rejection, manual review, escalation, retention, and appeal paths before launch.

For organizations that issue credentials after proofing, keep identity proofing separate from credential presentation. A verified person may later present a digital credential, QR code, or signed document. The credential should still be checked for issuer, status, integrity, and intended use. See the guide to verifiable credentials and validation for that later stage.

Checklist by scenario

1. New account or customer onboarding

• Define the minimum assurance level required for the account type.
• Verify control of a contact channel, such as an email address or phone number, where appropriate.
• Collect identity documents only when they are relevant to the risk and purpose.
• Compare submitted identity data with the information needed for the account, rather than copying every available field.
• Record the verification result, reason codes, and time of decision.
• Provide a safe recovery process that does not undermine the original checks.

A successful document check does not automatically prove that the applicant is the legitimate document holder. Consider whether the workflow also needs a selfie comparison, liveness detection, device signals, or a manual review path.

2. High-risk transaction or account change

• Require step-up verification when a user changes a payment destination, recovery method, or privileged setting.
• Recheck relevant identity evidence instead of treating an old approval as permanent.
• Compare the event with known account activity, device context, and access history.
• Pause unusual cases for review rather than forcing an automatic approve-or-deny decision.
• Notify the account holder through a trusted channel when a sensitive change is completed.

The goal is proportionality. A user who has already passed onboarding may still need additional checks when the requested action creates a materially different risk.

3. Employee, contractor, or administrator access

• Confirm the person’s identity before issuing an account or access credential.
• Connect the identity to an approved organization record and role.
• Use stronger authentication for administrators and other high-impact roles.
• Limit permissions to the tasks required by the role.
• Review access when employment, contract status, team assignment, or responsibilities change.
• Revoke credentials promptly when access is no longer justified.

Identity proofing is only one part of workforce security. Account lifecycle controls, authentication, authorization, and access reviews must continue after the initial decision.

4. Issuing or accepting a professional certificate

• Confirm the issuer’s identity and authority to grant the credential.
• Check that the recipient’s identity matches the enrollment or assessment record.
• Give the credential a unique identifier or verification URL.
• Protect the credential against unauthorized alteration through an appropriate signature, hash, or tamper-evident design.
• Define whether the credential can expire, be suspended, or be revoked.
• Make the verification result understandable to the person checking it.

When someone needs to verify a training or employee certificate, a public verification page should reveal enough information to establish authenticity without exposing unnecessary personal data.

What to double-check

Document and selfie checks

Document verification can inspect fields, formatting, security features, expiration, and consistency. It should not be treated as an absolute guarantee. A document may be genuine but used by the wrong person, or the information may no longer reflect the user’s current circumstances.

Selfie comparison can help connect a person to a document. Liveness detection is intended to help distinguish a live person from a photograph, replay, mask, or other presentation attack. Review how the system handles poor lighting, accessibility needs, camera limitations, and users who cannot complete a particular challenge.

Fraud signals and decision rules

Useful signals may include repeated use of the same document details, inconsistent personal information, suspicious velocity, unusual device changes, failed attempts, or mismatches between submitted evidence and account activity. Treat these as indicators for a decision process, not automatic proof of fraud.

Document each rule in plain language. For every signal, specify whether it causes rejection, additional verification, manual review, or monitoring. This makes the workflow easier to test and explain.

Privacy and retention

• List every field collected and state why it is needed.
• Restrict access to identity evidence by role.
• Encrypt sensitive data in transit and at rest where appropriate.
• Separate operational decision records from raw document images when possible.
• Set retention and deletion rules before collecting data.
• Review vendor access, exports, logs, and deletion behavior.

A good audit trail records what was checked, which result was returned, who or what made the decision, and when it happened. It should not require keeping every piece of sensitive evidence indefinitely.

Common mistakes

• Using one assurance level for every user: Match checks to risk and consequence.
• Assuming a document check proves ownership: Add a holder check when impersonation is a meaningful concern.
• Relying entirely on automation: Maintain a controlled manual review path for ambiguous or high-impact cases.
• Collecting more data than necessary: Extra data increases exposure without necessarily improving the decision.
• Ignoring legitimate users who fail: Test accessibility, image quality, name variations, language, and recovery options.
• Failing to define revocation: A credential or approval may need to be suspended when circumstances change.
• Confusing verification with trust: A valid document, signature, or QR result does not by itself establish that the issuer, purpose, or underlying claim is appropriate.

For document-based workflows, also distinguish identity proofing from document authenticity. A signed document can show that content has not changed since signing, but it may not prove that every statement in the document is true. The guide to document tamper detection explains this boundary.

When to revisit

Review the workflow before seasonal planning cycles, major product launches, and changes to the users or transactions it serves. Revisit it whenever authentication, recovery, document handling, vendors, risk rules, or credential formats change.

Use this action list for each review:

1. Compare recent approval, rejection, review, and appeal outcomes.
2. Identify repeated failure points and investigate whether they indicate fraud, poor instructions, or an accessibility problem.
3. Test the complete flow, including document capture, selfie or liveness checks, manual review, notifications, recovery, and deletion.
4. Confirm that audit records support an explanation of each decision.
5. Review permissions, retention settings, integrations, and vendor changes.
6. Run a small controlled test after every significant workflow change.
7. Update internal documentation and train reviewers on changed rules.

Keep the checklist versioned. Record the date, owner, scope, and reason for each change so that a future reviewer can understand which controls were in place when a decision was made. A repeatable review process turns identity verification from a one-time setup task into a maintainable part of identity and credential management.