To verify someone’s identity, start by examining a valid government-issued photo ID and confirming the details match the person in front of you, then add further checks — digital ID data, knowledge-based questions, biometric matching, or a background check — based on how much certainty the situation demands. That layered approach is how to verify someone’s identity in a way that holds up, whether you’re renting a room, hiring an employee, or opening an account for a customer.
Start With a Government Photo ID
A driver’s license, state ID card, passport, or military ID is the baseline. Compare the photo to the person: facial structure, eye color, general appearance. Confirm the name and date of birth. Check the expiration date. An expired ID is the single most common issue and the easiest one to overlook.
Real IDs carry security features that counterfeiters struggle to replicate. Holograms shift color or image when tilted. Microprinting shows tiny text under magnification. Raised lettering can be felt with a fingertip. UV-reactive elements appear under a blacklight. Warning signs of a fake include blurry photos, inconsistent fonts, peeling laminate, and material that feels unusually thin or thick. Gently flexing the card can reveal laminate bubbles or flimsy construction a legitimate card wouldn’t have.
Since May 2025, federal agencies including the TSA require a REAL ID-compliant driver’s license or state ID for boarding domestic flights and entering certain federal buildings. A compliant card has a star in the upper corner, black or gold, filled or outlined. A card without that star doesn’t meet the REAL ID standard for federal purposes, though a passport, passport card, or military ID still works.1USAGov. How to Get a REAL ID and Use It for Travel
Accepting a Mobile Driver’s License
More than 20 states and territories now issue mobile driver’s licenses (mDLs) stored in a phone’s digital wallet, including Arizona, California, Colorado, Georgia, Illinois, New York, and Virginia. They’re accepted at over 250 TSA checkpoints for domestic travel.2Transportation Security Administration. Participating States and Eligible Digital IDs
A digital ID has a verification advantage over a physical card. Rather than handing over a document that could be photographed or copied, the holder shares only the specific data requested through an encrypted transfer, often by near-field communication or a QR code read directly by a scanner. Acceptance outside airports is still uneven, so a digital ID usually shouldn’t be the only form of verification you’ll accept.
Asking Knowledge-Based Questions
Knowledge-based authentication (KBA) verifies identity by asking questions that, in theory, only the real person can answer. You’ve seen it when you call your bank, apply for credit, or reset an account.
Static KBA uses pre-set questions chosen during account setup: mother’s maiden name, the street you grew up on, first pet. The weakness is well-documented. Most of that information is guessable, findable on social media, or has been exposed in a data breach.
Dynamic KBA generates questions in real time from credit reports, public records, and transaction history. Out-of-wallet questions like “Which of these addresses have you lived at?” or “What was the approximate monthly payment on your auto loan in 2019?” are harder for an impostor to answer because the information isn’t sitting in a stolen wallet or on a social profile. Dynamic KBA is widely used during account openings and loan applications.
Neither form is foolproof. The volume of personal data available online has steadily weakened KBA, which is why most institutions now layer it with other checks rather than treat it as standalone proof.
Biometric Checks and Multi-Factor Verification
Biometric verification confirms identity through a physical characteristic, most often a face scan, fingerprint, or iris pattern. In a remote setting, like opening a bank account online, you’ll typically be asked to take a selfie and photograph your ID. Facial matching software compares the two images to confirm you’re the person on the document.
To defeat someone holding up a printed photo or a deepfake video, these systems use liveness detection. Active liveness asks you to perform an action during recording, such as turning your head or blinking. Passive liveness analyzes a single image for subtle cues that separate a live face from a screen, mask, or printout, looking for artifacts like unnatural lighting or screen reflections. More advanced systems combine both.
Multi-factor authentication (MFA) combines two or more methods from different categories: something you know (a password or PIN), something you have (a phone or hardware security key), and something you are (a fingerprint or face scan). Federal identity guidelines from NIST define three authentication assurance levels, with the highest requiring hardware-based authenticators and cryptographic proof of identity.3National Institute of Standards and Technology. NIST Special Publication 800-63-3 Digital Identity Guidelines MFA has become the baseline expectation for financial accounts, healthcare portals, and government services because compromising a single factor isn’t enough to break in.
Using Background Checks and Verification Services
When documents and digital checks aren’t enough, professional verification services pull from databases the public can’t access. They’re standard in hiring, tenant screening, and regulated industries.
- Criminal background checks search federal, state, and county records for convictions. State agency fees for name-based or fingerprint-based checks typically range from roughly $12 to $95 depending on jurisdiction and method.
- Employment and education verification contacts past employers and schools directly to confirm job titles, dates of employment, degrees earned, and attendance records.
- Credit-based identity verification cross-references a person’s name, Social Security number, and address against credit bureau data to confirm the information belongs to a real, living individual.
Identity verification platforms used in financial services combine several of these methods with AI-powered document scanning, biometric matching, and database cross-referencing, and they handle Know Your Customer (KYC) and anti-money laundering (AML) compliance at a speed a human reviewer couldn’t match.
Rules You Have to Follow When Verifying Identity for a Business
Verifying identity for a business is more than a practical step. It puts you under several federal laws that dictate how you must run the process and handle the data.
Get Written Consent Before a Background Check
Before pulling a background check through a consumer reporting agency for hiring, tenant screening, or a similar purpose, you must give the person a clear written disclosure that you plan to obtain the report. That disclosure must stand alone as its own document; you can’t bury it inside a job application or lease. The person then authorizes the check in writing before you proceed.4Office of the Law Revision Counsel. United States Code Title 15 – 1681b Permissible Purposes of Consumer Reports Skipping the step or bundling the disclosure with other paperwork is one of the most common compliance mistakes and a frequent source of lawsuits.
If you deny someone based on information in the report, you must send an adverse action notice. It has to include the name, address, and phone number of the reporting agency, a statement that the agency didn’t make the decision, and information about the person’s right to a free copy of the report and to dispute errors within 60 days.5Office of the Law Revision Counsel. United States Code Title 15 – 1681m Requirements on Users of Consumer Reports The rule applies whether the denial is for a job, a rental, or credit.
The Red Flags Rule
Financial institutions and creditors that maintain covered accounts must adopt a written identity theft prevention program under the Red Flags Rule. The program has to identify warning signs of identity theft relevant to the business, detect those red flags in day-to-day operations, respond when they appear, and be updated as risks change.6eCFR. Title 16 CFR Part 681 – Identity Theft Rules The FTC can impose civil penalties of up to $53,088 per knowing violation.7Federal Register. Adjustments to Civil Penalty Amounts
Bank Customer Identification Programs
Banks must maintain a written Customer Identification Program (CIP) as part of anti-money laundering compliance. At minimum, before opening any account the bank must collect each customer’s name, date of birth, address, and an identification number: a Social Security number for U.S. persons, or a passport number or other government-issued ID number for non-U.S. persons.8eCFR. Title 31 CFR 1020.220 – Customer Identification Program The bank must then verify that information within a reasonable time using documents, non-documentary methods like database checks, or both, scaled to the bank’s size, location, and customer base.
Protect and Dispose of the Data You Collect
Collecting identity information creates a custody obligation that lasts until the data is properly destroyed. The FTC’s Disposal Rule requires anyone who uses consumer report information for a business purpose to dispose of it so it can’t be read or reconstructed: shred, burn, or pulverize paper records, and completely destroy or erase electronic files. If you hire a destruction contractor, you’re expected to vet them.9Federal Trade Commission. Disposing of Consumer Report Information – Rule Tells How The rule reaches lenders, employers, landlords, insurers, debt collectors, attorneys, and individuals who pulled a credit report on a prospective nanny or contractor.
Separately, the Gramm-Leach-Bliley Act’s Safeguards Rule requires financial institutions to develop and maintain an information security program with administrative, technical, and physical safeguards protecting customer data, including identity information collected during verification.10Federal Trade Commission. Gramm-Leach-Bliley Act The moment you collect personal information to verify someone, you take on a legal responsibility to protect it for as long as you hold it and to destroy it properly when you no longer need it.