Identity proofing basics start with one simple question: is the person opening this account really who they claim to be? Identity proofing is the process a service uses to collect evidence about a claimed identity, check that the evidence is genuine, and confirm that it belongs to the applicant in front of it.
This guide explains the core idea behind proofing, the three steps most frameworks share, the roles involved and the evidence used. It is written for everyday people who meet proofing when they sign up for services, and for new IT and security staff who are about to design or run it.
Why Proving Who You Are Comes Before Logging In
Most people think of identity in terms of passwords and login codes. Those tools answer a later question: is this the same person who registered earlier? Proofing answers the earlier question of who that person was in the first place. Without it, a strong login simply protects an unknown identity.
Consider a hypothetical online pharmacy. If it lets anyone register as any patient, a criminal could create an account in a neighbor’s name and order prescriptions. Strong passwords would not help, because the attacker created the account. Only proofing at registration can stop that kind of impersonation at the source.
Proofing usually happens once, when an account is first created or when a person asks for access to something more sensitive. After that, the service relies on authentication, meaning the act of proving control of a password, passkey or other authenticator, to recognize the same person on each return visit.
Key Terms Every Reader Should Know
Identity work has its own vocabulary, and the words are often used loosely. The applicant is the person going through proofing. A claimed identity is the set of details they assert, such as a full name, date of birth and home address. Once proofing succeeds, the applicant becomes a subscriber.
A credential service provider, often shortened to CSP, is the organization that performs proofing and issues login credentials. A relying party is the service that depends on the outcome, such as a benefits portal or a bank. Sometimes the same organization plays both roles; sometimes they are separate companies.
Identity evidence is any document or record that supports the claim. A passport, a driver’s license or an official record held by a trusted source can all count. Evidence differs in strength depending on how carefully it was issued and how hard it is to counterfeit or obtain fraudulently.
The Three Core Steps of Proofing
Most modern frameworks, including the NIST SP 800-63 digital identity guidelines in the United States, describe proofing as three core checks followed by a recorded outcome. The names vary between countries and vendors, but the logic stays the same. Each check answers a different question, and skipping any one of them leaves a gap attackers can use.
- Identity resolution: narrowing the claim down to one unique person within the service’s population, using a minimal set of attributes.
- Evidence validation: confirming that the documents or records presented are genuine, current and accurate.
- Identity verification: confirming that the genuine evidence actually belongs to the applicant rather than to someone else.
- Enrollment outcome: recording the decision and binding the applicant to an account and its authenticators.
A simple example shows why all steps matter. A stolen but genuine passport would pass validation, yet fail verification because the face or other details do not match the person presenting it. A convincing forgery might match the presenter, yet fail validation. Proofing is only reliable when both checks succeed.
What Counts as Identity Evidence
Services group evidence into a few broad types. The type and number of pieces they request depends on how much confidence they need. Understanding these categories helps applicants know why one service asks for a single document while another asks for two plus a utility bill.
Government-Issued Documents
Passports, national identity cards and driver’s licenses are the most common evidence. They are issued after the government performs its own checks, and many contain security features such as holograms, special inks or an embedded chip. Electronic passports follow ICAO specifications, which allow the chip data to be checked for tampering using a digital signature.
Authoritative Records
Some evidence is not a document at all but a record held by a trusted source, such as a tax authority, a vital records office or a bank that already proofed the person. The service checks the claimed details against that source, usually with the applicant’s consent, instead of examining a physical card.
Supporting Evidence
Weaker items, such as utility bills, bank statements or student cards, may help confirm an address or link a name to a place. They are rarely enough on their own because they are easier to alter and are issued with lighter checks. Services typically use them to support, not replace, stronger evidence.
Who Performs Identity Proofing
Proofing can be done in-house or outsourced. Large public agencies and banks often run their own processes, staffed by trained employees at counters or in remote video sessions. Smaller organizations frequently rely on a specialized identity verification provider that handles document checks and record lookups on their behalf.
Increasingly, a person proofed once by a trusted provider can reuse that result elsewhere. Federation, where one organization vouches for a user to another, and digital identity wallets that hold verified credentials both allow this. Reuse reduces repeated document uploads, though it also concentrates trust in the original proofing provider.
Whoever performs it, proofing creates responsibilities. The organization handles sensitive personal data, makes decisions that can lock people out of essential services, and must protect records from breaches. Clear policies on retention, access and appeals are part of doing proofing responsibly, not optional extras.
In-Person and Remote Settings
Proofing traditionally happened at a counter, where staff could handle the physical document and compare the photo to the face in front of them. In-person settings remain valuable for high-risk cases and for people who struggle with technology, but they cost more and require travel.
Remote proofing moves the process to a phone or computer. The applicant may photograph a document, take a selfie and answer prompts, or join a live video call with a trained agent. These options are convenient, but they introduce risks such as manipulated images and require strong technical safeguards.
Many services now offer both paths. A reasonable design lets most people complete proofing remotely while keeping an in-person or assisted alternative for anyone who cannot finish online. Offering a fallback avoids excluding people who lack a smartphone, a valid photo document or a stable internet connection.
How Much Assurance Is Enough
Not every service needs the same depth of proofing. A newsletter signup needs none, while access to medical records or tax accounts demands a lot. Frameworks express this as assurance, meaning the degree of confidence that the applicant really is the claimed person.
NIST describes this through identity assurance levels, usually written IAL, which range from minimal checks to strict, in-person or supervised processes. Other regions use their own schemes, such as the assurance levels under the EU eIDAS regulation. The names differ, but each scheme ties stronger checks to higher risk.
Choosing a level is a risk decision. Organizations ask what would happen if an impostor got through: financial loss, harm to safety, exposure of private data or damage to trust. The more serious the potential harm, the stronger the evidence and verification they should require before granting access.
Common Mistakes in Basic Proofing Programs
A frequent error is collecting more personal data than the decision needs. Asking for full document scans, multiple identifiers and extensive history may feel thorough, yet it increases the damage of any breach. Good proofing gathers the minimum attributes required to resolve and verify the identity.
Another mistake is treating proofing as a single checkbox. Services sometimes validate a document but never confirm it belongs to the applicant, or rely on answers to personal questions that criminals can find in leaked data. Each step must be present and must use reasonably strong methods. Other recurring problems include:
- Rejecting legitimate applicants without explanation or a way to try again.
- Accepting expired or unverifiable documents to keep signup numbers high.
- Storing raw document images indefinitely with broad staff access.
- Offering no assisted path for people who cannot finish online.
Privacy Considerations During Proofing
Proofing involves some of the most sensitive data a person has: document images, identity numbers and often a facial image. In many places, biometric data such as a face template is treated as especially sensitive, for example as a special category under GDPR or under state laws like Illinois BIPA.
Applicants should be told what is collected, why, who processes it, and how long it is kept. Services should separate the proofing evidence from everyday account data, restrict who can view it, and delete raw images once the decision and any required records have been retained.
Rules differ widely between countries and states, so organizations should confirm their obligations with the relevant regulator or legal adviser. For individuals, the practical step is to read the privacy notice before uploading documents and to prefer services that explain retention and deletion in plain language.
A Hypothetical Walkthrough
Imagine Maya applying for an online account with a regional health agency. She enters her name, date of birth and address. The system uses those attributes to find a single matching record in its population, which completes resolution without asking her for extra identifiers she does not need to share.
Next she photographs her driver’s license. The service checks the document’s security features and confirms that the license is current with an authoritative source. This is validation. Then she takes a short selfie, and the system compares it with the license photo to confirm she is the rightful holder.
The agency records the result, links her account to a passkey on her phone, and deletes the raw images according to its retention policy. If any step had failed, Maya would have been offered a video session or an appointment at a local office instead of being turned away.
Preparing for Your Next Proofing Request
If you are an applicant, keep at least one valid photo document within its expiry date, and know where your supporting records are. Use good lighting when photographing documents, and only start proofing from a link you reached yourself, not one sent in an unexpected message.
If you are building or running a proofing process, map each step to a specific control, set an assurance level based on a documented risk assessment, and test the experience with real users, including those with disabilities or limited documents. Review retention and deletion rules before launch.
Proofing standards keep evolving as digital credentials, mobile driver’s licenses and identity wallets spread. Following updates from bodies such as NIST, your national digital identity program or the relevant regulator will help you adapt without rebuilding everything each time the rules change.