Identity proofing

Gathering and checking evidence about someone before they ever get an account.

It is the work an organization does to become confident that a new applicant is a real person and the person they claim to be. The applicant might show a driver's license, take a selfie, or confirm details against bank or government records, and the organization decides whether that evidence is enough.

A multi-step process that consists of (1) collecting evidence such as a government ID or third-party record, (2) validating that the evidence itself is genuine, and (3) verifying it belongs to the person presenting it. The rigor of that combination determines how much confidence the result earns. One widely used benchmark is the US National Institute of Standards and Technology (NIST) Special Publication 800-63A, which grades proofing from identity assurance level 1 (IAL1) to level 3 (IAL3).

NIST names the three steps resolution, validation, and verification, then adds enrollment once the applicant passes:

• Resolution collects evidence and core details, such as a name, date of birth, and government identifier, and determines that they point to one real, unique person.
• Validation confirms that the evidence is genuine and accurate and that its details match authoritative or credible records.
• Verification confirms that the applicant is the rightful owner of the evidence, for example through an automated face comparison, a confirmation code sent to a validated phone number or address, or a small test transaction to a bank account.
• Enrollment creates the account and ties login methods, called authenticators, to it.

NIST also rates identity evidence by strength:

• Fair evidence comes from a source that confirmed the person's identity under formal procedures, such as a bank or mobile carrier.
• Strong evidence, such as a government-issued photo ID, comes from an issuer whose written procedures face regulatory oversight, and it carries a facial image or other biometric.
• Superior evidence carries data that the issuer digitally signed, so a verifier can check it cryptographically, and the issuer confirmed the person's physical existence in an attended process.

Proofing can also happen in different settings. NIST sorts it by where it takes place, remote or on-site, and by whether a trained agent attends or the process is fully automated.