Identity Proofing: 3 Steps That Prove a User Is Real
Identity proofing is the process of establishing that an applicant really holds the identity they claim before you give them an account or credential. Under NIST’s digital identity guidelines, it has three steps: resolve the identity to one unique person, validate the evidence, and verify that the applicant owns it. The strength you need depends on the risk of what you protect.
Identity Proofing vs Identity Verification vs Authentication
In fact, these terms describe different moments in an identity’s life. Proofing happens once, at the start, while authentication happens every time the person returns. Mixing them up leaves gaps, so the table sets them apart.
| Term | Question | When |
|---|---|---|
| Identity proofing | Is this a real person who they claim to be? | Once, at enrollment |
| Identity verification | Does the applicant own this evidence? | The last step of proofing |
| Authentication | Is this the same person we proofed before? | Every login |
The two ends depend on each other. A strong password or face login proves little if a fraudster opened the account with someone else’s identity, so weak proofing undermines every login that follows. Many teams also use identity verification loosely for the whole process, although in NIST’s framework it is only the final step.
The Three Steps: Resolution, Validation, Verification
NIST Special Publication 800-63A-4 describes identity proofing as three steps, and each removes a different kind of doubt.
| Step | Question it answers | Typical checks |
|---|---|---|
| Resolution | Which single real person is this? | Collect name, date of birth, and ID number, then rule out duplicates |
| Validation | Is the evidence genuine and accurate? | Document checks plus checks against authoritative records |
| Verification | Does the applicant own this evidence? | Face match between a live selfie and the ID photo, with liveness |
After these steps, the service enrolls the person and issues an account or credential. Skipping any step leaves a hole, because a genuine passport proves nothing about its holder unless you verify the match. Verihubs maps onto these steps in a concrete way: OCR reads the identity data that feeds resolution, MRZ check digits support format validation, and a face match handles verification.
Evidence Strength: Why Some Documents Count More
However, not all evidence is equal. NIST grades identity evidence as fair, strong, or superior, based on how the issuer produced it and what it contains.
- Fair. Issued through a formal process, with unique identifying details and some security features.
- Strong. Adds written issuance procedures under regulatory oversight, as well as a facial image or other biometric.
- Superior. Also carries cryptographically signed data, such as a chip, issued after an in-person proofing process.
In everyday terms, a national ID card or passport is usually strong evidence, while a passport whose chip you actually read and check can reach superior. A utility bill, by contrast, supports an address but proves little about identity. So proofing usually needs one strong document plus a live face check, rather than a stack of weak papers.
NIST SP 800-63-4 Assurance Levels
NIST groups the strength of the whole proofing process into Identity Assurance Levels. Higher levels need stronger evidence and stricter verification.
| Level | What it means | Typical use | Rough equivalent |
|---|---|---|---|
| IAL1 | Basic proofing, often remote, with lighter evidence | Low-risk services with limits | eIDAS low |
| IAL2 | Stronger evidence plus verification, remote or in person | Financial accounts, healthcare portals | UK GPG 45 medium, eIDAS substantial |
| IAL3 | Strongest evidence, with an attended session | Sensitive government or privileged roles | eIDAS high |
NIST’s guidelines are a US federal standard, yet many private firms worldwide use them as a reference because they offer a clear, published vocabulary. The equivalents above are approximate, so teams with a legal duty should check the source frameworks. Verihubs supplies controls that support remote proofing, but it does not claim certification at any specific IAL, since that assessment belongs to the implementing organization.
What Changed in NIST SP 800-63-4
The 800-63-4 revision updated how NIST treats remote proofing and emerging threats. According to NIST, the revision gives more attention to fraud, equity, and the risks of unattended remote checks. So it reflects a world where most proofing happens through a phone camera, not at a branch.
The practical takeaway is that remote proofing must actively resist presentation and injection attacks, rather than assume a cooperative user. This is exactly where liveness and deepfake defenses move from optional to central.
Remote Unattended Proofing: Where Liveness and Deepfake Checks Fit
Most digital onboarding is remote and unattended, so no agent watches the camera and the system must spot fraud on its own. That raises a specific risk: the face presented might not be a live person at all.
- Presentation attacks. A printed photo, a screen replay, or a mask held up to the camera.
- Injection attacks. A fake video fed straight into the app, bypassing the camera.
- Deepfakes. AI-generated or face-swapped video that mimics the real document holder.
Liveness detection is therefore the gatekeeper of the verification step. Verihubs liveness detection confirms a living human is holding the phone, then ID-to-selfie face matching confirms that person matches the document photo, and a deepfake check screens out synthetic faces. For the attack side, the guides to presentation attack detection and injection attack detection explain why camera-level checks alone are not enough.
Choosing an Identity Proofing Level by Product Risk
So match proofing strength to the harm a fake account could cause. Too little invites fraud, while too much drives away honest users.
- List the harms. Money movement, access to personal data, regulatory penalties, and reputational damage.
- Map products to levels. Low-limit wallets need less, while lending and high-value transfers need more.
- Step up when risk rises. Start with lighter proofing, then require stronger checks before high-risk actions.
- Review attack trends. Raise the bar when new attacks, such as deepfakes, start hitting your flows.
Take a digital bank. It might accept fair evidence and a basic check for a low-limit savings account. Before the customer can borrow or send large sums, though, it requires a national ID, a live selfie match, and a database check.
Frequently Asked Questions
What is identity proofing?
Identity proofing is the process of confirming an applicant’s claimed identity before giving them an account or credential. It resolves the identity, validates the evidence, and verifies that the applicant owns it.
Can you provide an example of identity proofing?
A user opening a bank account online enters their details, photographs their national ID, and takes a selfie. The bank checks the ID, confirms the data against official records, and matches the selfie to the ID photo with a liveness check.
What is the difference between identity proofing and identity verification?
In NIST’s framework, verification is the last step of identity proofing, where you confirm the applicant owns the evidence. In everyday use, many people say identity verification to mean the whole proofing process.
What else can you use to prove your identity?
Besides a passport or a national identity card, services may accept a driving license, a residence permit, a digital ID, or a bank-verified identity. Utility bills help with address but carry little weight for identity.
What are NIST identity assurance levels?
They are three levels, IAL1 to IAL3, that describe how strongly a person’s identity was proofed. Higher levels require stronger evidence and stricter verification, up to an attended session at IAL3.
Identity Proofing Sets the Ceiling for Everything That Follows
Every login, payment, and permission inherits the strength of the original proofing, and strong authentication later cannot fix a weak start. So resolve the identity carefully, validate the evidence, verify the person with a live face match, and choose the level that fits your product’s risk. Then raise the bar as attacks evolve, so fake accounts stay out without slowing down real customers.
Building remote identity proofing that resists fakes? Ask Verihubs how document validation, face match, and liveness strengthen each proofing step.
