How does digital identity verification work? 8 vital data checks
Digital identity verification works by examining a variety of data sources, ID documents, and even selfie videos to ensure a person is who they say they are. These data sources are difficult to fake, making them the most secure and reliable way to verify identity online.
Plaid also looks at digital attributes like the customer's browser, location, and whether their email was part of a data breach. No one data point is considered on its own; rather each point is part of a holistic check across multiple platforms. In many cases, customers don't even know this data is there, making it more secure and more difficult to fake.
Then, companies are provided with an assessment of the risk a user presents. Based on a customizable risk level and other verification checks, the user may be able to complete verification or a company may require the user to undergo additional review to complete the process.
Digital identity verification platforms verify a range of data points, including:
1. Digital fingerprinting
When a customer wants to use a new financial app or service, as part of the onboarding process a company may require that customer to verify their identity. With the customer's permission, Plaid IDV looks at dozens of "fingerprints" related to their online activity, including:
Location
Browser settings
Cookies
Battery usage
Screen resolution
WebGL parameters
Each of these data points is compared to other data about the customer to verify they are a real person and determine the risk of fraud, allowing companies to make more informed decisions about risk and fraud protection.
2. Device and IP checks
Plaid also checks the user's device and IP address. For example, it looks to see if the IP address is associated with a data center, which could signify fraudulent activity. It also looks to see if there is a time zone mismatch—meaning the device says it's in the Pacific time zone while the IP address is located in the Eastern time zone.
Other IP address checks include:
IP geolocation mismatch
See AlsoSecurity at StripeIncognito session
Blocked cookies
Proxy or VPN usage
Using multiple data points is crucial to ensuring the accuracy of online identity verification, which is why Plaid looks at many different data points to determine fraud risk.
3. Email checks
When a user provides their email address, it enables Plaid IDV to associate their behavior with that address. The email address can then be checked for indications of fraud.
Email checks include:
Email deliverability: If the email is on a domain that isn't configured to receive email, that's a strong indication of fraud.
Disposable email: Plaid verifies whether the email is disposable, another high-risk indicator.
External account registration: If the email address is associated with accounts on popular social media, that's a strong indicator they are who they claim to be. For example, emails that have never been used to create a LinkedIn, Facebook, or Twitter account are more likely to be associated with fraud.
Recent domain registration checks: If the email address is associated with a domain that doesn't have a website or was purchased in recent weeks, it increases their chances of being associated with fraud.
Email data breaches: Finally, Plaid checks to see if the email address has been associated with a data breach. It analyzes how recent the breach was and how many times the email was uncovered. Surprisingly, the more data breaches an email has been exposed to, the better—because that means the address is likely to belong to a real person.
4. Phone checks
Phone number checks work similarly to email account checks. If the phone number is associated with several external accounts, say on Google or Facebook, that indicates the user is likely a real person. Phone numbers not associated with other accounts could be fraudulent or temporary numbers.
While you won't see the exact account, you will be able to see where the user has accounts using that same phone and email, making it easier to spot risky users.
5. Network risk
Network risk checks detect if a current user has attempted to verify their identity from the same device before, making it easier to detect fraud.
For example, if a user creates two separate online identity verification sessions from one device in the same day, they are likely at a higher risk than someone who creates two sessions from the same device 10 months apart. Granular details like these help organizations make smarter risk decisions based on verifiable data.
6. Behavioral analytics
As a user navigates the online Identity Verification process, Plaid tracks how they interact with the app or site, including how fast they type, whether data is copied and pasted or typed, and the order of input. People, for example, are likely to answer questions in order, while bots and bad actors may fill out information in less predictable patterns.
7. Digital ID verification and liveness/selfie verification
Many companies, especially in fintech, still need to collect government-issued IDs. Digital ID verification makes this process easier. With Plaid Identity Verification, for example, users simply snap a photo of their ID with their phone and upload it. Then, they submit a selfie verification to show they are a real person and look like the person in the documents they provide. Rather than replacing government IDs (which are required for many financial accounts), selfie verification makes it easier to verify that the person is real and looks like the person on the ID.
Read our article on how selfie verification works to learn more.
8. Database verification
Database ID verification compares information provided by the user with information stored in issuing databases. These databases store information about consumers, such as their social security number, date of birth, location, and email address. Comparing this information with information shared by the consumer can help verify identification.
Plaid's Identity Verification is a customizable online ID verification platform that helps companies reduce fraud risk and meet KYC and AML requirements in one easy-to-use solution. It verifies identity data by comparing it against regulated data sources, authenticates hundreds of different ID documents, and confirms liveliness through selfie verification. By analyzing hundreds of risk signals, Plaid helps reduce fraud losses while protecting the customer experience and increasing conversions.
