Identity Verification
Confirming a user's claimed identity during authentication using passwords, OTP, biometrics, or KBA.
What is Identity Verification?
Identity Verification is the process of confirming that a user is who they claim to be during authentication. It answers the question: "Is this really John Doe trying to log in?"
Verification methods:
- Something you know: Password, PIN, security questions (KBA)
- Something you have: Phone (SMS/OTP), hardware token (YubiKey)
- Something you are: Biometric (fingerprint, face scan, iris)
- Behavioral: Typing pattern, mouse movement, gait analysis
Identity verification happens after an account exists (unlike identity proofing, which happens before). It's the core of authentication - proving you are who you claim to be.
Analogy
Think of identity verification like a bouncer checking your ID at a club. You claim to be 'John Doe' (identity), and the bouncer verifies it by checking your ID photo against your face (verification). This happens every time you enter (authentication).
Types and Use Cases
- Login flows: Password + OTP/MFA to verify user identity"
- "Banking": Step-up verification (MFA) for wire transfers, large withdrawals"
- "Healthcare": Verify identity before accessing patient records (HIPAA)"
- "Account recovery": Verify identity via email/phone before allowing password reset"
How it Works
// Identity Verification Flow (Simplified)
app.post('/login', (req, res) => {
const { username, password, otp } = req.body;
// Step 1: Verify identity (password)
const user = await verifyPassword(username, password);
if (!user) return res.status(401).send('Invalid credentials');
// Step 2: Step-up verification (OTP) for sensitive actions
if (req.session.pendingAction === 'wire_transfer') {
if (!verifyOTP(user, otp)) {
return res.status(401).send('Invalid OTP');
}
}
// Identity verified - grant access
req.session.userId = user.id;
res.json({ success: true });
});Identity Verification vs Identity Proofing
Identity Verification
Identity Proofing
Identity Verification happens during authentication (existing account)
Identity Proofing happens before account creation (new account)
Verification uses password, OTP, biometric
Proofing uses document scan, selfie match
Verification is for accessing your account
Proofing is for proving who you are to get an account
Best Practices for Identity Verification
- "Enforce MFA: Passwords alone are insufficient - require OTP/biometric as second factor"
- "Use FIDO2 for strongest verification: Hardware keys (YubiKey) are phishing-resistant"
- "Implement step-up verification: Require MFA for sensitive actions (wire transfers, admin access)"
How LoginRadius Powers Identity Verification
LoginRadius CIAM platform provides robust identity verification through multiple methods: password-based with breached password detection, multi-factor authentication (SMS/Email OTP, TOTP, FIDO2/WebAuthn, push notification), biometric verification (FaceID, TouchID, Windows Hello), and step-up verification for sensitive actions. Our platform also provides account recovery flows with identity verification (email/phone/SMS), adaptive authentication with risk-based verification, and detailed verification audit logs for compliance.
Resources
FAQs
Identity Verification confirms your identity during login (password + OTP + biometric). Identity Proofing verifies your identity before creating an account (scan ID, take selfie). Verification is 'prove who you are to access your account'. Proofing is 'prove who you are to get an account'.
KBA asks users knowledge questions that only they should know: 'What street did you grow up on?', 'What was your first car?', 'What is your mother's maiden name?'. Static KBA (set questions in advance) is now discouraged by NIST. Dynamic KBA (questions from credit reports) is considered weak. Use OTP/biometric instead.
LoginRadius provides comprehensive identity verification: (1) Password-based with breached password detection, (2) Multi-Factor Authentication (SMS/Email OTP, TOTP, FIDO2, push notification), (3) Biometric verification via FIDO2/WebAuthn (FaceID, TouchID), (4) Step-up verification - require MFA for sensitive actions, (5) Account recovery - verify identity via email/phone before password reset.