Opening a bank account, signing up for a crypto exchange, or renting a car can involve checking identity without presenting a physical ID to an employee in person. Remote verification can reduce the need for a visit, but its reliability depends on the evidence, controls, implementation, and threats involved. Here is how the process can work, why businesses use it, and where important risks remain.
What Online ID Verification Actually Checks
Digital identity verification can combine several checks. The appropriate combination depends on the service, its risks, the required assurance, and applicable rules. The following are possible components, not a mandatory four-step checklist for every system:
- Document authentication. A system may examine an identity document for signs of alteration or forgery, using checks appropriate to the document and capture method. Examining a document image does not establish that every physical security feature has been inspected or that the presenter is its rightful holder.
- Biometric checks. Where facial comparison is used, it assesses the similarity between a captured face and a reference image, such as the photograph on an ID. Presentation-attack detection, sometimes described as a liveness check, addresses a different question: whether the capture appears to involve a genuine person rather than a presentation such as a photograph. Neither check guarantees resistance to all deepfake or injection attacks. Biometrics are not required in every verification process.
- Evidence and attribute validation. Where suitable sources are available and use is permitted, information may be checked against authoritative or credible records to assess its accuracy. Separately, sanctions or other watch-list screening evaluates regulatory or risk concerns. A screening match is not, by itself, proof of identity or wrongdoing and needs appropriate assessment.
- Risk assessment and review. A service may evaluate signals such as device information, location indicators, and unusual activity to decide whether additional checks or review are needed. These signals can be incomplete or misleading; they do not independently prove a person’s identity.
The combination matters, but the checks address different questions and have different limitations. A document may be genuine while being used by someone else, and matching personal details may not establish who is presenting them. NIST’s identity-proofing guidance distinguishes resolving an identity, validating evidence and attributes, and verifying the applicant’s association with them. It provides assurance-based requirements rather than treating the four examples above as a universal recipe.
Why Businesses Use Remote Verification
As businesses offer more services remotely, they need ways to establish identity without requiring every customer to visit a physical location. A suitable remote process can improve access and convenience. Its effectiveness should be evaluated for the particular service rather than assumed to equal or exceed every in-person process.
Market estimates provide context, not proof that a particular verification method is effective. IMARC Group estimates the global identity verification market at approximately $15.8 billion in 2025 and forecasts about $50.2 billion by 2034, with a projected compound annual growth rate of 13.28% for 2026–2034. Separately, a Juniper Research forecast published in August 2022 projected more than 5.2 billion digital-wallet users in 2026, compared with 3.4 billion in 2022. That older forecast is not a confirmed 2026 user count. It also does not establish that every wallet user underwent identity verification or represents one uniquely verified person.
The Regulatory Backbone: AML, KYC, and CDD
Regulated businesses may have legal duties to identify and verify customers, but those duties do not universally require one online method. The relevant requirements depend on the jurisdiction, sector, customer, and circumstances. The FATF’s Guidance on Digital ID is technology-neutral and explains how suitable digital identity systems can support elements of customer due diligence. FATF guidance should not be confused with the specific domestic rules that apply to a business.
Know Your Customer (KYC) is commonly used as a broad term for understanding and checking customers; it should not be reduced to a single onboarding check. Customer due diligence (CDD) includes identification and verification and, where applicable, understanding the relationship, addressing beneficial ownership, and ongoing scrutiny. The terms overlap in practice. A business needs to establish its applicable duties and approved procedures, including when checks must take place and how concerns should be escalated.
Where Real Risk Still Lives
Remote verification can reduce some practical barriers, but it does not eliminate fraud or privacy risks. Important examples include:
- Synthetic identity fraud. Rather than stealing one real person’s complete identity, fraudsters increasingly combine real and fabricated information (a real Social Security number with a fake name and address, for example) to create an identity that doesn’t map cleanly to any one victim, making it harder to detect and harder for a victim to discover.
- Deepfake and injection attacks on biometric checks. As liveness-check technology has improved, so has the sophistication of attempts to defeat it — injecting a pre-recorded or AI-generated video feed instead of a live selfie. This is a genuine, ongoing arms race between verification vendors and fraud techniques, not a solved problem.
- Data breaches exposing verification data itself. Depending on its design, a service may process document images, identification numbers, or biometric information. These can be sensitive and difficult to replace if exposed. A provider breach can affect customers of one or more client businesses, depending on what information was stored and which systems were compromised.
What Businesses Should Actually Look For in a Verification Process
- A risk-appropriate combination of checks, with evidence of their effectiveness and limitations; adding more checks is not automatically a better outcome if they are unsuitable or unnecessarily intrusive.
- Clear explanations of what data is collected, why it is needed, who can access it, and how retention and deletion are handled under applicable requirements.
- Regulatory alignment with the specific AML/KYC requirements that apply to the business’s industry and jurisdiction, since requirements vary significantly between, for example, financial services and general retail.
- A workable review or redress route for errors and unsuccessful applicants, including accessible alternatives where appropriate.
Putting Verification in Context
Online identity verification can support remote services and, where appropriate, help businesses meet customer-identification duties. A sound process distinguishes evidence validation, the applicant’s association with that evidence, and separate fraud or compliance screening. Choose controls for the actual risk and applicable rules, protect the information collected, and provide a way to address mistakes. Neither a successful check nor the use of several technologies guarantees that fraud has been eliminated.
Frequently Asked Questions
How big is the online identity verification market?
IMARC Group estimates the market at about $15.8 billion in 2025 and projects approximately $50.2 billion by 2034, with a forecast CAGR of 13.28% for 2026–2034. These are the publisher’s market estimates and projections, not measures of any individual system’s effectiveness.
What’s the difference between KYC and CDD?
KYC is commonly used as an umbrella term for knowing and checking customers. CDD includes identification and verification as well as other applicable measures, such as understanding a relationship and ongoing scrutiny. They should not be presented as two completely separate stages, with KYC only before onboarding and CDD only afterwards.
Can online identity verification be fooled?
Yes. Synthetic identities, stolen evidence, deepfakes, and injection attacks can challenge verification processes. Combining appropriate controls can help address different threats, but effectiveness depends on implementation and testing. No method should be described as completely foolproof.
Why are so many industries adopting digital ID verification now?
Remote services create demand for ways to check identity without requiring an in-person visit. Some regulated businesses also have customer-identification obligations. The required checks and whether a particular digital method is suitable depend on the service and applicable rules, rather than a universal duty to use online verification.
