A reliable identity verification workflow does more than approve or reject a user. It combines document checks, face matching, liveness detection, risk signals, and human review in a way that protects the business without creating unnecessary friction. This guide explains how to design that process, connect the right tools, handle failures, and measure whether the workflow is both effective and respectful of user privacy.
Overview
Identity verification is the process of establishing that a person is who they claim to be. In an online setting, the business cannot usually inspect an original document or meet the person in person, so it uses several types of evidence instead. A typical workflow may compare identity information, inspect an identity document, match a face to the document portrait, and check whether the person presenting the face is physically present.
These checks answer different questions:
- Identity information: Does the submitted name, date of birth, address, or other information fit the account and use case?
- Document verification: Does the identity document appear genuine, valid, and consistent with the information provided?
- Face match verification: Does the person in a live selfie or video resemble the portrait on the document?
- Liveness detection: Is the person presenting themselves likely to be physically present rather than using a photograph, replayed video, mask, or other presentation attack?
- Risk review: Are there contradictions, unusual patterns, or other signals that require additional investigation?
No single check proves identity in every situation. The appropriate combination depends on the risk of the activity, the information required, the user population, and the organization’s legal and privacy obligations. A low-risk account may need a lighter process, while access to valuable assets or regulated services may justify stronger identity proofing.
For a broader decision between conventional checks and credential-based approaches, see Verifiable Credentials vs Traditional Identity Verification. The important design principle is to collect only the evidence needed for the decision and to define what happens when the automated result is inconclusive.
Step-by-step workflow
1. Define the decision before choosing the checks
Start by writing down what verification enables. The decision might be opening an account, releasing a payment, granting access to a professional marketplace, confirming age, or recovering an account. Then classify the consequences of a false approval and a false rejection.
This makes it easier to choose a proportionate process. It also prevents teams from adding every available check without understanding its purpose. Document the accepted identity documents, supported countries or regions, minimum information, review thresholds, retention rules, and escalation path.
2. Collect information with clear user instructions
Explain what the user must submit, why it is needed, and how to capture it successfully. Instructions should cover lighting, glare, document placement, camera permissions, image quality, and whether the document must be current and undamaged. A short explanation of the process can reduce avoidable retries and support requests.
Ask for consent where required for biometric processing, and separate essential verification information from optional profile information. Do not request a face image, document field, or other sensitive data simply because the software can collect it.
3. Run document verification
Document verification software typically examines the document image, extracts relevant fields, checks formatting and machine-readable information where available, and looks for inconsistencies. Treat the result as an assessment rather than an unquestionable fact.
Build a fallback for common problems: blurry images, cropped edges, glare, unsupported document types, expired documents, mismatched names, and unreadable security features. Tell the user what to correct instead of returning a generic failure message. If the problem cannot be resolved through a retry, route the case to the defined review queue.
4. Add face matching when the risk justifies it
Face match verification compares a live capture with the portrait on an identity document. It can strengthen the connection between the document and the person using it, but performance may vary with camera quality, lighting, pose, accessibility needs, and the quality of the document portrait.
Set a policy for borderline results. A near-threshold match should not automatically become a permanent rejection. Offer a controlled retry, an alternative method where appropriate, or manual review. Record the reason for the outcome without retaining more biometric information than the workflow requires.
5. Use liveness detection to address presentation attacks
Liveness detection is designed to assess whether a real person is present during the capture. Depending on the implementation, the user may be asked to turn their head, follow an on-screen instruction, or provide a short video. These actions can add friction, so use them where the threat model calls for them rather than as a default substitute for good process design.
Test the experience on common devices and network conditions. Provide an accessible alternative when a user cannot complete a motion or camera-based step. A liveness failure should trigger a defined next action, not an unexplained dead end.
6. Combine results into an outcome
Use clear outcome categories such as approved, retry, manual review, and declined. Keep the decision logic understandable to the operations team. For example, an authentic document with a technical capture issue may need a retry, while conflicting identity information may need review.
Separate technical failure from risk failure. This distinction helps support staff resolve camera or upload problems without treating genuine users as suspicious. It also makes reporting more useful.
7. Complete manual review consistently
Manual reviewers need a checklist, evidence limits, service-level expectations, and an escalation route. The checklist should state which signals can support a decision and which issues require additional evidence. Reviewers should not improvise new requirements for individual users.
Keep an audit trail of the decision, reason code, reviewer or system action, and relevant timestamps. Access to identity images and biometric information should be limited to people and systems that need it.
Tools and handoffs
An identity verification workflow usually includes several connected components rather than one all-purpose tool:
- Capture interface: A web or mobile experience for collecting document images, selfies, video, and user declarations.
- Document verification service: A component that extracts fields and evaluates document consistency.
- Biometric component: A face match and, where appropriate, liveness detection service.
- Workflow or rules engine: The layer that combines results, applies thresholds, and sends cases to the right outcome.
- Case management queue: A controlled workspace for manual review, notes, escalation, and audit records.
- Account and support systems: The systems that receive only the decision or minimum required attributes, rather than unrestricted copies of sensitive evidence.
When evaluating identity verification software or a credential verification API, ask how results are returned, how failures are explained, what data is stored, how retention can be configured, and whether human review is supported. Also confirm how the system handles document types and user conditions relevant to your audience. A technically impressive tool may still be a poor fit if its handoffs are opaque or its failure states cannot be managed operationally.
Assign ownership at each handoff. Product teams may own the capture experience, security teams may own access controls, operations may own manual review, and compliance or legal teams may define requirements. The workflow should have one accountable owner even when several teams contribute.
For related operating controls, use the Identity Verification Implementation Checklist for Small Businesses. If the workflow concerns sellers, experts, or service providers, the requirements may include entity-level checks as well; see Entity Verification for Marketplaces.
Quality checks
Review the workflow using both security and user-experience measures. Useful operational checks include:
- Can a new user understand the required steps without contacting support?
- Are technical failures distinguishable from identity or fraud concerns?
- Does every automated rejection have a documented reason and an appropriate appeal or review path?
- Are manual reviewers applying the same evidence standards across cases?
- Are sensitive images, biometric outputs, and extracted fields protected by role-based access and defined retention rules?
- Can the team identify which step causes most retries, abandonment, and review volume?
- Are test cases available for poor lighting, damaged documents, name differences, older devices, accessibility needs, and supported document variations?
Track approval, retry, manual-review, decline, completion, and support-contact rates by workflow stage. These measures should be interpreted together. A higher approval rate is not automatically an improvement if it comes with more fraud, while a lower decline rate may reflect excessive friction or an overly narrow user population. Review outcomes by relevant device, document type, region, and user journey where doing so is lawful and appropriate.
Privacy is a quality requirement, not a final compliance check. Explain the purpose of collection, minimize stored evidence, secure data in transit and at rest, and establish a deletion process. For designs that reduce disclosure, compare the workflow with selective disclosure and other privacy-preserving approaches in Privacy-Preserving Identity Verification.
When to revisit
Identity verification workflows should be reviewed on a schedule and after meaningful changes. Revisit the process when the verification provider changes its document coverage, face match or liveness features, risk signals, API behavior, or data-retention options. A platform update can alter the user journey even when your own business rules have not changed.
Review the workflow after a material fraud pattern, a rise in support contacts, a significant change in completion or manual-review rates, a new product or customer segment, or an incident involving sensitive identity data. Also revisit the process when your organization changes what access, payment, benefit, or service verification unlocks.
Use this practical refresh sequence:
- Export recent funnel and outcome data by verification step.
- Sample approved, declined, retried, and manually reviewed cases.
- Compare failure reasons with the current user instructions and decision rules.
- Confirm that document types, device support, accessibility paths, and escalation contacts remain accurate.
- Recheck permissions, retention settings, vendor handoffs, and audit records.
- Test the revised workflow before releasing it broadly, then record the change and its expected effect.
A useful identity verification workflow is not the one with the most checks. It is the one that gathers proportionate evidence, gives legitimate users a clear path to completion, detects meaningful risks, and provides a fair way to resolve uncertainty. Keep the workflow documented, measure each handoff, and update it whenever the tools, threats, or business decision changes.
