Identity Verification

Consumer-facing organizations face intensifying pressure to reduce identity-related fraud while keeping onboarding and transactions fast, low-effort, and compliant across many jurisdictions. Generative AI is accelerating the scale and sophistication of attacks, making account opening fraud, account takeover, and synthetic identity fraud easier and cheaper, while deepfakes and injection attacks increasingly target selfie/video verification and bypass capture via virtual cameras, emulators, or manipulated SDK/API traffic. Document fraud is also shifting from physical counterfeits to AI-edited, composited, and template-generated images, lowering the skill barrier for attackers. At the same time, users have minimal tolerance for security friction, creating a need for fraud controls that are as passive and streamlined as possible, especially for global digital services that must support diverse documents, languages, and issuing regions.

Compliance adds further complexity: KYC/AML obligations remain high-effort when handled manually, and age assurance requirements are now actively enforced in the UK, expanding across US states, and taking shape in the EU with DSA guidance and pilots. Meanwhile, the EU’s revised eIDAS regulation will require EUDI wallets by end of 2026, shifting identity verification investments toward solutions that can both issue verified data into wallets and accept wallet-presented credentials later.

Modern identity verification typically centers on remote document capture plus selfie/video biometrics, triangulated with fraud checks and, where needed, sanctions/PEP screening. Core capabilities span document verification (OCR/MRZ/NFC, forensics, authoritative validation, AI-image tamper detection), biometric verification (1:1 matching, liveness, deepfake/injection defense, bias and privacy controls), optional synchronous video verification, attribute verification via authoritative sources, and additional fraud signals (device intelligence, IP/GPS, behavioral analytics) with confidence scoring. Selection should emphasize privacy-by-design, orchestration across use cases, interoperability with emerging standards, resilience/SLAs, and independent testing of critical defenses.

• Phishing accounted for around 60% of observed intrusions in the ENISA Threat Landscape 2025 reporting period.
• The large majority of phishing campaigns now use AI-generated or AI-enhanced content.
• Deepfakes are used against selfie and video verification as both presentation attacks and injection attacks.
• Injection attacks can bypass the camera using virtual cameras, emulators, or manipulated SDK and API traffic.
• Fraudsters increasingly submit AI-edited or fully template-generated document images instead of physical counterfeits.
• In the UK, Online Safety Act duties requiring highly effective age assurance for services allowing pornographic content have been in force since July 2025.
• Ofcom has opened enforcement cases and issued fines against non-compliant services under those duties.
• In June 2025, the US Supreme Court upheld state age verification laws for adult content in Free Speech Coalition v. Paxton.
• The EU Commission published DSA minors-protection guidelines and a white-label age verification blueprint in July 2025.
• Under the revised eIDAS regulation, EU member states must offer EUDI wallets to citizens and residents by the end of 2026.

• “The tolerance for delay and effort is extremely low.”
• “Buyers should assume that the attacker no longer needs specialist skills.”
• “Not every action requires a full identity verification, and it is critical to privacy best practice and to preserving a good user experience not to over-collect information.”
• “Account recovery deserves specific attention: attackers increasingly target helpdesk and self-service reset flows, which are often weaker than the primary login.”
• “Presentation attacks in front of the camera are only part of the problem; injection attacks bypass the camera entirely through virtual cameras, emulators, or manipulated SDK and API traffic.”
• “With EUDI wallets due from EU member states by the end of 2026 and comparable schemes advancing elsewhere, the verification flow buyers deploy today should not become a dead end.”
• “The identity verification solution being considered must be able to meet your SLAs and regulatory requirements around IT resilience, information security, and compliance with AI regulations such as the EU AI Act where applicable.”
• “Establish transparent communication from the start by clarifying that the vendor willingly shares the accuracy and performance rates of algorithms and has the in-house expertise to explain the verification checks and settings.”
• “Ability to address data residency requirements and compliance with regulations such as GDPR, California’s CCPA, and other global privacy laws are required.”
• “Identity verification provides a unique combination of enabling digital interaction with higher security.”