Yes. Physical IDs remain part of the control mix and provide a fallback for customers who do not use digital credentials. The safest approach is to support both routes, define when each is acceptable, and train staff so the choice does not depend on individual preference or convenience.
Why retailers usually need both digital and physical ID checks
certified digital id can reduce friction, improve consistency, and make age or identity checks easier to standardise, but they do not eliminate the operational need for a manual path. Retail environments still need a fallback for customers without compatible devices, unreliable connectivity, accessibility constraints, or situations where the digital credential cannot be read or trusted at the point of sale.
A dual-route model also helps avoid turning the checkout process into a technology gate. The control objective is not to replace every physical document overnight, but to preserve a reliable verification option while digital adoption matures and staff learn how to recognise acceptable evidence.
Where the process is governed well, retailers define when digital ID is sufficient, when a physical ID is still required, and when a transaction should be escalated for manual review.
What a dual-route identity check should actually control
The important issue is not whether the retailer prefers digital or physical proof, but whether the verification method is appropriate to the transaction risk. A low-risk purchase may tolerate a streamlined check, while regulated products, refund abuse prevention, age-restricted sales, or account recovery scenarios may justify a stricter control path.
That is why the acceptance rule should be explicit. Staff should not be left to improvise based on convenience, queue pressure, or personal comfort with new technology. Consistency matters because inconsistent checks create both customer friction and control gaps, especially when different stores or shifts interpret the policy differently.
Retailers should also treat the choice of method as part of the control design, not a front-line preference. If both routes are accepted, the policy should state what makes each acceptable, what evidence must be present, and what triggers refusal or escalation.
How to make the control dependable in practice
Digital ID works best when it is supported by clear operating rules, staff training, and a documented exception process. Physical ID remains useful because it gives the organisation a resilient fallback when the digital route fails, is unavailable, or does not fit the customer situation.
This is also where identity verification intersects with broader control quality. Stronger practice means the store can explain why one route was accepted over another, and can show that staff used the same rule set across locations. For organisations aligning with formal control guidance, verification, access decisions, and exception handling map naturally to the identity and access controls described in ISO/IEC 27002:2022 Information Security Controls and the identification and authentication controls in NIST SP 800-53 Rev 5 Security and Privacy Controls.
For teams implementing digital ID alongside traditional checks, the practical question is whether the process is reliable under real store conditions, not just in a pilot. The customer experience, the fraud exposure, and the staff decision path all need to be stable before a retailer can safely reduce reliance on manual documents. Guidance on identity assurance and authentication strength in NIST SP 800-63 Digital Identity Guidelines is useful when deciding how much trust a digital credential should carry.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST SP 800-63 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Retail staff need consistent authenticated decision-making for identity checks. |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Customer identity verification is central when accepting digital or physical IDs. | |
| AC-6 — Least Privilege | Store staff should only apply the level of verification authority their role requires. | |
| Recommendation — Define who may approve exceptions and require authenticated staff actions for escalations. Use verified customer identity evidence before allowing regulated sales or account actions. Limit override and exception approval rights to narrowly authorised roles. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | ID checks are an access decision for regulated goods and customer-facing transactions. |
| Recommendation — Define and enforce consistent acceptance rules for digital and physical identity evidence. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The question turns on how much assurance a digital ID provides versus a physical fallback. |
| Recommendation — Match the required assurance level to the transaction risk and customer journey. | ||
Practitioner Guidance
What to prioritise: Set a single acceptance policy that tells staff when digital ID is enough, when a physical ID is required, and when to escalate. The policy should be simple enough to use at the counter without judgement calls.
What to verify: Confirm that the digital ID route works across the customer devices and store conditions you actually see, and that the fallback process is available whenever the primary route fails. If either path cannot be used consistently, the control is not yet dependable.
Common mistake: Treating digital ID as a replacement for process discipline. The benefit comes from having two controlled routes, not from assuming the newer route is automatically safer or more convenient in every case.
Practitioner takeaway: The right design is usually dual-track, with digital ID preferred where it fits and physical ID retained as a governed fallback so verification stays consistent, defensible, and customer-safe.
Related resources from NHI Mgmt Group
- How should organisations implement certified digital ID checks for age verification?
- How should retailers implement digital ID checks at the point of sale without slowing queues or collecting unnecessary personal data?
- How should retailers evaluate digital ID checks for age-restricted sales and access control?
- How do digital ID checks differ from showing a physical identity document?