Topic starter
01/08/2026 8:59 pm
TL;DR: Online identity checks combine document extraction, document authenticity testing, selfie matching, liveness detection and fraud intelligence to decide whether a person is genuine, according to Yoti. The real governance issue is not whether any single check works, but whether the assurance model is resilient enough to stop spoofing, deepfakes and reused identity data.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “What happens during a Yoti identity check?”.
Key questions
Q: How should organisations design online identity checks to avoid relying on a selfie alone?
A: Use layered verification with document extraction, document authenticity, selfie matching, liveness detection and fraud-intelligence checks.
Q: Why do static identity checks fail against deepfakes and synthetic identities?
A: Static checks fail because they usually verify a captured moment, not an ongoing identity state.
Q: What are the signs that an identity verification flow is too permissive or weakly controlled?
A: Warning signs include acceptance of identity documents without strong liveness checks, limited comparison between the live presenter and the stored identity record, and unclear handling of failed verification attempts.
Practitioner guidance
- Separate document, face and liveness controls Design the verification flow so document extraction, document authenticity, selfie matching and liveness each produce distinct outcomes that can be independently scored and audited.
- Set risk-based assurance thresholds Increase the required evidence set for high-value transactions, sensitive onboarding journeys and account recovery, rather than using the same verification path for every user.
- Test for spoofing and replay resistance Validate that your verification flow can detect screen replays, printed photos, injection attempts and AI-generated deepfakes before it is exposed to production risk.
Bottom line: Online identity checks are strongest when document authenticity, selfie matching, liveness detection and fraud intelligence work together rather than as isolated gates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:06 pm
Layered identity verification is the only defensible model when fraud is adaptive. A selfie, document check and fraud-intelligence lookup each reduce different risks, but none is decisive on its own. The real control is the quality of the assurance chain, because attackers now optimise for the weakest step rather than the strongest one. Practitioners should design verification as a correlated set of evidence, not a binary gate.
A question worth separating out:
Q: When should teams increase identity proofing requirements during onboarding or recovery?
A: Increase requirements when the transaction is high value, the account can trigger downstream financial or data risk, or the user is re-establishing access after a trust break. The stronger the potential impact of impersonation, the more evidence the organisation should require before granting access or completing the transaction.
👉 Read our full editorial: Online identity checks rely on layered verification, not a selfie alone