In-Person Verification

What In-Person Verification Means

In-person verification is the point in onboarding where an organisation checks that the applicant is physically present and matches the identity they have presented. It is used to reduce impersonation risk, strengthen trust in remote identity proofing, and create a higher-confidence basis for issuing access, accounts, or credentials.

The control matters because it tests a real-world assertion, not just a document or digital claim. When it is done poorly, the process can become a rubber stamp that approves a convincing impostor, a coerced applicant, or an identity that has been assembled from stolen evidence.

Why It Is Used in Identity Verification

In-person verification is typically a higher-assurance step than purely remote onboarding because it introduces direct human or video-based scrutiny. That matters when the organisation needs stronger confidence that the person claiming an identity is the person standing in front of the verifier, especially for sensitive roles, regulated services, or accounts with meaningful downstream authority.

It also helps close gaps left by document-centric checks. A passport, national ID, or uploaded selfie can be forged, stolen, altered, or replayed. A live presence check makes it harder to separate the claimed identity from the actual applicant, which is why it is often used as one layer inside a broader verification journey rather than as a standalone guarantee.

How Verification Quality Changes the Security Outcome

The security value of in-person verification depends on the integrity of the whole process, including who performs the check, what evidence they rely on, and how exceptions are handled. A weak process can still approve the wrong person if staff are rushed, inconsistently trained, or overly dependent on a single artefact.

For that reason, organisations usually treat the step as a risk-reduction control, not a proof of absolute identity. The strongest versions combine presence checking with document review, liveness or video scrutiny where allowed, and downstream controls that limit what is issued until additional assurance is established.

When the organisation needs a formal benchmark for identity and authentication assurance, NIST SP 800-63 Digital Identity Guidelines is a useful reference for how assurance levels and identity proofing fit together.

Operational Use Cases and Boundary Conditions

In-person verification is most useful where remote onboarding alone does not provide enough confidence, such as high-risk financial services, government-linked enrolment, privileged access onboarding, or situations where identity fraud has direct security or legal consequences. It is also used when an organisation wants a defensible escalation path for uncertain or inconsistent applications.

Approved video-based methods can support the same intent, but they change the operating model. The organisation must decide whether the method still delivers adequate presence assurance, whether the session is supervised, and whether the technology and reviewer process are reliable enough to resist replay, substitution, or social engineering.

For identity-focused application controls, the assurance work should line up with verification requirements such as those described in OWASP ASVS, which covers authentication and access-related verification concerns in application workflows.

Risk and Threat Considerations

In-person verification carries a material fraud and compromise risk because it is often the last human checkpoint before an identity is accepted into a system. If the verifier is deceived, the organisation may create accounts, privileges, or credentials for an attacker instead of the legitimate applicant.

Failure mechanism: Weak review discipline, forged documents, coached impersonation, or sloppy exception handling lets a false applicant pass the presence check and inherit the target identity.

Impact: The resulting account, session, or issued credential can be used for fraud, unauthorized access, data theft, or further identity abuse, and the compromise may be difficult to unwind once downstream systems trust the onboarding decision.

Practitioner Guidance

Why practitioners should care: Treat this control as an assurance gate, not a ceremonial step. Its value comes from the consistency of the reviewer, the quality of the evidence, and the clarity of the pass or fail decision.

Governance implication: Define when in-person verification is mandatory, who may perform it, what counts as acceptable evidence, and how escalations are handled when the applicant cannot be confidently matched. For cross-border or regulated identity journeys, align the process with the verification and assurance expectations in the relevant policy or standard set.

Practitioner takeaway: If the process cannot reliably distinguish a live applicant from a convincing impostor, it should be treated as incomplete assurance, not as verified identity.

Related resources from NHI Mgmt Group

• Person Verification
• Why do online identity verification workflows create more governance pressure than in-person checks?
• Who is accountable when automated identity verification approves the wrong person?
• Why does mobile ID reduce friction in both in-person and remote identity verification?