Identity verification (IDV) vendors all promise high pass rates, fast onboarding and strong fraud defence, and their demos look very similar. The differences appear with your customers, your documents and the attacks your business attracts: deepfake selfies, injected camera feeds, forged documents and synthetic identities. Vendors range from document and biometric specialists to data-driven identity verification networks and platforms that orchestrate many checks. This vendor-neutral buyer's guide helps you set requirements, evaluate accuracy and attack resistance, and run a proof of concept that tells you what will really happen in production.
Key takeaways
- Measure vendors on both sides of accuracy: fraud caught and genuine customers passed.
- Require presentation and injection attack detection, with independent test evidence.
- Check document coverage for your markets, including chip reading where available.
- Understand what data the vendor keeps, for how long, and whether it trains models on it.
- Plan for digital identity wallets and reusable identity alongside document checks.
Define requirements
- Use cases: account opening, age assurance, account recovery, workforce onboarding, high-risk transaction step-up.
- Required assurance level for each use case. See the Identity Proofing and KYC Guide.
- Markets, document types and languages you must support.
- Regulatory obligations: KYC and AML, age assurance, data protection, accessibility.
- Channels: web, native mobile, assisted in branch or by phone.
- Volumes, peaks and acceptable time to decision.
Evaluation criteria
| Area | What to test |
|---|---|
| Document verification | Coverage for your markets; security feature checks; NFC chip reading and signature verification; detection of edited and AI-generated images |
| Biometric verification | Face match accuracy on your population; demographic performance; independent evaluation results. See the Biometrics Guide |
| Liveness and presentation attack detection | Resistance to photos, screens, masks; ISO/IEC 30107-3 testing |
| Injection attack detection | Detection of virtual cameras, emulators, hooked apps and deepfake streams; CEN/TS 18099 evaluation |
| Data and fraud signals | Authoritative source checks, device and network signals, consortium fraud data, linkage across applications |
| Digital evidence | Support for mobile driving licences, national eIDs and digital identity wallets. See the Digital Identity Wallets Guide |
| Decisioning and review | Configurable rules, explainable reasons, manual review tools and quality control |
| Privacy and retention | Data minimisation, retention controls, deletion, processing locations, use of data for model training |
| User experience and accessibility | Completion rates, capture guidance, accessibility support, alternatives for people who cannot complete the flow |
| Integration | SDKs, APIs, webhooks, orchestration with other checks and your CIAM platform |
Questions to ask vendors
- Show us your injection attack detection working against a virtual camera and a real-time face swap.
- What are your false acceptance and false rejection rates on a population like ours, and how were they measured?
- Which documents can you read by chip in our markets, and what happens when a chip cannot be read?
- How do you detect the same face, device or document reused across different claimed identities?
- What do you retain after a check, for how long, and do you use our customers' data to train models?
- How do you support people without documents or who cannot complete biometric capture?
- How will you support EU Digital Identity Wallets and mobile driving licences?
Red flags
- Pass rates quoted without false acceptance data.
- No independent testing of presentation or injection attack detection.
- Liveness checks that run only on the device with no server-side verification.
- Unclear data retention or a default right to use your data for training.
- Manual review hidden inside "automated" decisions with no disclosure.
Proof of concept
- Run a sample of real, consented applicants through each shortlisted vendor, including hard cases such as older documents and poor lighting.
- Run a red team set: printed and screen photos, masks, virtual camera injection, face swaps and edited documents. See the Deepfake and AI Impersonation Guide.
- Compare decisions against known outcomes and measure both fraud caught and genuine users rejected.
- Test the manual review and exception routes, which attackers target.
- Confirm data retention and deletion in practice.
Standards and references
- NIST: SP 800-63A-4 Digital Identity Guidelines: Identity Proofing and Enrollment
- NIST: Face Recognition Technology Evaluation (FRTE) 1:1 Verification
- ISO: ISO/IEC 30107-3:2023 Biometric presentation attack detection, Part 3: Testing and reporting
- DIN: DIN CEN/TS 18099 Biometric data injection attack detection
- ISO: ISO/IEC 18013-5:2021 Mobile driving licence (mDL) application
- EUR-Lex: Regulation (EU) 2024/1183 establishing the European Digital Identity Framework
How NHI Mgmt Group can help
We provide independent requirements and evaluation support for identity verification and wider identity programmes. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Biometrics Guide · CIAM Buyer's Guide · KYB Guide