Identity verification both ways: requests, documents, recovery, and failures

Q: A service wants a selfie holding my ID. Should I do it?

It is a [normal request](https://privacyscamverification.com/identity-verification-examples-2027) from a regulated financial service, an employer, or a marketplace paying you out. It is never a normal request from a private individual, a buyer, or someone who contacted you first. Verify that the organization is real and that you initiated the process before sending anything.

Identity verification runs in two directions, and almost all the trouble comes from only thinking about one of them.

Downwards, a service asks you to prove who you are; upwards, you must decide if the thing asking is real before you hand anything over. People skip that second question.

That gap fuels a broad fraud category: an impostor need not break a verification system if it can persuade you to complete one for it.

What to take away

Knowing the mechanism tells you what an attacker has to do, and what it costs you if the check fails.
A short version of the obligations, because the design decisions determine how much harm a breach does.
The direct answerthree questions, set out directly below.

Before you verify yourself to anyone

Ask three questions in this order.

Three questions before verifying

Who initiated this contact?
Does the ask fit the relationship?
What exactly is being requested?

1. Who initiated this?

If a message, call, email, or pop-up asked you to verify, you are not verifying, you are responding to a claim. Stop and reach the organization through a route you already had: its app, a bookmark, the number on your card. If a genuine verification is pending, it will be visible there.

2. Does the ask fit the relationship?

A bank opening an account for you needs your identity documents. A marketplace paying out your sales proceeds may need them. A stranger on a dating app does not. A "delivery company" does not. Somebody who says they will send you money does not. Ask what decision this data is being used for, and whether the amount requested is proportionate to it.

3. What exactly is being requested?

There is a difference between confirming a name and a date of birth, and uploading a full scan of a passport plus a selfie holding it. Full document images are the most damaging thing to lose, because they support accounts opened in your name for years afterwards.

Verification requests that are never legitimate

No matter how convincing the sender:

Never legitimate, however convincing

A one-time code sent to you
A verification payment to prove ownership
Documents sent to a private individual
Remote access to your device
Verification through an unprompted link
Receiving and passing on money

A delivery or redelivery fee.A text says a parcel is held until you pay a small fee and confirm your address. Real couriers bill inside their own app.
A romance contact who needs you to verify an accountbefore sending money. No real transfer depends on you passing a check.
A support agent who asks for a code.A code sent to your phone completes a login you started. Whoever asks for it is taking over an account.
A job offer that wants your ID before an interview.Employers check documents after an offer, through systems you can find yourself.
A buyer or landlord who sends a link to confirm your identity.Payment platforms verify inside their own app. A link is a copy of a login page.
A warning that your account is locked and only this page can restore it.Go to the service yourself, where a real lockout shows up.

Handing over documents with less exposure

Sometimes you genuinely do have to send identity documents. Reduce the damage if the recipient is careless or is not who you think.

Sending documents with less exposure

Check the destination before the content
Upload inside the service, not email
Send the minimum required fields
Mark the copy for its purpose
Ask what happens to it
Delete your own copies afterwards

Check the destination before the content.Type the address yourself, and confirm you are on the service's real domain. A password manager that declines to autofill is telling you something useful.
Upload inside the service, not by email or chat. Email copies live in two mailboxes forever and are a standard target.
Send the minimum.If a document number and a name are enough, do not send the whole page. Cover fields that are not required.
Mark the copy for its purposewhere the service allows an overlay or where you are sending an image anyway: a visible note that this copy is for that specific application makes reuse harder.
Ask what happens to it.A service handling this properly can tell you how long it retains images, whether the check is done by a processor, and how to request deletion. In the EU and UK, and increasingly elsewhere, you have a right to ask.
Delete your own copiesfrom the phone's camera roll and from chat threads afterwards. This is one of the most common ways document scans leak.

In the European Union that right comes from the General Data Protection Regulation; in the United Kingdom, from the UK GDPR, enforced by the Information Commissioner's Office. It covers a copy of what is held, how long images are kept, and deletion. A service that cannot answer those questions has not designed for them.

Rights to ask differ by country. In the United States, state privacy laws in California, Colorado, Connecticut, Utah and Virginia give residents the right to access and delete personal data held by covered businesses: the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act.

In Canada, the Personal Information Protection and Electronic Documents Act gives you the right to ask what a company holds about you and to have errors corrected.

If a copy leaked, report it. In the United States, file with the FTC at ReportFraud.ftc.gov and follow the recovery plan at IdentityTheft.gov. In Canada, report to the Canadian Anti-Fraud Centre and notify Equifax Canada and TransUnion Canada.

How the methods actually work, and where each one breaks

Knowing the mechanism tells you what an attacker has to do, and what it costs you if the check fails.

Verification methods and their failure points

Method

Document scan plus liveness selfie: Document genuine, live person matches
Knowledge questions: Someone knows facts about you
Code to a phone number: Control of the number
Authenticator app code: Control of an enrolled device
Passkey or hardware key: Control of a site-bound key
Bank or government digital ID: Identity verified elsewhere
In person with originals: Strongest person-document link

What it proves

Document scan plus liveness selfie: Lighting, damage, disability, appearance changes
Knowledge questions: Facts widely available after breaches
Code to a phone number: Number takeover and code phishing
Authenticator app code: Approval fatigue; talked into approving
Passkey or hardware key: Needs a recovery path
Bank or government digital ID: Concentrates risk; not universal
In person with originals: Inconvenient, not always offered

Where it fails

Document scan plus liveness selfie
Knowledge questions
Code to a phone number
Authenticator app code
Passkey or hardware key
Bank or government digital ID
In person with originals

Knowledge-based checks. Anything based on knowing facts about you is weak, because the facts are in circulation. They also fail because each added question makes guessing easier.

Document scans. You photograph a passport or driver's license. Software reads the fields and checks the security features. Poor images and worn documents fail, and the service keeps a full copy.

Selfie and liveness checks. The system compares your face to the document photo and asks you to move or blink. Deepfakes defeat it, and so do faces the model reads poorly.

Biometrics do not reset: a leaked face template is not like a leaked password. So prefer a service that verifies and deletes over one that keeps images indefinitely, and choose account security tools that make that exposure impossible rather than merely unlikely.

Bank login checks. You sign in to your bank through the service, which confirms a name and an account that already exists. It fails when someone else holds your banking session.

Government digital IDs. A state or national scheme issues a credential held in an app: the EU Digital Identity Wallet, UK One Login, and mobile driver's licenses issued by US states. Coverage is the failure mode: not everyone has one, and accepting a single scheme turns people away.

A legitimate verification flow runs the same way:

How the methods actually work

You start it yourself, from the service's own app or site.
The service states what it needs and why.
You confirm the domain and sign in with credentials you have.
It asks for the smallest item that answers its question.
You finish the check inside the service and see the result there, along with the retention period.
If the automated check fails, a manual route is offered.

Account recovery is the weakest point

Most accounts are not broken into. They are recovered by somebody else. Recovery is verification with the difficulty turned down, because the service is trying to help a locked-out user, and that is exactly the door an impostor uses.

Lock down account recovery

Remove stale recovery email and phone
Prefer offline recovery codes over questions
Protect the email that resets everything
Add a carrier port-out PIN
Re-check recovery after any exposure

Check the recovery email and phone on your important accounts and remove anything stale. An address you no longer control is a permanent open door.
Prefer recovery codes stored offline over security questions. Where questions are unavoidable, the answers do not have to be true: they have to be unguessable and recorded.
Put the strongest available method on the email account that receives everyone else's password resets. It is the master key.
Add a port-out or transfer PIN with your mobile carrier.A hijacked number defeats every text-based check you have.
If verification data was exposed in a scam, treat recovery settings as compromised and re-check them; the sequence is in account security.

When verification fails and it is you

This happens to real people constantly and it is not evidence that you did something wrong.

When verification fails and it is you

Use the alternative route, not repeats
Ask what manual review requires
Fix name and address mismatches
Keep reference numbers and dates
Never pay a third party to fix it

Common causes: a name that does not match across documents after a marriage or legal change, a recent move, a thin or absent credit history.

Others are a worn document, a format the system reads poorly, no smartphone, poor connectivity, and a face the system struggles with. Several of these fall hardest on people who already have the least slack.

What helps: use the alternative route rather than repeating the failing one, because repeated attempts sometimes lock the account. Ask what a manual or in-person review requires. Fix the underlying mismatch where you can: a consistent name and address across documents removes a whole class of failure.

Keep a note of reference numbers and dates, because you will be re-explaining this. If you are asked to pay a third party to "fix" a failed verification, that is a scam. A failed verification is often the opening move in phishing scams, so know what the sender actually wants before you pay anyone.

Verifying the other side

The same rigor, pointed outwards. Where documents of yours have already been misused, the recovery process rather than any further checking is what helps, and it is set out at IdentityTheft.gov.

Verifying the other side

Businessregistry, number, address, history
Professionalcheck the regulator's register
Online personlive video and reverse image search
Support agentend call, use official channel

A business:the business registry for its jurisdiction — the Secretary of State in most US states, Companies House in the UK — with a registration number that matches the one on its invoice, a verifiable address, and a trading history. Bank details confirmed by a call to a number you found yourself, never the one in the email.
A professional:the licensing body's or regulator's own register, checked by number: FINRA BrokerCheck for brokers, the state bar for attorneys, the state medical board for physicians.
A person you met online:a live video call at a time you choose, and a reverse image search on the profile photo. That is proportionate, and the fuller version of it is in catfishing. Building a file on a private individual is not, and the boundary is set out in background checks.
A support agent who contacted you:they do not get verified. You end the conversation and start a new one through the organization's own channel. This is the whole content of impersonation scams, and it is worth more than any other check on this page.

If you are the one building verification

A short version of the obligations, because design decisions determine how much harm a breach does. Match the strength of the check to the risk of the action rather than applying the heaviest check everywhere. Collect the minimum that answers the question, and prefer confirming an attribute (over eighteen, resident here, holds this license) to storing the whole document.

Obligations when building verification

Match check strength to action risk
Collect the minimum, confirm attributes
Set retention and actually delete
Offer a genuine alternative route
Treat biometrics as a special category
Make recovery as considered as enrollment
Log decisions to explain rejections

Set a retention period and actually delete. Offer a genuine alternative route, because the people who fail automated checks are disproportionately the people who most need the service. Treat biometric data as a special category: the General Data Protection Regulation requires explicit consent to process biometric data used to identify someone, and US state statutes such as the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act require notice, consent and eventual destruction of stored templates.

Make recovery as considered as enrollment, since it is the path attackers prefer. And log decisions well enough to explain a rejection to the person it happened to. For the underlying model, including what the levels of assurance are for, the NIST digital identity guidelines are the place to start.

Common questions

Is a verified badge proof of identity?

It depends on the platform. A Meta Verified badge on Facebook or Instagram follows a paid subscription plus a government ID and a selfie check. The paid badge on X comes with the subscription and no document check. Treat a badge as weak evidence and confirm through the organization's own site.

A service wants a selfie holding my ID. Should I do it?

It is a normal request from a regulated financial service, an employer, or a marketplace paying you out. It is never a normal request from a private individual, a buyer, or someone who contacted you first. Verify that the organization is real and that you initiated the process before sending anything.

Is it safer to verify with a bank login or a government digital ID than to upload documents?

Often yes, since fewer copies of your documents end up in circulation. The trade-off is concentration: whoever gets into that one account can present as you in many places, so it needs your strongest sign-in method.

Someone asked me to verify my account by sending them a code. They seemed official.

That is the request itself, not a step toward it. No legitimate party ever needs a code that was sent to you. If you already sent one, change that account's password, sign out all sessions, and check the recovery settings for changes.