Choosing how to verify a customer’s identity shouldn’t feel like guesswork. You’re juggling compliance (TPB obligations and AML/CTF readiness), fraud risk, drop‑off during onboarding, and the reality that staff live inside your CRM—not in a dozen separate tools. Meanwhile, the options keep multiplying: document checks, biometrics with liveness, issuing‑source lookups like the DVS, mobile driver licences, video calls, and old standbys like knowledge questions and 2FA. Each brings different assurance levels, costs, user friction, and privacy obligations under Australian law. Pick the wrong mix and you either block good customers or let risk slip through.
This guide demystifies the main types of identity verification, with practical pros and cons, where each shines, how they work, and what to watch for in the Australian context (privacy and AUSTRAC considerations included). We’ll cover seven methods—starting with integrated CRM verification (e.g., StackGo IdentityCheck), then document and proof‑of‑address checks, biometric/selfie with liveness, database and issuing‑source verification, digital IDs (mDLs and wallets), agent‑assisted video, and knowledge‑based and two‑factor authentication. By the end, you’ll know which combination fits your risk profile, customer experience goals, and tech stack. First up: keeping verification inside your CRM to cut clicks and errors.
1. Integrated CRM identity verification (StackGo IdentityCheck)
Bringing identity checks into the system your team already uses is often the fastest way to cut drop‑off and errors. IdentityCheck is StackGo’s productised integration that runs KYC/AML verification from inside your CRM, so staff don’t juggle tabs or learn new software while still accessing modern types of identity verification.
What it is
IdentityCheck is an “out‑of‑the‑box” verification workflow embedded in everyday SaaS platforms (e.g., HubSpot, Salesforce, Xero). It reads contact details directly from the record, orchestrates the required checks, and writes outcomes back to the CRM—giving you a consistent, auditable process without custom builds or brittle zaps.
How it works
You trigger verification from the contact/company record, choose the required policy (standard vs enhanced), and IdentityCheck handles the rest. It streamlines collection, verification and result capture while enforcing your rules and reducing manual re‑keying.
- Pulls known contact data from the CRM to pre‑fill checks.
- Initiates the configured verification flow (for example, documentary checks and, where required, additional measures like selfie or database‑backed verification).
- Applies your pass/fail thresholds and flags exceptions.
- Writes structured outcomes, evidence references and timestamps back to the CRM.
- Surfaces status to users; restricts sensitive artefacts via admin‑only access.
Best for
If your team lives in a CRM and you need compliant onboarding without building a new stack, this approach fits. It’s ideal for Australian accounting and professional services firms getting TPB‑ready today and preparing for AUSTRAC AML/CTF obligations.
- Regulated SMEs standardising client onboarding in HubSpot/Salesforce/Xero.
- Operations teams who want fewer clicks and less copy‑and‑paste risk.
- Multi‑market businesses needing global coverage (200+ countries, 10,000+ document types).
Pros
Keeping verification where work happens lifts completion rates and consistency, while per‑check pricing keeps costs predictable as you scale.
- Native CRM experience: trigger, track and report without leaving the record.
- Lower error rate: uses CRM data to pre‑fill and avoid re‑keying.
- Privacy Layer: PII and artefacts aren’t stored in general CRM fields; admin‑only access with MFA.
- Global coverage: support across 200+ countries and 10,000 document types.
- Per‑check pricing: pay only for usage, not another seat‑based platform.
- Productised reliability: no fragile DIY automations for critical workflows.
Cons
Any integrated approach inherits some limits from the host system and your data quality. Consider the trade‑offs before mandating it across every use case.
- CRM dependency: messy records in, messy verification out.
- Initial setup: roles, permissions and policies need admin time.
- Less bespoke: not a blank‑sheet toolkit for highly custom flows.
- Per‑check costs: may be higher than a fully in‑house build at very large scale.
Data privacy and compliance (AU)
IdentityCheck’s Privacy Layer is designed to support APP data minimisation: sensitive PII isn’t stored in general CRM fields and is accessible only to MFA‑authenticated admins. For TPB obligations and AML/CTF readiness, it helps keep a clear audit trail (who ran what, when, and outcome) while limiting broad staff access to identity artefacts.
- APP alignment: collect only what’s needed; restrict access; retain with purpose.
- Auditability: outcomes and timestamps written back to records for assurance reviews.
- Policy control: configure verification intensity by risk tier; complement with issuing‑source/database checks where your compliance policy requires them.
2. Document verification (government IDs and proof of address)
Document verification is the most recognisable of the types of identity verification. It confirms someone’s identity by checking a government‑issued ID (passport, driver licence, national ID) and, where required, a proof‑of‑address document (utility bill, bank statement, rates notice). It’s widely used for onboarding, age‑restricted sales, deliveries and regulated financial services.
What it is
A check that the document is genuine, current and unaltered, and that its data matches what the user provided. Many organisations pair ID checks with proof‑of‑address to meet customer due diligence requirements.
How it works
Modern workflows use image capture and OCR to extract data, then run authenticity checks against the document’s security features. Where higher assurance is needed, this is combined with issuing‑source or biometric checks.
- Capture ID images; extract data with OCR.
- Validate security features (e.g., MRZ, holograms, barcodes).
- Check expiry and data consistency against submitted details.
- Collect and match proof‑of‑address where policy requires it.
Best for
Fast, first‑time onboarding when you don’t already know the customer, and for meeting baseline KYC/AML obligations with minimal friction.
- Financial and professional services onboarding.
- Age‑restricted commerce and deliveries.
- Travel, hospitality and accommodation.
Pros
- High coverage: works across 200+ countries and document types.
- First‑time friendly: no prior account or history needed.
- Automatable: OCR and authenticity checks reduce manual review.
- Flexible: add proof‑of‑address only when policy requires.
Cons
- Image‑quality sensitive: poor lighting or glare drives false negatives.
- Maintenance: needs updates as document designs change.
- Ownership gap: proves a document is real, not who’s holding it.
- Friction: some users abandon during photo capture/upload.
Data privacy and compliance (AU)
In Australia, documentary checks commonly pair with issuing‑source queries via the government’s Document Verification Service (DVS) and must be done with the individual’s informed consent. Apply the Australian Privacy Principles: collect only what’s necessary, restrict access (e.g., MFA‑gated admin views), and avoid storing raw ID images in general CRM fields. Keep clear audit trails for TPB and AML/CTF reviews, and align retention to legal and business needs—no longer.
3. Biometric and selfie verification with liveness
Biometric and selfie verification adds the “are you the rightful holder?” layer that documentary checks alone can’t guarantee. By capturing a real‑time selfie, analysing liveness, and matching the face to the ID portrait, this method has become a go‑to for remote onboarding and step‑up checks where assurance matters and fraudsters try to spoof cameras.
What it is
A face‑based biometric check that confirms two things: the person is physically present (liveness) and their face matches the government ID photo collected in the session. While other biometrics exist (fingerprint, iris, voice), selfie + liveness is the most common for online KYC and is widely used to stop impersonation and spoofing attempts.
How it works
Most providers capture a short selfie (or sequence) and run liveness detection before comparing the image to the ID portrait to produce a confidence score and decision. Solutions commonly combine active and/or passive liveness with other risk signals to flag suspicious activity.
- Capture a real‑time selfie via mobile or browser.
- Run liveness detection (active cues like gaze/smile or passive analysis of texture, motion and light).
- Face‑match against the government ID image from the same session.
- Score risk and decide; route borderline cases to manual review or secondary checks.
Best for
Use this when you must prove the person is real and owns the document, or when raising assurance without resorting to a video call.
- Remote onboarding for regulated services.
- Step‑up events: password resets, payouts, large withdrawals, or PII changes.
- Age/impersonation risk in iGaming, alcohol delivery and marketplaces.
Pros
- High assurance of presence: liveness makes spoofing harder.
- Proves document ownership: matches selfie to ID portrait.
- First‑time friendly: no prior account history needed.
- Lower friction than video calls: fast, self‑serve flow.
- Composable: pairs well with document and database checks.
Cons
- Privacy‑sensitive: biometric data requires strong protection and consent.
- Device/camera dependent: poor lighting or occlusions increase failure rates.
- Not standalone: must be checked against something (e.g., an ID).
- Accessibility considerations: may challenge some users; allow fallbacks.
- Tuning/thresholds: aggressive settings can create false negatives.
Data privacy and compliance (AU)
Treat biometrics as highly sensitive under the Australian Privacy Principles: obtain informed consent, collect only what’s necessary, and restrict access. Avoid storing raw selfies/biometric templates in general CRM fields; gate artefacts behind MFA‑protected admin views and align retention with legal purpose and policy.
- Minimise and secure: least data, least access, encrypted at rest/in transit.
- Clear audit trail: who ran the check, when, outcome and rationale.
- Policy fit: pair with documentary/issuing‑source checks where your KYC/AML policy requires higher assurance.
4. Database and issuing‑source verification (e.g., DVS, credit bureaus)
Database checks compare user‑supplied data against trusted records to confirm accuracy, spot mismatches, and screen for risk. In types of identity verification, this method adds a fast, low‑friction layer that’s widely used for AML/KYC, fraud prevention, and step‑up assurance. In Australia, this often includes the government’s Document Verification Service (DVS) with consent.
What it is
This approach draws on “source of truth” systems and reputable aggregators to validate identity attributes without asking the user for more documents.
- Issuing‑source databases: verify details directly with the authority that issued them (e.g., DVS for Australian ID documents).
- Authoritative databases: cross‑check against credit bureaus, financial institutions, telcos, and watchlists/PEPs.
How it works
Vendors normalise inputs, submit secure queries, and return a pass/fail or match score you can apply in policy decisions. It’s often paired with documentary or biometric checks.
- Collect consent; standardise name, DOB, address, ID numbers.
- Query issuing sources (e.g., driver licence/passport via DVS).
- Cross‑match with bureaus/authoritative datasets.
- Screen against sanctions/PEPs; return decision and audit data.
Best for
- Regulated onboarding where you need rapid assurance.
- Step‑up checks on profile changes or high‑value actions.
- Reverification of known customers with minimal friction.
Pros
- High assurance: confirms against trusted records.
- Fast and invisible: low user friction; real‑time results.
- Composable: strengthens document and selfie flows.
- Compliance‑friendly: supports AML screening needs.
Cons
- Coverage variance: data quality differs by region/source.
- Data sensitivity: requires careful handling and consent.
- Exact‑match issues: name formats/typos can cause fails.
- Not presence proof: doesn’t show a real person is present.
- Setup/costs: integrations and per‑query fees apply.
Data privacy and compliance (AU)
Use DVS and other checks with explicit consent and align handling to the Australian Privacy Principles: collect only what’s necessary, restrict access, and retain for clear purposes. Maintain auditable logs (who checked, when, outcome), and avoid storing raw identifiers in general CRM fields—gate sensitive artefacts behind MFA‑protected admin access. Pair issuing‑source/database verification with document and/or biometric checks where your AML/CTF policy calls for higher assurance.
5. Digital ID verification (mobile driver licences and digital wallets)
Digital ID sits at the sweet spot of low friction and strong assurance. Instead of photographing an ID, users share verified attributes from a mobile driver licence (mDL) or digital wallet, typically unlocked with FaceID or a fingerprint. Among the types of identity verification, it’s the most seamless when coverage is available and your policy permits selective disclosure.
What it is
Digital ID verification confirms identity using cryptographically signed credentials stored in a user’s wallet (e.g., mDLs). Because the credential has already been validated by the issuing ecosystem and protected on‑device, you can auto‑populate forms and reduce error without heavy document capture.
How it works
The user consents to share specific attributes, unlocks their wallet, and a signed payload is sent to your verification flow for validation.
- Present a “Share your Digital ID/mDL” prompt.
- User reviews requested attributes (e.g., name, DOB, address) and consents.
- Wallet unlocks via device biometrics; issues a signed data package.
- Your system verifies signatures/expiry and ingests attributes.
- Optional: add selfie/liveness or issuing‑source checks for step‑up assurance.
Best for
High‑conversion onboarding and repeat actions where you want fewer steps but reliable data quality.
- Retail and delivery: age‑checks without storing full IDs.
- Financial/pro services: rapid onboarding, then step‑up as risk rises.
- In‑person or remote flows needing quick, accurate pre‑fill.
Pros
- Low friction: no image capture; fast, familiar wallet UX.
- Fewer errors: auto‑populate attributes directly from the credential.
- Privacy by design: request only the attributes you need.
- Secure by default: device biometrics and signed data reduce tampering.
- Composable: add to doc, database or selfie checks when needed.
Cons
- Coverage variability: availability differs by region and device.
- Adoption gap: not all customers have an mDL/digital ID yet.
- Integration work: wallet protocols and updates to maintain.
- Presence gap: device unlock ≠ independent liveness; add selfie if required.
- Regulatory acceptance: some use cases still expect documentary evidence.
Data privacy and compliance (AU)
Apply Australian Privacy Principles: obtain clear consent, minimise attributes requested, and restrict access to shared data. Avoid storing raw credential artefacts in general CRM fields; keep sensitive items behind MFA‑protected admin views with short, purpose‑bound retention.
- Consent and transparency: show exactly which attributes you’re requesting and why.
- Pairing for assurance: use DVS/issuing‑source and/or selfie liveness when policy calls for higher confidence.
- Audit trail: capture who requested, what was shared, decision and timestamps for TPB/AUSTRAC reviews.
6. Video‑based verification (agent‑assisted)
When stakes are high or automation hits edge cases, live video with a trained agent delivers “virtual face‑to‑face” assurance. The agent validates the ID on camera, compares it to the person, asks scripted liveness cues, and captures evidence. It boosts confidence and fraud resistance, but adds time, cost and privacy overheads versus self‑serve flows.
What it is
A remote, human‑in‑the‑loop identity check conducted over a secure video call. The agent inspects government ID documents in real time and confirms the presenter matches the ID photo, following an auditable script.
How it works
- Customer joins a secure session; agent confirms consent and session details.
- Customer shows ID; agent performs real‑time checks and liveness prompts.
- Agent cross‑checks extracted data; may trigger issuing‑source or database lookups.
- Decision and notes are recorded; evidence stored per policy with an audit trail.
Best for
- High‑risk onboarding: financial/pro services, healthcare, gaming.
- Fallbacks/exceptions: after failed or inconclusive automated checks.
- Guided users: customers needing hands‑on help or accessibility support.
Pros
- Face‑to‑face assurance: impersonation is harder with a live agent.
- Real‑time document checks: inspect holograms/MRZ and compare faces.
- Human guidance: reduces user error; supports multi‑language workflows.
- Strong for exceptions: handles nuanced cases automation flags.
Cons
- Higher cost: staffing, scheduling and QA increase overheads.
- More friction: longer sessions can impact conversion and CX.
- Tech limits: poor lighting/cameras affect outcomes.
- Privacy concerns: recording/storing video adds obligations.
- Human variance: susceptible to error or bias if not well controlled.
Data privacy and compliance (AU)
Obtain informed consent, collect only what’s necessary, and restrict access under the Australian Privacy Principles. Avoid storing raw video/PII in general CRM fields; keep artefacts behind MFA‑gated admin views with purpose‑bound, time‑limited retention. Maintain clear audit logs (who, what, when, outcome) for TPB/AUSTRAC reviews, and pair with issuing‑source (e.g., DVS) or selfie liveness where policy requires higher assurance.
7. Knowledge‑based and two‑factor authentication
KBA and 2FA don’t prove identity on their own, but they strengthen your identity stack. Used well, they harden accounts, reduce account‑takeovers, and add a low‑friction step‑up when risk spikes.
What it is
KBA asks users to answer personal questions (static or dynamic). 2FA adds a second proof (one‑time codes or device biometrics) after a password or primary check.
How it works
You present a challenge only the legitimate user should satisfy, then decide pass/fail. 2FA commonly uses SMS/app codes or a face/fingerprint unlock to authorise access or actions.
Best for
Best as authentication and reverification—not standalone ID proof.
- Step‑up on sensitive actions.
- Known‑customer phone/web flows.
Pros
Done right, it’s fast and familiar.
- Low friction; fast to deploy.
- Users already understand it.
- Reduces many account‑takeover attempts.
Cons
Know the limits.
- KBA can be guessed or socially engineered.
- Intrusive and memory‑dependent for many users.
- Not suitable for first‑time identity proof.
- 2FA alone doesn’t verify who the person is.
Data privacy and compliance (AU)
Treat KBA answers and 2FA artefacts as personal information under the Australian Privacy Principles: obtain consent, minimise collection, and keep secrets out of general CRM fields.
- Restrict access; MFA for admins.
- Maintain audit logs and accessible fallbacks.
Bringing it all together
There’s no single silver bullet. The sweet spot is a layered approach that matches assurance to risk: low‑friction data and digital ID where you can; documentary plus selfie liveness for stronger proof; issuing‑source/database checks (e.g., DVS) to tighten confidence; and agent‑assisted video for exceptions. Reinforce account security with 2FA, maintain clear audit trails for TPB/AUSTRAC reviews, and apply Australian Privacy Principles: consent, minimisation, restricted access, and purpose‑bound retention.
If you want this to run where your team already works, use integrated CRM verification. IdentityCheck keeps KYC/AML inside your CRM with global coverage, a Privacy Layer, and per‑check pricing—no new software to learn. See how it fits your stack at StackGo.
