Ten questions to ask before you buy identity verification

Identity verification is easy to demo and hard to evaluate. Every product shows the same happy path. A document scans, a face matches, a green tick appears. The differences that matter tend to show up later, under real conditions.

This guide lists ten questions that surface those differences early. They suit operations, fraud and procurement teams alike. None require deep technical knowledge, just a willingness to push past the demo.

The list is vendor-neutral by design. Any capable provider should handle these questions comfortably. If one of them causes visible discomfort, that reaction is itself useful data.

1. Which standards do you implement, and can I verify that?

Standards turn marketing claims into testable ones. For mobile credentials, the key reference is ISO/IEC 18013-5, the standard behind mobile driving licences. Its companion, ISO/IEC 18013-7, covers presenting a licence over the internet.

For biometrics, ask whether liveness detection was tested against ISO/IEC 30107-3 by an independent laboratory. We explain why that matters in our piece on deepfakes and liveness detection. A good answer names the exact standard and edition, then offers test reports. Phrases like "aligned with" or "based on" deserve a follow-up question.

2. What happens when the network is down?

Many verification products quietly depend on a server for every check. Ask what a check looks like with no connectivity at all. Does it slow down, queue, or stop entirely? The answer tells you more than most architecture diagrams.

ISO/IEC 18013-5 was designed so mobile licences can be verified fully offline. We cover the mechanics in our article on offline identity verification. If your sites include basements, gates, roadsides or remote locations, treat offline capability as a hard requirement.

3. What data do you collect, and where does it live?

Ask for a plain data-flow answer. What is captured, what is transmitted, what is stored, and for how long? Every stored record is something you must protect, disclose and eventually delete.

Good answers favour data minimisation, such as selective disclosure of only the fields you need. They should also offer retention controls, and deployment options that can include on-premise. Be cautious if the default is "everything goes to our cloud indefinitely".

4. How do you handle the grey zone?

Real-world checks are rarely a clean yes or no. Documents arrive worn, photos arrive blurry, and some faces sit near the matching threshold. A system that hides this behind a black-box verdict moves the risk onto you.

Ask whether you receive confidence scores, and whether the thresholds are yours to adjust. Ask how a borderline case steps up to manual review. Good systems let you tune fraud risk against customer friction, because that balance is a business decision.

5. Can you verify physical documents and digital credentials?

Digital credentials are growing, but most flows still see plastic cards and paper passports. That mix will likely persist for years, and it varies by region and demographic. A tool that only handles one world leaves a gap in the other.

Look for a single workflow that covers document reading and authenticity checks alongside digital credentials. One process means one training effort for staff and one integration for your systems. It can also spare you a second procurement cycle later.

6. What does integration actually take?

Demos hide integration effort, and integration effort is where timelines slip. Ask which SDKs exist, which platforms they cover, and how current the documentation is. Then ask for sandbox access before you sign anything.

A confident vendor will let your engineers build a small proof of concept early. Treat "one-day integration" claims with care. Realistic pilots usually take weeks once testing and edge cases are included. What you want is a credible plan, not the smallest number.

7. Who builds the hardware?

This question only applies if readers, kiosks or scanners are involved. If software and hardware come from different suppliers, ask who owns a fault that spans both. Finger-pointing between suppliers is a real operational cost, and it lands on your team.

A good answer names one accountable party for the whole stack. It should also cover firmware updates, spare units and support response times. Hardware that cannot be updated ages quickly as credentials and attacks evolve.

8. How do accuracy claims hold up?

Every accuracy number depends on its test conditions. Ask how the figure was measured: on which documents, which demographics, what lighting, and what sample size. Ask whether the testing was internal or independent, and whether you can read the methodology.

Be suspicious of unhedged claims such as "100% accurate". Every real system has an error rate somewhere. Vendors who discuss their errors openly tend to understand their product better than vendors who deny having any.

9. What does failure look like for a real customer?

False rejects happen to genuine people, and often at the worst moments. Ask what the retry experience looks like, how long it takes, and what happens after repeated failure. Ask who a stranded customer can reach, and how quickly.

Accessibility belongs in this conversation too. Older phones, low-vision users, worn documents and unusual names all need a path through. A verification system is judged by its worst experience, not its best demo.

10. What is the total cost as volume grows?

Per-check pricing comes in different shapes: flat rates, volume tiers and committed minimums. Model your cost at today's volume, then at five or ten times that. The shape of the curve often matters more than the headline rate.

• Hardware purchase, replacement units and firmware support over the contract term.
• Implementation, testing and any re-integration after major version updates.
• Support tiers, service levels and training for frontline staff.

A cheap pilot that becomes an expensive production system is a common story. Ask for worked pricing at several volumes, in writing.

Put the list to work

No checklist guarantees a perfect choice, but these ten questions shorten a shortlist quickly. Any provider worth your time should welcome all of them. We are happy to be asked every one, in as much depth as you like. If you would like to put us on the spot, book a demo.