Why you are being asked
Signing up for a bank account, a payment app, an exchange for digital assets, or a marketplace that pays sellers often brings a request to upload a photo of an ID document and a selfie. It can feel intrusive, especially for something that seems low-stakes. The reasons are usually a mix of legal duty and fraud prevention.
- Legal requirements. In many countries, financial businesses must confirm who their customers are, as part of rules against money laundering, terrorist financing and sanctions evasion. These are often called “know your customer” checks. The specific requirements depend on the country and the type of service.
- Fraud prevention. Criminals open accounts in other people’s names to borrow money, receive stolen funds or take over a service. Checking identity at the start makes this harder.
- Age and eligibility. Some services must confirm you are old enough or live in a place they are allowed to serve.
- Account recovery. An ID check can also be used later to confirm you are the genuine owner of an account that has been locked.
Not every service has the same obligation, so a request from a business that does not obviously need it deserves a closer look.
How a typical check works
Most online identity checks follow similar steps, though the details differ by provider.
- Document capture. You photograph the front and back of a passport, driving licence or national ID card. Some systems also read a chip in the document using an NFC-enabled phone.
- Document checks. Software examines the image for signs of tampering or forgery, whether the layout and security features look right, and whether the data is consistent, for example that the printed details match the machine-readable zone.
- Selfie or liveness check. You take a photo or a short video, sometimes with instructions to turn your head or blink. The aim of this “liveness” step is to show a real person is present, not a printed photo, a screen or a mask.
- Face matching. The system compares your selfie with the portrait on the document. This is a form of biometric authentication, though here it is used for a one-time match rather than repeated logins.
- Other signals. Providers may also check the details against databases, look at your device and location, or ask for proof of address.
- Decision. The result may be automatic, or a human reviewer may look at borderline cases. Failed checks can often be retried.
Many companies do not run this process themselves. They use a specialist verification provider, so your images may be handled by a company other than the service you are signing up to.
What can go wrong
Checks are not perfect.
- False rejections. Poor lighting, glare, worn documents, a change in appearance or an unusual name format can cause failures. Automated face matching can perform unevenly across different groups of people, which is part of the wider debate about facial recognition ethics.
- Fraud arms race. Attackers try to defeat checks with edited images, stolen documents and synthetic media. Advances in deepfakes make liveness checks harder, so providers keep changing their methods.
- Inclusion. People without standard documents, or with unstable addresses, may find it hard to pass.
The privacy trade-offs
An ID image and a face scan are some of the most sensitive things you can share. They are difficult to replace if they leak. A few questions help you judge a request.
- Who is collecting this, and why? A bank or regulated financial business has a clear reason. An ordinary website asking for a passport scan may not.
- Who else sees it? The privacy policy should say whether a third-party provider processes the data.
- How long is it kept? Some businesses are required to retain records for a number of years; others delete images soon after the check. A policy that says nothing is a reason to ask.
- Is biometric data stored? Find out whether your face template is kept, used to train systems, or shared. Data protection laws in some regions give you rights to access or delete data, though legal retention duties can limit deletion.
- Is it necessary? Sometimes there are alternatives, such as verifying through your bank or using a government digital identity scheme, which can share only a confirmation instead of a full document.
- What if it leaks? ID data is valuable to criminals. After any data breach affecting such records, consider protective steps such as fraud alerts on your credit file where available.
Spotting a fake request
Scammers also ask for ID, because the images are useful for opening accounts in your name. Be cautious if:
- the request arrives by unexpected text or email, especially with urgency, as with many suspicious messages;
- the link goes to a lookalike domain rather than the real service;
- someone you only know online, such as a “buyer”, “employer” or “partner”, asks for a passport photo;
- you are told to send documents by chat instead of through the service’s own app or website.
When in doubt, go to the service directly by typing its address or using its official app, and check whether it really needs the information.
Reducing your risk
Share the minimum that is genuinely required. Use official apps and sites, keep copies of what you submitted, and keep an eye on your accounts afterwards. Some services let you cover or redact non-required details on a document, but follow their instructions, as an altered image may fail the check. Identity verification is a trade: it can protect both you and the service from fraud, but it asks you to trust the organization with data that is hard to change, so it is reasonable to ask questions first.