IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Identity verification (IDV/KYC) — proving a real person
Logging in proves you can get into an account. It does not prove who the person is. A bank or a marketplace seller must prove the real person. That is identity verification. Your goal: tell login from proofing and pick the right level of checks.
- Authentication asks: do you hold the credential?
- Proofing asks: are you really who you claim to be?
- Match the level of checks to the risk.
- Keep the result. Delete the raw ID scans when the law allows.
Authentication is not proofing
Authentication answers one question. Do you hold the credential for this account? The credential can be a password, a passkey or a magic link.
Identity proofing (also called IDV) asks a harder question. Are you really the person you claim to be?
You can sign in perfectly to an account that was opened under a fake name. The login is flawless, and the person is still a fraud. Proofing ties an account to a real person. Use it where that matters. See proving who you are.
A key opens the door of a flat. It does not prove that you own the flat. For that you need the sale papers. Login is the key. Proofing is the papers.
Assurance levels: climb only as high as the risk
Not every account needs a passport check. The US standard NIST SP 800-63A describes identity assurance levels (IAL). Below the first level, nothing is checked. This is normal for everyday sign-up. The levels are:
- IAL1: one piece of real evidence, such as an ID, is checked.
- IAL2: stronger checks that the applicant truly owns the evidence. A document plus a selfie is common.
- IAL3: a trained agent meets the applicant on-site, and a biometric is collected.
Low stakes need a low rung. Regulated money needs a high one.
How proofing is done
| Method | What it checks | Its weakness |
|---|---|---|
| Document check | A government ID (passport, license) is real and unchanged. | A stolen or borrowed ID is still a real document. You checked the card, not the holder. |
| Liveness + selfie match | A live person is present and their face matches the ID photo. | It needs active challenges (blink, turn) to beat a deepfake or a held-up photo. |
| Database or knowledge check | Details match a credit or public record. | This is the data that leaks in breaches. It is weak alone. |
A document check plus a liveness check is the usual way to do remote IAL2. The document shows that the identity exists. The liveness check shows that a live person is sending it. No single method is perfect. So proofing stacks a few signals.
KYC and privacy
Banks and marketplaces must do this by law. It is called KYC (Know Your Customer). It is part of the rules of the game. In India, a bank may use Aadhaar e-KYC. An OTP goes to the mobile linked to your Aadhaar. A bank may also use a video call with an official, called video KYC. But holding someone's passport creates a new danger. You now keep exactly what identity thieves want.
Practice data minimization. Verify, then record the result: "proofed at IAL2 on this date". Keep the raw ID scans only as long as the law requires. Then delete them. Keeping scans forever is a liability. It can clash with the right to be forgotten.
Go deeper: levels and re-checks
The levels follow the 2025 revision, NIST SP 800-63A-4. IAL2 can be done remotely or in person. For IAL3, a controlled kiosk with a remote agent also counts.
KYC includes anti-money-laundering (AML) checks. Some rules make banks keep ID records for years. When that time ends, delete them.
Proofing is not one-and-done. High-value actions can call for re-verification. A sudden jump in risk in the middle of a session should trigger a step-up. It is the same "climb a rung" idea, used after login.
🧪 Interactive lab — enable JavaScript to play with this one.
Curious how we would design right-sized proofing for your sign-up flow? Browse the free security toolkit or talk to our team about matching assurance to risk.