Online marketplaces require users to verify their identity for a variety of reasons, such as to prevent fraud and to comply with anti-money laundering laws. Verification processes vary in complexity, but commonly include email and phone verification, photo ID and selfie comparison, address verification, and biometric verification.
While these methods are useful for confirming the identity of the user, they can be vulnerable to manipulation or security breaches. In this section, we’ll explore current methods of identity verification used by marketplaces today, and how they sometimes fall short in providing reliable confirmation of user identity.
Email and phone verification
Email and phone verification are two of the most basic methods used to verify online marketplace accounts. In email verification, a user will enter their email address when registering for an account. The system then sends that email address an automated message with a validation code that can be used to activate the account. Phone verification works similarly - the user is asked to provide a phone number, which is then sent an automated message with a validation code.
Once the code is entered, the user's account is verified and they can begin using the platform. Both email and phone verification are relatively easy to implement and provide some level of assurance that someone is who they say they are.
However, neither of these methods are foolproof since it’s possible for fraudsters to create fake email addresses and phone numbers.
Photo ID and selfie comparison
Photo ID verification and selfie comparison are two more advanced methods used to verify user accounts on online marketplaces. With photo ID verification, users are asked to upload a photo of their government-issued ID (such as a driver's license or passport). The platform then verifies the information against an official database in order to confirm that the account is associated with a real person.
Selfie comparison works similarly, but instead of verifying the ID against a database, the platform compares the photo to one taken from the user's camera or smartphone.
For verification purposes, having to upload an official photo or take a selfie are both steps that add a lot of friction to the verification process. Additionally, with the advancement of generative AI and deepfakes, facial recognition like the kind used in photo ID verification will become more vulnerable to spoofing attacks.
Address verification can also be used to verify user accounts on online marketplaces. To do this, the platform requires users to enter their address when registering for an account. The system then checks that address against official databases to ensure that it’s associated with a real person and not a fraudster. This helps prevent fraudulent activity, since it makes it more difficult for someone to create a fake account using false information.
However, address verification using databases has many shortcomings, most notably gaps in the database’s recency and coverage. For example, the United States has a central address database through organizations like the United States Postal Service or the Department of Motor Vehicles, but these organizations aren’t standard in every country, which presents an immediate problem for global companies seeking to use address verification. If there’s no public database to rely on, companies have to go out of pocket to pay for private subscriptions.
Additionally, not every individual is covered by these types of databases. For example, minors who live with their parents and aren’t yet old enough to drive may not have an official record to which the address verification system can compare their information, which may result in a false positive.
Lastly, if database information is out of date (for example, if someone moved recently), that can result in false positives or in people gaining access even where they might have failed verification had the database information been current.
Biometric verification is becoming increasingly popular as an identity verification method for online marketplaces. It involves using biometrics data like a fingerprint or face scan to verify the identity of someone registering for an account. Similar to address verification, the biometric data is compared against official databases to see if the user is who they claim to be.
Depending on the type of biometric verification, however, this method can be vulnerable to “spoofing” attacks in which an attacker sends false or manipulated biometric data to fool the system into granting them access. For example, in the case of facial recognition, someone might use a computer-generated deepfake video of their target victim in order to pass facial or voice recognition authentication.