1

If I am dealing with somebody remotely, via phone and email, how can I verify their identity?

The person has presented me credentials, such as copies of passport etc, but obviously just because someone has a copy of another person's passport, does not mean it is that person. For example, imagine the person has a roommate and that roommate knows where his other keeps his documents. Then the roommate could copy the passport and then pretend to be the other person.

3
  • 3
    Can you give a bit more information on the exact situation here, how remote this is and what is at stake? If it involves a significant investment for example you could find a local trustworthy party (say a well known notary) to verify that identity. If it involves a first physical date I would consider eyeball verification in a public place, and if it involves a purchase I would consider going for another party with a better reputation on whichever commerce platform is involved.
    – MiG
    Apr 1, 2022 at 11:55
  • @Glorfindel any idea how the question was tagged with non existent tag to begin with? Should we report this as bug on MSE? (At first thought it's result of migration, but can't see any migration trace in question timeline) Nov 21, 2022 at 8:48
  • 1
    @ShadowTheKidWizard I think this is just regular tag pruning: web.archive.org/web/20220713055931/https://…
    – Glorfindel
    Nov 21, 2022 at 8:51

6 Answers 6

8

The classic method for this, going back long before digital signing and public keys, never mind official documents, was to ask the other person a question only the two of you know the answer to. "Where did we go for drinks the first time we went out?" or "What did you mother call me when I asked for more soup at your graduation dinner?"

The problem is, this only works to verify someone claiming to be a familiar person (for instance, in a potential "stranded friend" scam). If you're trying to verify the identity of someone who was a stranger before your online dealings, you're pretty much reduced to asking for a live video feed, including the old "Write {random word} on a piece of paper and hold it up to the camera" to verify the feed is live and not recorded -- and then comparing the video (live or captured) to photos in the ID copies they've sent you.

That's good enough for police at a traffic stop to verify the person in the car is actually the holder of the driver's license they've presented (though they may ask things like date of birth to ensure against basic "fake" ID). It's generally all the real-time validation available at a Customs check after an international flight, and both of those have a history of working pretty well -- but you should be aware that careful planning routinely defeats those checks as well for things like undercover operations.

Bottom line: there is no completely reliable method. Even if you had a means of verifying a fingerprint against the national database, you have no way to be certain the fingerprint sent to you is actually that of the person you're conversing with.

2

This doesn't help your roommate example, but there is a way to verify that someone has not stolen a digital picture of credentials and is presenting it as their own. You can ask them to send a picture of the credentials beside a handwritten note with your name on it, or some other physical marker that proves they do have the credentials in their physical possession.

1

Ask for a unique picture of them, something that'd be hard to Photoshop or find online.

Something like a picture of them with a spoon over their nose, or have them write something on a piece of paper and take a picture of them holding it.

1

The "Take This To The Bank" Lifehack

Using static documents to spoof an identity, while possible, is difficult to carry on with a high degree of consistency.

You can challenge the individual to provide a series of official certified documents (such as a passport, driver's licence, credit card, etc.) Having immediate access to a variety of common documents with matching information, does tend to increase the person's claim.

However, using an active transaction with a federally-regulated bank reduces identity-spoofing to near zero.

Send a personal bank draft/cheque for some amount and ask your contact to deposit it in their account. You can trace if and when it was deposited. Ask your unsecured contact for an equal amount to be sent to you from their account as a draft/cheque (money order). The signatures will have to match on the bank draft/cheque and others which are on the document copies you have probably already obtained

The banks are pretty good arbiters of identification. There's a minuscule to zero chance that your mystery person can avoid the scrutiny of a bank teller who will demand verifiable identification before any financial transaction is even attempted.

Edit: Even if the person does their banking online, there will be a dr/cr account mismatch unless the person has a joint account with the willing or unwitting "room mate". Money orders are typically a service desk manual operation so the signatures are the key spoof weak point. Human intervention in a transaction is your best verification.

Good luck.

6
  • Bank teller? These days most actions in most banks can be done online. Aug 3, 2022 at 12:08
  • Maybe needed to add "in some countries"? OP is from USA, and in there yes, really. Aug 3, 2022 at 13:58
  • @ShadowTheKidWizard Banks are the most regulated NGOs on the planet as the world economy depends on them. International standards exist for the banking industry. They work pretty much the same anywhere you be. Note that the point of the answer was about … Oh, look, there's my bus. G'bye. : )
    – Stan
    Aug 3, 2022 at 14:31
  • I just challenge the usage of the term "bank teller", not the essence of the answer. Aug 3, 2022 at 14:39
  • This can be extended to the civilized world, where checks are no longer in common use; ask for their bank account number, transfer a small sum (say, 42 cents, but don't tell them how much) and have them tell you the amount. This proves that they are in possession of the account, and displays the recipient's name in your transactions. A serious identity thief could have taken over their victim's bank account, too, of course; but for mundane situations where you don't specifically expect to need to guard against heavy criminality, this should provide reasonable proof.
    – tripleee
    Sep 8, 2022 at 16:10
1

There are a couple of ways to test if the person is who they say they are:

  • ask them to take a picture holding their passport near their face. If they already sent you the copies then a picture shouldn’t be a problem. You already know their passport info, now you’re just making sure that you’re talking to the passport’s owner. A selfie holding a page that has a picture is simple enough to make;
  • to make sure that the person doesn’t use an old picture of someone else, ask them to hand–write a date and your name (for example) on a piece of paper and take a selfie with that paper. Combined with a selfie with a passport, now you know that it’s done recently for your verification;
  • have a video call with them. It doesn’t have to be an hour–long session. Just 15 mins of small talk or verifying questions should be enough to resolve any concerns;
  • Google them if you haven’t already. It’s not as good as selfies with a passport but it can give a general idea of the person. Lots of people have Facebook pages even if they don’t use them, for example.

The person you’re talking to must understand why you’re asking for an extra verification, and if there’s nothing to hide, they don’t have a reason to deny selfies or video calls. It doesn’t take more time than making a copy of passport pages. And also, neither of these selfies or a call gives personal information that wasn’t already provided (e.g., passport details). If the person claims that they don’t have a passport right now, tell them that you can wait for it. Or you can accept a selfie with passport copies (though, I wouldn’t do that personally).

0

You can use spy dialer to look up the number or email the other person uses. I use it for unknown callers.

2
  • 3
    If you mean apps like TrueCaller then I must warn the readers it's terrible and possible malware. I started to get spam ads inside other apps when installing TrueCaller, after removing it those ads were gone. And I'm sure other apps that "spy" on other numbers as bad, or worse. Aug 2, 2022 at 7:10
  • I'm using one called Hiya which is specifically for blocking scam calls etc. I have stayed on the free version because I don't need the premium features, but I have certainly not had it serve me unwelcome ads or infect other, unrelated applications. I'm on IOS; perhaps the situation on Android is different.
    – tripleee
    Sep 8, 2022 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.