Lifehacks Stack Exchange is a question and answer site for people looking to bypass life's everyday problems with simple tricks. It only takes a minute to sign up.
Sign up to join this community
If I am dealing with somebody remotely, via phone and email, how can I verify their identity?
The person has presented me credentials, such as copies of passport etc, but obviously just because someone has a copy of another person's passport, does not mean it is that person. For example, imagine the person has a roommate and that roommate knows where his other keeps his documents. Then the roommate could copy the passport and then pretend to be the other person.
The classic method for this, going back long before digital signing and public keys, never mind official documents, was to ask the other person a question only the two of you know the answer to. "Where did we go for drinks the first time we went out?" or "What did you mother call me when I asked for more soup at your graduation dinner?"
The problem is, this only works to verify someone claiming to be a familiar person (for instance, in a potential "stranded friend" scam). If you're trying to verify the identity of someone who was a stranger before your online dealings, you're pretty much reduced to asking for a live video feed, including the old "Write {random word} on a piece of paper and hold it up to the camera" to verify the feed is live and not recorded -- and then comparing the video (live or captured) to photos in the ID copies they've sent you.
That's good enough for police at a traffic stop to verify the person in the car is actually the holder of the driver's license they've presented (though they may ask things like date of birth to ensure against basic "fake" ID). It's generally all the real-time validation available at a Customs check after an international flight, and both of those have a history of working pretty well -- but you should be aware that careful planning routinely defeats those checks as well for things like undercover operations.
Bottom line: there is no completely reliable method. Even if you had a means of verifying a fingerprint against the national database, you have no way to be certain the fingerprint sent to you is actually that of the person you're conversing with.
This doesn't help your roommate example, but there is a way to verify that someone has not stolen a digital picture of credentials and is presenting it as their own. You can ask them to send a picture of the credentials beside a handwritten note with your name on it, or some other physical marker that proves they do have the credentials in their physical possession.
Ask for a unique picture of them, something that'd be hard to Photoshop or find online.
Something like a picture of them with a spoon over their nose, or have them write something on a piece of paper and take a picture of them holding it.
The "Take This To The Bank" Lifehack
Using static documents to spoof an identity, while possible, is difficult to carry on with a high degree of consistency.
You can challenge the individual to provide a series of official certified documents (such as a passport, driver's licence, credit card, etc.) Having immediate access to a variety of common documents with matching information, does tend to increase the person's claim.
However, using an active transaction with a federally-regulated bank reduces identity-spoofing to near zero.
Send a personal bank draft/cheque for some amount and ask your contact to deposit it in their account. You can trace if and when it was deposited. Ask your unsecured contact for an equal amount to be sent to you from their account as a draft/cheque (money order). The signatures will have to match on the bank draft/cheque and others which are on the document copies you have probably already obtained
The banks are pretty good arbiters of identification. There's a minuscule to zero chance that your mystery person can avoid the scrutiny of a bank teller who will demand verifiable identification before any financial transaction is even attempted.
Edit: Even if the person does their banking online, there will be a dr/cr account mismatch unless the person has a joint account with the willing or unwitting "room mate". Money orders are typically a service desk manual operation so the signatures are the key spoof weak point. Human intervention in a transaction is your best verification.
Good luck.
There are a couple of ways to test if the person is who they say they are:
The person you’re talking to must understand why you’re asking for an extra verification, and if there’s nothing to hide, they don’t have a reason to deny selfies or video calls. It doesn’t take more time than making a copy of passport pages. And also, neither of these selfies or a call gives personal information that wasn’t already provided (e.g., passport details). If the person claims that they don’t have a passport right now, tell them that you can wait for it. Or you can accept a selfie with passport copies (though, I wouldn’t do that personally).
You can use spy dialer to look up the number or email the other person uses. I use it for unknown callers.
