How are the identification levels IDN1 to IDN4 composed from the four identification factors?
IDN1: everything self-declared (PP.a, IE.a, IV.a, NP.a). IDN2: checked against apparently genuine evidence, online or physical presence (PP.b-d, IE.b, IV.b, NP.a). IDN3: strongly validated evidence and a stored copy (PP.b-d, IE.c or 2x IE.b, IV.c, NP.b). IDN4: physical or virtual in-person presence, biometrics checked, presence documented (PP.c-d, IE.d, IV.d, NP.c).
* Each identification level fixes a minimum value for all four factors. *
| Level | Description | Presence | Evidence | Validation | Non-repudiation |
|---|---|---|---|---|---|
| IDN1 | All identity data are self-declared and not checked | PP.a | IE.a | IV.a | NP.a |
| IDN2 | Data checked with apparently genuine and valid evidence; applicant present physically or online | PP.b, PP.c or PP.d | IE.b | IV.b | NP.a |
| IDN3 | IDN2, plus the evidence was strongly validated and a copy of evidence with physical features was made | PP.b, PP.c or PP.d | 1x IE.c or 2x IE.b | IV.c | NP.b |
| IDN4 | IDN3, plus physical or "virtual in-person" presence, biometric data from the evidence are checked, and the applicant's presence is documented | PP.c or PP.d | IE.d | IV.d | NP.c |
Two things stand out. Plain online presence (PP.b) is enough up to IDN3, but IDN4 demands a live human check, either at a counter or by real-time video. And IDN4 is the first level where the person's body (biometrics) is both checked and recorded.