What are the levels of the validation factor (IV.a to IV.d) in identity proofing?
IV.a no validation; IV.b adequate validation (the applicant possesses the evidence and the data are checked against it); IV.c strong validation (IV.b plus a closer examination of evidence and data); IV.d highest validation (IV.c plus comparison with biometric features and verification of the postal address).
The questions: Can the link be established between the applicant presenting the evidence and the claimed identity? Do the applicant's data match the data in the evidence?
| Value | Validation |
|---|---|
| IV.a | None |
| IV.b | Adequate: the applicant is in possession of the evidence, and the stated data are checked against it |
| IV.c | Strong: IV.b plus a more thorough examination of evidence and data |
| IV.d | Highest: IV.c plus comparison with biometric features and verification of the postal address |
Evidence answers "is this document real?"; validation answers "does this document belong to this applicant, and does what they told us match it?". A perfectly genuine passport presented by someone who merely looks a bit like its owner is the classic case that only validation catches, which is why IV.d adds a biometric comparison (face or fingerprint against the document). Remote face comparisons are usually combined with a liveness check so that a photo or a replayed video cannot pass.
Go deeper:
Liveness test (Wikipedia) — how remote biometric checks detect photos, masks and injected deepfakes.