Manual checks do not scale and do not catch much
A lettings agency onboarding 150 tenants a month has a member of staff compare a scanned passport to a video call. A small lender does the same for loan applicants. It is slow, it annoys legitimate customers, and a good forgery on a phone screen passes easily because the person checking has never been trained to spot one.
Machine learning verification does the checks more consistently: reading the document, looking for tampering, comparing faces and confirming a live person is present. Done well, most genuine customers verify in minutes and staff only see the cases that look wrong.
Done badly, it rejects honest people with unusual documents, lets through sophisticated fraud and hands you a compliance problem. This is one area where we are firm about buy versus build.
What a verification flow checks
- Document capture. Guided photo of the document, with glare and blur checks.
- Classification. Identifying document type, issuing country and version.
- Data extraction. Reading printed fields and the machine-readable zone, and checking they agree.
- Authenticity checks. Fonts, layout, holograms, microprint patterns and signs of editing or screen replay.
- Chip reading. Where the device supports it, reading the passport or ID card chip, which is a much stronger check than the image.
- Face match. Comparing the document photo to a live selfie.
- Liveness. Confirming a real person is present rather than a photo, mask, screen or deepfake video.
Each step has its own failure modes, and fraudsters target the weakest one. Deepfake injection attacks, where a synthetic video is fed into the camera stream, are a growing concern that verification providers now invest heavily to counter.
Why we usually recommend buying the core checks
| Consideration | Established provider | Building in-house |
|---|---|---|
| Document coverage | Thousands of document types and versions | Each new document type needs samples and work |
| Fraud research | Dedicated teams tracking new attack methods | You find out about new attacks from losses |
| Certification | Often certified against recognised standards | You would need to achieve and maintain it |
| Cost at low volume | Per-check fee | High fixed cost |
| Control and flexibility | Limited to their API and rules | Full |
The document and face models are the part that takes years to get right and never stops needing work. A small business building them in-house is taking on a permanent fraud research programme. For almost every client, we would integrate a provider for the core checks and build the surrounding workflow ourselves.
Where the custom work actually sits
- Risk-based routing. Low-risk customers get a light check; higher-risk ones get chip reading and enhanced checks. The rules reflect your regulatory position, not the provider's defaults.
- Combining signals. Verification results alongside device data, address checks, sanctions screening and your own history.
- Proof of address and supporting documents. Bank statements, utility bills and payslips need document extraction and consistency checks that ID providers often do not cover well.
- Review queues. A clear screen for compliance staff showing why a case was referred, with the evidence.
- Audit trails. Records of what was checked, when, and what decision was made by whom.
This is the kind of joined-up onboarding build that our AI integration projects cover, and it is where most of the conversion and compliance improvement comes from.
Bias, exclusion and fairness
Face matching and liveness models have historically performed unevenly across skin tones, ages and some disabilities. Document checks can fail on older or less common documents. The result is that some legitimate customers are rejected more often than others.
- Ask providers for performance data across demographic groups and document types
- Always offer a fallback route, such as manual review or an in-person check
- Monitor rejection and referral rates by document type and, where lawful, by group
- Remember that face matching uses biometric data, which carries extra obligations under UK and EU data protection law
A verification flow is judged by how it treats the honest customer with an unusual passport, not the demo with a perfect one.
When you might not need it
If regulations do not require identity verification and the risk of impersonation is low, adding a document and selfie step costs conversions for little benefit. A lighter check, such as verified email, payment card checks or a database-based identity check, may be proportionate. Check what your sector actually requires before designing the flow; it varies a great deal between lettings, lending, gambling, crypto, recruitment and healthcare.
Questions SpiderHunts would ask first
Which regulations apply to you, and in which countries? What is your monthly volume and expected growth? Which documents do your customers typically hold? What happens to a customer who fails? The answers point to a provider shortlist and a workflow design within a couple of conversations, well before anyone writes code.
At SpiderHunts we also ask to see your current referral and drop-off numbers, if you have them. A verification step that is technically excellent but loses a fifth of genuine applicants at the selfie screen is a commercial problem, and it is usually fixable with better capture guidance, clearer copy and a sensible fallback route. Measure completion rate by device and document type from the first week, because that is where the quiet losses hide.