How do banks verify identity? They collect four details from every new customer (name, date of birth, address and an identification number such as a Social Security number) and check them, either against a government photo ID, or against independent records such as a credit bureau file and public databases, or both. That is what the federal Customer Identification Program rule requires, and it lets each bank decide the method by risk and channel. The uncomfortable part is accuracy: the person comparing a face with an ID photo is less reliable than most banks assume, and the machines vary widely. Botminds' CIP Verification is an agentic solution for the files those checks cannot clear: agents lay every field beside every source and explain each difference, and a person decides.
Identity is where much of the fraud a bank sees begins
42%
of all BSA reports in 2021 related to identity, about 1.6 million
$212 billion in suspicious activity
13%
of those described attackers exploiting insufficient verification
about 323,000 filings
70.5%
of banked households use mobile, online or phone banking as their main way in
2023
How do banks verify identity?
Banks verify identity in two steps: collection, then verification. The CIP rule requires the four details "prior to opening an account", and verification "within a reasonable time" afterwards, by documents, non-documentary methods or both (31 CFR 1020.220). Documentary verification usually means a current driver's license or passport. Non-documentary methods, in the rule's words, include "contacting a customer; independently verifying the customer's identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; and obtaining a financial statement".
The standard is a "reasonable belief" that the bank knows who the customer is, not proof beyond doubt. That standard is what lets two banks verify the same person differently and both be right, and it is why the method matters less than whether it is written down, applied consistently and recorded.
How do banks verify identity online?
Online, banks replace the employee's look at an ID with software. A typical remote opening asks the applicant to photograph the front and back of an ID, takes a selfie, checks that the selfie is of a live person and matches the ID photo, reads the barcode, and compares the details with a credit bureau header and other databases. Device and location data are often checked too. Most households already bank this way: in 2023, 70.5% of banked households used mobile, online or telephone banking as their primary access (FDIC, 2023).
The rule treats online opening as one of its named situations: an account opened "without appearing in person" requires non-documentary procedures. That is why online verification leans on data checks even when an ID is scanned, and why it produces more exceptions for people whose data is thin or out of date.
Three channels, three ways banks verify identity
What the bank checks: An employee compares the person with a photo ID, enters the details; data checks run in the background.
Where it tends to break: The human comparison itself, and keying errors such as a day and month swapped.
What the bank checks: ID capture and tamper checks, selfie match and liveness, bureau and database comparison, device signals.
Where it tends to break: Thin or stale records, phone and document quality, injected or synthetic images.
What the bank checks: Details read out and checked against records; a call-back to an independently sourced number; a one-time code.
Where it tends to break: Knowledge-based questions whose answers can be found or stolen.
How do banks verify identity over the phone?
Over the phone, banks verify identity with data checks plus something the caller has, rather than something the caller knows. The FFIEC's 2021 authentication guidance is direct about the weakness of the old approach: "Reliable verification methods generally do not depend solely on knowledge-based questions to verify identity" (FFIEC, 2021). Questions about past addresses or loan amounts can be answered from stolen data or public records.
Better practice combines the same data comparison used online with a call-back to a number the bank found itself, not the one the caller gave, or a one-time code to a device already on file. For a new applicant with no history at the bank, a phone opening is still a "not in person" situation under the CIP rule, with all the non-documentary procedures that implies.
What does a bank check when you open an account?
When you open an account, a bank usually runs three separate checks, under three separate rules. The CIP check confirms who you are. A sanctions check compares your name with the Treasury's OFAC lists, and the bank searches its records against law-enforcement requests under the 314(a) program. And for a checking account, a bank may pull a report from a checking account reporting company; the CFPB notes that most banks buy them from one of two companies, ChexSystems or Early Warning Services, and that a denial based on one must come with a notice naming the company (CFPB, 2016).
Only the first is identity verification in the CIP sense. A denial because of a past overdraft on a ChexSystems report is a different matter from a failure to verify identity, with a different remedy, and a bank should not describe one as the other.
Are bank staff trained to spot fake IDs?
Bank staff are trained to check IDs, but the best evidence on human face matching suggests training and experience help less than expected. In a study published in PLoS ONE, 30 passport officers compared photos with the people in front of them. They made errors on 10% of trials on average: "6% of valid photos were wrongly rejected, and 14% of fraudulent photos were wrongly accepted". Students did about as badly, and "there was no relationship between employment duration and face matching accuracy" (White et al., 2014).
How often identity checks get it wrong, human and machine
These are faces matched with photos, not KYC files reviewed. We know of no published regulator or academic study that measures error rates in manual review of complete account opening files, so each bank has to build that comparison from its own files. The face-matching evidence is still the closest proxy for the branch employee's check, and it does not support the assumption that a careful person at the desk is the safe default.
Training still matters, but it should aim at what people can do well. NIST's identity proofing standard requires services with attended proofing to "train proofing agents to detect indicators of fraud" and to give them "tools to flag suspected fraudulent events for further treatment and investigation" (NIST SP 800-63A-4). Indicators of fraud are things a person can check reliably: a date of birth that does not fit the face, an address that does not fit the ID, a story that changes. A long look at a photograph is not one of them.
Our data show that the best results come from a single facial examiner working with a single top-performing algorithm.
P. Jonathon Phillips, NIST, on the 2018 PNAS study of face examiners
How accurate is face matching?
Face matching by algorithm is accurate in good conditions and uneven across people. NIST's 2019 study of demographic effects found false positive rates differing between demographic groups by a factor of ten, and sometimes more than a hundred, with higher false positives for women than men, and for the elderly and children (NISTIR 8280). The 2025 identity proofing standard responds by requiring biometric performance for every demographic group to stay within 25% of the performance for the population as a whole (NIST SP 800-63A-4; NIST identity assurance levels covers the standard).
The most useful finding is about combinations. In NIST's 2018 study, published in PNAS, professional examiners did better with an algorithm as a partner than with another examiner: "Trained human beings perform best with a computer as a partner, not another person" (NIST, 2018). For a bank, the lesson is to design for the pair. Neither the person nor the machine should work alone on the files that matter.
Errors in both directions have a cost. A false match lets the wrong person in. A false non-match turns a genuine applicant into an exception, and if one group of applicants is turned away more often than others, the bank has a fair access problem as well as an operations one. That is the reason to track refers and declines by channel and, where the data allows, by group, and to make sure every automated refusal is looked at by a person before it becomes final.
Why can't banks verify my identity?
Banks usually cannot verify someone's identity because the records they check disagree with what the applicant gave, not because they suspect fraud. Credit bureau headers lag behind moves and name changes; a young adult or a recent arrival may have no bureau file at all; a form keyed with day and month in the wrong order breaks a date-of-birth match; a phone camera or an older ID can fail a document check. Each of those is a CIP exception with an ordinary fix.
The fix is almost always one more piece of evidence, not a repeat of the same check. In the fictional sample data used throughout this series, 19% of exceptions ended with the applicant being asked for one document, and most were closed on evidence already in hand. Opening an account with an expired ID walks through one such case from the applicant's side.
Every field beside every source, with the difference explained, in CIP Verification
Measuring a bank's own identity verification baseline
A bank that wants to know whether automation is safer than its people has to measure its people first. The comparison that matters is not machine against perfection; it is the new process against the current one, on the same files. Sampled correctly, a bank's own exception history is enough to do it.
How to measure your current identity verification error rate
- Pull a sample of last year’s CIP exceptions
Weighted toward the routes examiners sample: non-documentary, incomplete verification, higher risk.
- Re-review each file blind
A second reviewer, without the first decision, records what the evidence supports.
- Count three kinds of error separately
Good applicants refused or delayed, resolutions not supported by the evidence, and files with no described resolution.
- Note which source would have settled each file
Bureau, database, a second document, a confirmation: this is your procedure, discovered.
- Run the same files through the new process
Agents or vendor, with a person deciding as they would in production.
- Compare on the same three counts
And on human minutes per file, which is where the cost is.
Where CIP Verification fits in how banks verify identity
CIP Verification is built on the finding that a person and an algorithm together beat either alone. The agents do the part machines are good at: reading the ID document and its barcode, pulling the bureau header and the database, comparing four fields across every source and explaining each difference in a sentence. The person does the part judgement is for: deciding whether the evidence supports a resolution under the bank's procedure. A member service representative proposes, and a BSA analyst who did not propose it approves.
The agents also know when to stop. When the sources show something no procedure step can resolve, they propose nothing. In one sample file, the applicant's Social Security number belonged to someone born in 1958 at both the bureau and the database; the opening stopped and the file went to the BSA officer on a restricted page.
When identity cannot be verified, CIP Verification proposes nothing
The solution does not judge whether a selfie is live or a document genuine; that stays with the bank's identity verification service. How those machine checks and the people around them fit together, step by step, is traced in automated identity verification for CIP. The solution as a whole is on the CIP Verification page.
Questions people ask
Do banks verify identity with a credit check?
They often compare your details with a credit bureau header, which is the name, address, date of birth and SSN part of a credit file, as one non-documentary method. That is identity verification, not a credit decision; checking accounts may also involve a separate report from a checking account reporting company.
Can a bank verify my identity without a photo ID?
The CIP rule allows it, through non-documentary methods such as database comparison, references from other banks or a financial statement. Whether a particular bank offers that route is in its written procedure.
Are knowledge-based questions enough to verify identity?
Not on their own, according to the FFIEC's 2021 guidance, which says reliable methods "generally do not depend solely on knowledge-based questions". Answers can be found in breached data or public records.
Does face matching treat everyone equally?
No. NIST found false positive rates varying by factors of 10 to more than 100 across demographic groups, higher for women, older people and children. NIST's 2025 standard caps the gap at 25% worse than the overall population for systems that follow it.
How long does identity verification take at a bank?
Seconds when every check passes. An exception takes as long as the person resolving it: in the fictional sample data in CIP Verification, the median from exception to approved resolution was 34 minutes.