What Is Digital Identity, and How Can Businesses Verify It?

A customer opens an account, returns to use it, and eventually needs to recover access after losing their phone. Each interaction raises a different question: Who is this person? Do they control the account? Is it safe to restore access?

Digital identity connects these interactions. Understanding what it contains, how it can be verified, and when further checks are needed helps businesses make decisions based on evidence.

A digital identity is a set of attributes that represents a person within a particular digital context. It enables a service to distinguish that person from others and associate relevant information and interactions with the appropriate account or record.

Organizations and even devices can also have digital identities, but we’ll focus exclusively on digital identities related to humans.

Consider a customer registering with a car rental service. Their digital identity within that service can include:

• Information about the person, such as their name, date of birth, and contact details.

• Identifiers that distinguish their account, such as a unique customer number assigned by the service.

• Verified information, such as driver’s license details checked during registration.

• Activity associated with the account, such as previous rentals and changes to contact information.

These details serve different purposes. The customer number helps the company locate the correct record, even when two customers share a name. Verified license information helps it assess whether the customer meets rental requirements. Account activity provides context for subsequent interactions.

A person does not have one universal digital identity. The same person can have separate digital identities with a bank, employer, healthcare provider, government portal, and other services. Each organization maintains the data and credentials relevant to its relationship with that person.

Besides, establishing a digital identity is not a one-time event. Businesses must periodically reassess whether the person interacting with an account is still the same person who was originally verified.

A digital identity is the information and attributes that represent a person within a particular digital system. It may include both self-reported and verified information.

A digital ID is an electronic means of providing evidence of someone's identity or specific attributes, such as their age. It can be issued by a government authority or another trusted organization.

A verifiable credential (VC) is a digitally secured credential containing claims made by an issuer. Its authenticity and integrity can be verified cryptographically, and some formats support selective disclosure of personal information.

Consider how these concepts apply to a car rental service:

The distinction lies in their purpose: digital identity represents the person within a system, digital ID provides identity evidence, and verifiable credentials enable cryptographic verification of issued claims. These categories can overlap, since a digital ID may itself be implemented as a verifiable credential.

A customer can have a digital identity before presenting any credentials. The rental company can then use verified evidence to establish or update that identity, provided it has checked the credential's validity and its connection to the customer.

Businesses use digital identities to associate people with accounts, provide access to services, and determine whether customers meet specific requirements. What they need to establish depends on the interaction, for example:

• Opening an account. The business creates a record for the new customer. Depending on the service and risk involved, it may also need to establish the customer’s real-world identity, verify relevant attributes, and determine eligibility. 

• Providing subsequent access. When a customer returns to view or change a booking, the service needs to confirm that they control a login method linked to the account. This is authentication: it allows the business to connect the current interaction to an existing customer record without necessarily repeating the initial identity checks.

• Verifying a specific attribute. Sometimes, a business needs to establish only one fact, such as whether a customer meets an age threshold or holds a professional qualification. Where supported, the customer can provide evidence of that attribute without disclosing unrelated personal information. 

• Recovering access. If a customer loses their phone or another login method, the business needs to establish that the person requesting recovery is entitled to regain control of the account. Knowing the name or date of birth on the record may be insufficient, since someone else could obtain those details.

Businesses commonly establish identity in two ways: by checking identity evidence and biometrics directly, or by accepting a digital credential from an issuer they trust. In either case, they must assess whether the evidence is sufficient for the transaction and appropriately connected to the person presenting it.

In a typical remote verification process, the customer captures an identity document and takes a selfie. The business uses verification software to perform several complementary checks:

1. Validate the document. Identify its type, extract relevant data, check expiration and other validity information, and assess it for signs of alteration or forgery.

2. Validate chip data where supported. For compatible electronic documents and devices, NFC reading enables cryptographic checks of the chip data, adding evidence beyond what is visible in a photograph.

3. Verify the applicant against the document. Compare the applicant’s captured face with the document portrait to assess whether they depict the same person.

4. Detect presentation and injection attacks. Liveness and presentation attack detection can help identify attempts involving photos, replays, masks, or other presentation attacks, while injection-attack controls help protect against manipulated media introduced directly into the capture pipeline.

In practice, businesses often combine document and biometric checks within their identity verification workflows. For example, iCard uses Regula Document Reader SDK to verify identity documents and Regula Face SDK for facial recognition and liveness checks in its digital wallet app. Similarly, UBS incorporates biometric passport verification, including NFC chip checks, alongside facial verification in its remote onboarding process.

A business does not always need to collect a person’s identity documents and perform the initial checks itself. It can accept a digital ID or credential from an issuer whose verification process it trusts, provided the evidence meets its requirements. The value of a credential depends on the assurance of the issuer's identity proofing process and the controls protecting the credential after issuance.

For example, a customer completes document and biometric checks with an identity provider. The provider then issues a digital credential containing verified information about that person. When the customer registers with a rental company that accepts the credential, they can present it instead of submitting the same documents for another initial check.

A real-world example is REACT, a digital identity solutions provider that uses Regula’s technology to verify identity documents and perform biometric checks before issuing digital credentials. This illustrates how document and biometric verification can establish a foundation for trusted digital credentials that users can later present as identity evidence.

This is how reusable identity works: previously verified identity information can be used again by participating services. Each business still maintains its own digital identity for the customer, but it can use evidence from a trusted issuer to establish or update that record.

Government-issued digital IDs and other trusted digital credentials, for example, verifiable credentials, can provide identity evidence in these interactions. For example, the European Digital Identity Wallet framework is designed to support activities such as opening bank accounts, registering SIM cards, and sharing qualifications. Whether a business can accept a particular digital ID depends on the scheme, its technical capabilities, and the requirements of the service.

The receiving business still needs to check:

• The issuer: Is the issuer trusted for the relevant claims, and does its identity proofing process provide sufficient assurance for this use case?

• The credential: Is it authentic, unaltered, and within its validity period? Has it been revoked or suspended, where status information is available?

• The presenter: Does the person presenting the credential have the required connection to it? Depending on the scheme, this may involve proof of control of a cryptographic key bound to the credential, with additional checks where needed. It is important to note that proof of possession of a credential or cryptographic key does not automatically establish that the legitimate holder is presenting it. 

• The information provided: Does it establish the identity details or attributes required for this interaction?

Cryptographic verification establishes the credential’s origin and integrity. It does not automatically establish that its claims are true, a distinction made in the W3C Verifiable Credentials Data Model. The business must therefore consider both the issuer’s reliability and the safeguards connecting the credential to its presenter.

Reusable identity can reduce repeated document collection and checking. It does not remove the receiving business’s responsibility to assess the evidence and decide whether further verification is necessary.

Identity verification can fail when evidence is fabricated, genuine evidence is presented by an impostor, the capture process is manipulated, or previously reliable information is no longer current. Each problem requires different controls.

Account takeover is a separate post-onboarding risk. An attacker may compromise an account whose underlying identity was correctly established, which is why identity proofing must be complemented by secure authentication, session controls, and account recovery.

NIST’s authentication guidance addresses phishing-resistant authentication and account recovery, including circumstances where parts of identity proofing should be repeated. A successful onboarding check cannot compensate for a recovery process that allows an impostor to take control. In many fraud investigations, the issue is not whether the original identity was genuine but whether control of the account later changed through compromise, social engineering, or weaknesses in recovery procedures.

Identity assurance does not end at onboarding. Changes to account information, authentication methods, risk signals, credentials, or the nature of a transaction can create reasons to perform additional checks later in the customer lifecycle.

For example, additional verification may be appropriate when:

• A customer needs to recover an account after losing an authentication method

• Important identity or contact information changes

• An identity document or credential expires

• A transaction presents a higher level of risk

• Suspicious activity indicates possible account takeover

• Regulatory or business requirements call for updated identity information

Businesses therefore need processes for applying the appropriate verification checks at onboarding and introducing additional checks when risk or circumstances change.

Regula IDV Platform supports this lifecycle approach by combining identity verification workflows, identity and case management, and integrations in a single environment. Organizations can use it to:

• Build and automate customizable verification workflows for onboarding and other stages of the identity lifecycle, from straightforward checks to complex multi-system scenarios.

• Verify identities with document and biometric checks, backed by Regula’s database of 16,500 identity document templates from 254 countries and territories.

• Manage identities and verification sessions centrally, with user profiles, session histories, analytics, and detailed interaction logs providing visibility into the identity journey.

• Support regulatory compliance with built-in capabilities for KYC, AML/PEP and sanctions screening, age assurance, and other jurisdiction-specific requirements.

• Connect identity verification with the wider technology ecosystem through a vendor-agnostic architecture and customizable integrations with third-party systems and services.

• Adapt identity verification to global operations, with flexible deployment, multilingual support, and workflows tailored to different business and regulatory requirements.

Together, these capabilities help organizations move beyond isolated identity checks toward continuous identity management, adapting verification to changing circumstances and risk throughout the customer lifecycle.