Identity verification

Authenticate client or third-party identities during each interaction by testing the credentials supplied by the person making the claim.

This control targets both internal and external fraud risks.

Examples

Examples of this control include:

using RealMe to confirm an individual’s identity online
performing entry-level checks to confirm the identity of employees and contractors
requiring service providers to present evidence of identity for company directors
requiring applicants to provide certified copies of primary and secondary identification.

Accepting claims or requests without confirming an applicant’s identity can lead to:

fraudsters impersonating customers or third parties to receive fraudulent payments or gain access to information
fraudsters using false or stolen identities to receive fraudulent payments or gain access to information
spoofing, which is the act of disguising communication from an unknown source as being from a known, trusted source.

Methods to evaluate the effectiveness of this control include:

reviewing identity verification policies to make sure it is clear when a policy applies
reviewing a sample of completed claims to confirm correct processes are being carried out
reviewing identified cases of fraud that used a false or stolen identity to confirm whether changes are required to identity verification processes
confirming that employees are applying processes consistently both within and across channels.

Other capability, prevention, detection and response controls that can enhance this control’s effectiveness:

Types of behaviour this control is designed to mitigate:

Explore a range of controls that can be put in place to reduce the risk of fraud happening in your organisation.