# identity-proofing

Source: https://startwithidentity.com/glossary/identity-proofing/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Identity proofing is the process of confirming that an applicant is a specific, real person before issuing them an account or credential; [NIST SP 800-63A-4](https://pages.nist.gov/800-63-4/sp800-63a.html) defines it as "establishing a relationship between a subject accessing online services" and "a real-life person to some degree of assurance." The strength of the process is graded by [Identity Assurance Level (IAL)](https://startwithidentity.com/glossary/ial/).

SP 800-63A-4, which supersedes SP 800-63A, splits proofing into three steps:

| Step | What it confirms |
|---|---|
| Resolution | The evidence and attributes collected point to one unique person |
| Validation | The evidence (for example a passport or driver's license) is genuine, accurate and current |
| Verification | The applicant is the same person the evidence was issued to, often by comparing a live selfie to the document photo |

It also names four ways to run them: remote unattended (fully automated), remote attended (a proofing agent over a secure video session), on-site unattended (a kiosk) and on-site attended. At IAL3 a trained representative attends the session and collects at least one biometric. A [trusted referee](https://startwithidentity.com/glossary/trusted-referee/) can make a risk-based decision for an applicant who cannot meet the normal evidence requirements.

Identity proofing is not authentication. Proofing happens once, at enrollment or recovery, and answers "who is this person"; authentication happens at every sign-in and answers "is this the same person we proofed". The two meet at account recovery: if a help desk resets MFA without re-proofing, the attacker skips straight past both. That is why proofing now appears in workforce programs, not only in banking [KYC](https://startwithidentity.com/glossary/kyc/): it is the step before issuing a [Temporary Access Pass](https://startwithidentity.com/glossary/temporary-access-pass/) or a first passkey.

See also: [identity verification (IDV)](https://startwithidentity.com/glossary/idv/), [IAL](https://startwithidentity.com/glossary/ial/), [NIST SP 800-63](https://startwithidentity.com/glossary/nist-800-63/), [top identity proofing solutions](https://startwithidentity.com/articles/top-5-identity-proofing-solutions/), [customer identity verification guide](https://startwithidentity.com/guides/compliance/customer-identity-verification-guide/), [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/)