Identity Proofing

Identity proofing is the process of confirming that an applicant is a specific, real person before issuing them an account or credential; NIST SP 800-63A-4 defines it as "establishing a relationship between a subject accessing online services" and "a real-life person to some degree of assurance." The strength of the process is graded by Identity Assurance Level (IAL).

SP 800-63A-4, which supersedes SP 800-63A, splits proofing into three steps:

It also names four ways to run them: remote unattended (fully automated), remote attended (a proofing agent over a secure video session), on-site unattended (a kiosk) and on-site attended. At IAL3 a trained representative attends the session and collects at least one biometric. A trusted referee can make a risk-based decision for an applicant who cannot meet the normal evidence requirements.

Identity proofing is not authentication. Proofing happens once, at enrollment or recovery, and answers "who is this person"; authentication happens at every sign-in and answers "is this the same person we proofed". The two meet at account recovery: if a help desk resets MFA without re-proofing, the attacker skips straight past both. That is why proofing now appears in workforce programs, not only in banking KYC: it is the step before issuing a Temporary Access Pass or a first passkey.

See also: identity verification (IDV), IAL, NIST SP 800-63, top identity proofing solutions, customer identity verification guide, help desk social engineering