How to verify personal information (identity)?

Question

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers.

I am trying to figure out how/where companies get information to ask you to verify you have not stolen someone's identity. For example:

Which of the following cars have you owned?
Which of the following addresses have you lived at?
What color was your xyz car?
What city were living in, in xyz year?

Generally the only information entered is your social and name. I would like to be able to provide this same verification in my service but don't know where to find it. I would prefer to build it myself if that's possible, but if there is a service for it, that could work too.

As for building it myself I am curious how companies even have access to that kind of information. To get the color of my car for example, you would need to verify based off of very confidential DMV records or I guess possibly insurance companies. Do they have a contract that allows them to use said information for these purposes or how do they get their data?

Answer 1

There are professional services that do background verification/auditing of individuals and gather the information to cross verify it. So it itself is a service offering apart from the application you want to use it for (long story short you don't wanna do it just for the sake of your app/service, if you think of it as new business opportunity then it's a different ballgame and out of scope for this question)

There are two major types of background verifications 1. Criminal/personal records 2. Financial/credit verification records

Based on the requirements the details comprising of these records vary.

I am unsure about service providers for criminal/personal records your area (as these will be domestic/country specific agencies) however for financial/credit verification records you can tie up with Experian, Equifax etc service providers(again country specific considering the legal aspect of capturing part of PII).

Oh and be advised when you will be embedding/engaging their services in your application you need to adhere the guidelines for how you'll protect the data at rest and in transit, have to go through their independent audits like Experian Independent 3rd party assessment (EI3PA), Equifax audit etc which are as strict as PCI audits and need to be executed by independent QSA annually.

Finally following are some of the companies (with better SEO at least) who will be able to do the job for you.

(Might be deprecated) Consumer Authentication Service by VeriSign - http://xml.coverpages.org/VerisignCAS.html

Experian: http://www.experian.com/decision-analytics/identity-and-fraud/identity-verification-screening.html

MiiCard: http://www.miicard.com/

Trulioo: https://www.trulioo.com/

i-Verified Background Screening Solutions: http://i-verified.us/

ACCESS BACKGROUND SCREEN LLC: http://www.accessbackgroundscreen.com/id9.html

AAIMCheck: http://www.aaimea.org/AAIMCheck/Background-Verification.aspx Credit Verification: http://www.creditverification.com/

einvestigator has a list ofprivate investigators if required: https://www.einvestigator.com/missouri-private-investigators/

A parting gift, few valuable links which may be helpful either now or in the future.

https://en.wikipedia.org/wiki/Identity_verification_service

http://www.businessnewsdaily.com/7638-best-background-check-services.html

http://www.businessnewsdaily.com/7636-choosing-a-background-check-service.html

http://insurance.mo.gov/consumers/faq/creditScoring.php

Answer 2

You mentioned PayPal in your comment. Sites like Paypal and similar sites have the information that you give to them. That is how they verify data. The initial question is confusing: "I am trying to figure out how/where companies get information to ask you to verify you have not stolen someone's identity." Any company asking me to verify who I am, would have to be a company I have a vested interest in doing business with on some form of financial transaction. E.g. pay a bill, transfer money, check medical history, etc. Anything associated with me having to verify who I am - would mean I would have had to given them some form of information beforehand. If some company randomly asked me to verify ANYTHING and I had no vested interest in that company, I'd contact a lawyer.

Now when it comes to say filling out a credit application for a car, etc., you'd still have to provide that company with some initial form of data. That company can then do basic information digging, and ask you another question: "Where did you live 5 years ago." Any organization is not going to randomly store that much data on anyone. When this occurs (say you fill out a credit form), companies usually rely on data brokers like LexisNexis (which purchased Choicepoint).

(edited) As for your question, where do questions come from, there is no standard that I am aware of. If you are building out something for say an application (web based or not), here is a primer

Answer 3

This is something that has always concerned me. As you point out, nearly all of the common security questions are actually public knowledge, albeit often with a few hoops to jump through, presenting not much by way of a challenge to a sophisticated attacker researching a high-value victim.

It's further complicated by people making the assumption that the data is all harvested or shared between providers. It is not. When one of my credit cards transitioned to another issuing bank, they got a lot of my data but none of my password data. When I called them for support, I asked about that (I use different "mothers' maiden names" for different accounts, and none of them are ancestors' names); they said it was blank, so we set a new one.

I'm under the impression they just don't say anything; if they don't have an answer for your mother's maiden name, they merely save your answer the first time you offer it so that they can then compare it to your future answers. This is all kinds of insecure, so it behooves you to make sure it's set as soon as you open such an account (or else an attacker with just your address and financial credentials will have an easier time stealing your ID).

As noted in my above story, financial information (anything required to make money, really) is indeed shared; this is how financial companies make the lion's share of their profits (targeted ads on the web weren't the first to to this game!).

 

The challenge questions included in this SE question are not populated by public records (though you might be surprised at how easily they can be). They were asked of you when you set up the account.

Aside from pre-defined challenge questions, some of the better credit card issuers will ask you about recent purchases you made (if they don't feel free to offer that data, it's pretty clear proof that you at least have been using the card).

Answer 4

You can integrate with the Trulioo API and instantly verify over five billion individuals and 250 million organizations. Although you can use the API with various ways (e.g., Java, C# etc.), there are a couple of quick-start projects that make integration easy.

If you are using npm, you can run npm i trulioo to install the EmbedID component.

Install trulioo-react:

npm install trulioo-react

Then in your jsx:

import EmbedID from 'trulioo-react/EmbedID'

const handleResponse = (e) => {
    // handle verification submission result here ...
}

<EmbedID url='URL' handleResponse={handleResponse} />

handleResponse is the callback from the vendor, here's more info of what's the response structure about.

To avoid CORS issues, you will need a backend server; you can either build your own or use trulioo-react-sample-app:

TRULIOO_BASE_URL=
TRULIOO_USERNAME=
TRULIOO_PASSWORD=
TRULIOO_PORT=
SIGNATURE_ALGORITHM=
PRIVATE_KEY_FILE_PATH=

Simply run the following command in your cmd/terminal and enjoy the ride.

# install the libraries needed
npm i
# start the server
npm start

---

Disclaimer: I work for Trulioo and I am the author of trulioo-react and trulioo-react-sample-app projects.