Many of my employees at Savora ask me, "What happens after I upload my ID to a website?"     It might sound strange, but there are a lot of clear steps you need to take to make sure someone is who they say they are.      I'll show you how to do everything, like taking a picture of your ID and checking it online.    This is for business leaders and anyone else who wants to learn more about the technology, the risks it poses, and how to stay safe from them.

     A quick look at the nine main steps

 1. The user sends

    2. Make sure you follow the rules and check the quality before you take a picture.   

 3. Accepting documents and OCR  

  4. Checks to see if the document is real   

5. Uses biometrics to check that the face is the same and that the person is still alive.

 6. Looking through databases to make sure the information is correct   

   7. Checking for risk (watchlists and PEP/AML) 

8. If you have to, go over it by hand

     9. Picking something, writing it down, and keeping it

    Let's go over each step in detail so that it's easy to understand.

    ---

    1) You send in a picture of yourself and your ID.

    When you send in your information, the process of checking it usually starts:

•      A picture of an ID, like a passport, driver's license, or national ID, 

• A selfie or short video taken live

    You can also upload files that you scanned or took with your phone camera with modern flows.      "Light it up, don't glare, and show all corners" are examples of what good apps tell you to do.   This makes things go faster.

    ---

    2) Help with getting the right shots and checking the quality right away

    Before you even open the file, the platform checks its quality on its own:

•  Is the picture clear? 

• Can you see all the edges? 

• Is there enough light and no glare?

      If the picture doesn't pass these tests, the app will ask you to take it again.      This stops false rejections from happening later and makes it easier to check by hand.

    —

    3) Using OCR (optical character recognition) to read documents

    When you send in a good picture, the system uses OCR to read the structured data and text in the document.

•   Name, date of birth, document number, expiration date, country of issue, and so on.   

•   It's easier to read the machine-readable zones (MRZ) on passports.

        OCR turns the picture into data that computers can read.       This lets the system check the fields on its own.

        4) Look to see if the paper is real.

       A machine checks to see if the paper is real:

•    Template matching: Does the layout look like the templates that people in that country already use for that type of document?

•   Do the holograms, microprint, and UV features all look the same when you look at them?       

•   Is the font or spacing off?  Are there problems with the edges or the printing

•   Checking the MRZ fields on a passport for mistakes by doing math.

          If the system sees signs of tampering, changed images, or fake documents, it either marks the application for manual review or denies it right away.

        ---

      5) Checking to see if someone is alive and matching faces to biometric data

      There are two ways to check that the ID holder is who they say they are:

•       Face match: This checks to see if the person in the ID photo and the selfie are the same.    We give things scores based on how similar they are. A higher score means they match.

•     Liveness detection: This checks to see if the selfie is of a real person and not a photo, a video replay, or a deepfake.      Some ways to do this are to look for blinks, ask you to turn your head, or use AI to look at small textures.

    Strong systems use more than one liveness signal to stop false accepts, which is when someone pretends to be someone else.---

     6) Checking and confirming information

      Look at the information that was taken away:

•    Is the date of birth right? 

• Is the document no longer good?  (not in the future, but in the normal age range for people)      

• Are the fields for the address set up right?You could have let the system check the identity data against other sources, like bank records and utility companies, to make sure they are correct.      People often use hashed or tokenized lookups to keep their information private.

7).Risk screening: PEPs, AML lists, and fines

         To follow the rules, you need to compare identity information to the following:

•   Lists of international sanctions, such as OFAC and others    

•  Databases of Politically Exposed Persons (PEPs) 

• Databases of known fraud and bad press 

•  Internal watchlists of users who have been banned before

         Usually, a compliance team pays more attention to a match or a close hit.     This step stops people and businesses from stealing money and breaking the law.

     8) Go over it by hand with someone else who is involved.

    You can't always choose things on your own.      If a case is marked as unclear, like when the edges of a document are cut off, the face match is on the edge, or there is strange activity, it is sent to trained human reviewers who:

•     Look at the original photos and metadata. 

•  If you need more proof, ask for it, like a utility bill, a second ID, or a short video. 

• You can either agree, disagree, or ask for more information.

    It's important to check documents by hand to make sure that security and fairness are balanced, especially for people from places where documents aren't as standardized.

    ---

    9) Picking it out, writing it down, and keeping it safe

    The system chooses one after all the checks are done:

•     Verified means that the user has more rights or can use the service.    If you see 

• "rejected," it means that the user can't use the service or that they are doing something wrong.   

• "Pending" means that the user is waiting for more information or for someone to check it by hand.

      Every step is recorded with timestamps and, if needed, cryptographic hashes to make sure the rules are followed.        The law and the company's rules say how long they can keep information.  It is usually encrypted when it is not in use, and there are rules about who can see it and how long it can be kept.

    ---

    ## What to expect when it comes to safety and privacy

•     * **Least privilege**: Only the least amount of information needed to check is used.

•    * **Encryption**: Data is encrypted both when it is being sent and when it is not being used.

•   * **Tokenization:** Many systems store verification tokens that you can use instead of regular IDs.     This means you don't have to keep giving the same information over and over again.

•    * **Consent and openness**: You should know why, what, and how long data is kept.

•  * **Right to access/erase**: Laws like the GDPR give you the right to ask for data to be deleted or accessed.

We want you to know that you agree and that Savora doesn't have a lot of information about you.

    ---

     Why verifications don't always work (and how to make sure they do)

•      If your pictures are blurry or were taken in low light, try taking them again when it's bright or holding your phone still.     You need to show a current ID because the document is no longer valid.     It doesn't look like the picture is right.    Make sure the selfie is up-to-date and clear.       Make sure to cut off all of the edges and corners of the paper.  When you send edited or scanned screenshots, always use the original document or a live capture.

    ---

Conclusion

    Verification is a process that combines automated checks, smart risk screening, and the judgment of people.      The goal is to make it easy for good users to start and hard for bad ones to do so.      As online identity systems get better, you can expect more password-free flows, proofs that protect your privacy (selective disclosure), and better user experiences.

    When you set up or improve online ID verification for your business, the most important things to think about are how accurate it is, how easy it is to use, and how to keep the data safe and legal.      If you're a person, you should use the best ways to get information and look for services that are honest about how they use your information.

Would you like an audit of your current verification flow or one that is made just for your platform?          As the head of **Savora**I'd be happy to help you set up a verification pipeline that is safe, protects users' privacy, and works for both users and the law.