What does a candidate actually do in a vID check?

If the candidate quits, you do not have a screening program. You have a folder of unfinished invites. You have a roster you hope is fine.

The candidate experience is therefore the product. This article walks through what they actually do, in order.

Why typed fields matter more than steps

Baymard Institute studies checkout forms. A checkout is a different product from a background check. The human sitting in front of the fields is the same kind of human.

In June 2024 Baymard published numbers from its 2024 research. The average checkout flow was 5.1 steps long. It contained 11.3 form fields. Seventeen percent of users have abandoned a checkout because of complexity. Baymard labels that finding #GC050.

A checkout step, in Baymard's definition, is any distinct phase the user must complete. Examples include creating an account and entering shipping, billing, and payment information. Baymard counts from the shopping cart step to the order review step, both included.

That step count has been stable. Baymard has tracked it at large retailers since 2012. Very short flows of 1 or 2 steps, including the cart, remain rare. Flows of 8 or 9 steps are nearly gone. Most checkouts stay at 5 or 6 steps.

Baymard also reports a finding from more than ten years of this work. People often assume that more steps make a flow worse. The research says that assumption is a red herring. What predicts drop-off is how many fields the person has to manage.

Most sites, Baymard says, need only 8 form fields in a checkout. The 2024 average was 11.3. That was slightly down from 11.8 in 2021 and 12.7 in 2019. The extra fields raise both the perceived effort and the actual effort.

On a phone the problem is worse. Baymard notes that every unnecessary field makes the form look longer on a small screen than it does on a desktop.

Checkout Optimization: Minimize Form Fields. Published June 26, 2024. Average of 11.3 fields. Seventeen percent have abandoned because of complexity. Field count, not step count, is the number that matters.

A background-check form is heavier than a checkout. It asks for a Social Security number. It asks for addresses. It asks for dates a volunteer does not have in front of them at a picnic table. Each field is a chance to mistype. Each mistype is a chance to search the wrong file.

vID's answer is to stop asking them to type those fields. The camera on the phone they already have does that work.

Step 1: they receive an invite

You send an invite by email or text from /start. The candidate opens a link. The process runs in the browser. There is no app store.

They can use a phone. They can use a computer. The native camera on either device is enough.

This step has one job. It gets a live person to a camera. It does not collect a biography.

Step 2: they photograph a government photo ID

They photograph the front and back of a valid photo ID. The product reads the document. Name, date of birth, and the other printed fields come off the ID. The candidate does not re-key them.

The product also authenticates the document. Authentication here means checking that the ID is a real government document, not a printout held up to the lens.

NIST treats that authentication as a prior step. Identity verification, in SP 800-63A, happens after the evidence has already been treated as valid. A photo of a document is not yet proof that the person holding it is the person named on it.

Step 3: they take a live selfie

The camera captures a live face. The product checks liveness so a still photo held up to the lens does not count. It then compares that live face to the portrait on the ID.

NIST describes that comparison in Special Publication 800-63A, section A.5. Identity verification is a process that confirms a linkage between two things. One is the validated evidence for the claimed identity. The other is the physical, live existence of the person presenting the evidence.

For identity assurance levels 2 and 3, that binding is done by a physical or biometric comparison of the photograph on the strongest piece of evidence to the applicant. It can also be a biometric comparison between information on the evidence and a biometric characteristic captured live from the applicant.

NIST lists a weaker method as well. Knowledge-based verification compares answers to challenge questions. That method is listed at FAIR strength only. For IAL2 and IAL3 the strongest evidence is STRONG or SUPERIOR, so FAIR binding is never the required method. A mother's maiden name is not the IAL2 check.

For remote IAL2 proofing, NIST says you need both an image of the identity evidence and a live capture of the applicant's face. The credential service provider must use liveness detection so the face is live and not a spoofing or presentation attack. NIST says there are considerable risks of impersonation without that control.

One method NIST names is automated comparison plus liveness detection, completed in a single session. That is the shape of the vID capture. Identity capture on vID usually takes under a minute.

SP 800-63A: Identity Verification. SP 800-63A section A.5. The selfie is not the whole proof. The comparison of the live person to the ID portrait is the proof. Liveness is required either way.

The same face is also searched against criminal mugshots, next to name-and-identifier searches.

NIST names two other remote methods besides the automated one. In the first, a remote operator supervises the session and may compare the ID image to a live video of the applicant. To confirm the video is live and not pre-recorded, the operator may ask the applicant to move their head, raise or lower their eyes, or answer a question during the capture. In the second, liveness detection runs at capture and an off-line operator compares the images later. That second method may take more than one session. vID's capture is the automated path: comparison plus liveness, in one sitting.

Step 4: they review disclosures and submit

The FTC requires a stand-alone written notice before an employer may obtain a consumer report. The notice cannot live inside an employment application. Written permission comes next. Those documents appear in this step, in the browser, before searches run.

The FTC also requires the employer to certify compliance to the company supplying the report. The candidate does not see that certification. It is a duty on the employer side, not a fifth screen in the phone.

Using Consumer Reports: What Employers Need to Know. Stand-alone written notice, then written permission, before you get the report.

vID maintains SOC 2 security status. Identity data is triple-encrypted. That is the handling of what the camera just captured. It is not a substitute for the FCRA documents in this step.

What the candidate does not do

They do not create an account in an app store. They do not type their Social Security number into a ten-field form. They do not wait for a sales call to 'unlock' the invite.

They also do not decide what the report means for a job. That decision sits with the organization, under the EEOC and FCRA rules that apply to that organization. The candidate's five minutes are how the file gets built.

HireRight's March 2024 survey of 1,275 respondents, reported by SHRM that September, put accuracy back above speed and cost. The candidate's five minutes are how those two stop being a tradeoff. The slow part was never the camera. The slow part was the form, the typo, and the mismatch.

Accuracy Regains Top Spot as Crucial Factor in Background Screenings. Accuracy first among 1,275 respondents in March 2024. A finished identity capture is how a fast check stays a correct check.

What happens after they submit

The candidate is done. The record searches are not. Synapse applies matching rules to each result. It asks for corroborating identifiers such as date of birth, Social Security number, address, or license. A typical Synapse case takes about ten seconds. Ambiguous matches go to an analyst. Hits that need a courthouse go to county confirmation through TazWorks.

The candidate does not sit in that queue. They already photographed the ID and the face. The wait, if there is one, is a courthouse or an analyst, not another form.

vID maintains SOC 2 security status. Identity data is triple-encrypted. FCRA disclosures and consent were already collected in step 4, before any search ran.

Why this is also an accuracy step

A mistyped date of birth is a different person. A mistyped Social Security number is a different person. Baymard's checkout work is about drop-off. The same extra fields also produce typos. A volunteer at a picnic table is a high-typo environment.

Identity capture removes those fields. Name and date of birth come off the document. The live face is bound to the portrait. The search then runs on that identity. That is the candidate experience and the matching input at the same time.

What this flow does not do

It does not download an app. It does not create a social login. It does not ask the candidate to type their life story into a portal designed for recruiters.

It does not replace the organization's decision. The candidate submits. The report comes back. What the organization does with a hit is still their process under the EEOC and the FCRA.

It does not prove the ID is the only ID the person has ever held. A Social Security trace can still surface other names and addresses. That is a later search, running on the identity that was just confirmed.

Most people finish in about five minutes. The rest of the clock, if there is one, is Synapse, an analyst, or a courthouse.