What is an identity-verified background check?

A background check is only as good as the identity attached to it. If the name on the order is not the person in the room, a clean result is false calm.

What NIST means by identity verification

NIST publishes digital identity guidelines. One of them is Special Publication 800-63A. Section A.5 of the implementation resources is about identity verification.

Identity verification, in that section, is not the first step. Evidence has already been shown to be valid. The remaining process confirms that the valid evidence actually refers to the applicant who is appearing for identity proofing.

The stated objective is a linkage. One side of the linkage is the validated evidence for the claimed identity. The other side is the physical, live existence of the person presenting the evidence.

For identity assurance levels 2 and 3, that binding is a physical or biometric comparison of the photograph on the strongest piece of evidence to the applicant. It can also be a biometric comparison between information on the evidence and a characteristic captured live from the applicant.

NIST lists methods by strength. SUPERIOR is biometric comparison of a characteristic on the evidence against a live capture, remote or in person. STRONG is a physical comparison of the applicant to the facial image on the strongest validated evidence, in person or remote. FAIR is knowledge-based verification: challenge questions.

Knowledge-based verification may be used at FAIR strength only. For IAL2 and IAL3 the strongest evidence is STRONG or SUPERIOR, so FAIR binding is never the required method. A mother's maiden name, a prior address from a credit header, or a 'what street did you live on' quiz is not the IAL2 check.

Physical comparison, in NIST's words, is a comparison by a person of the applicant to the photograph on the evidence. Remote physical comparison may use high-resolution video or a camera. Biometric comparison is automated. The most common biometric for this purpose is the facial image, because most STRONG and SUPERIOR evidence carries a photograph.

For remote IAL2 proofing, NIST says you must collect both an image of the identity evidence and a live capture of the applicant's face. The credential service provider must employ liveness detection so the face is live and not a spoofing or presentation attack. NIST says the risks of impersonation without that control are considerable. Liveness is required whether the comparison is physical or automated.

SP 800-63A: Identity Verification. Section A.5. The comparison of the live person to the ID portrait is the definition. A selfie sitting in a folder is not. A knowledge-based quiz is not.

On vID the candidate photographs a government ID and takes a live selfie. The product authenticates the document, checks liveness, and matches the selfie to the ID portrait. That verified identity becomes the input to screening. Capture usually takes under a minute.

What a typed name lets through

On April 15, 2026 the Justice Department announced sentences for two U.S. nationals, Kejia Wang and Zhenxing Wang. They facilitated North Korean remote IT workers posing as U.S. residents.

Kejia Wang, 42, of Edison, New Jersey, was sentenced to 108 months in prison. In September 2025 he pleaded guilty in the District of Massachusetts to conspiracy to commit wire fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft. Zhenxing Wang, 39, of New Brunswick, New Jersey, was sentenced to 92 months. In January 2026 he pleaded guilty to conspiracy to commit wire fraud and conspiracy to commit money laundering. Each received three years of supervised release. The court ordered them to forfeit a total of $600,000. As of the announcement the United States had received $400,000 of that amount. Kejia Wang was also ordered to pay $29,236.03 in restitution.

The Department described "laptop farms." Employers sent devices to U.S. addresses. The hire looked domestic. The person at the keyboard was not.

According to court documents, from about 2021 until October 2024 the defendants and their co-conspirators compromised the identities of more than 80 U.S. persons. They obtained remote jobs at more than 100 U.S. companies, including many Fortune 500 companies. The scheme generated more than $5 million in illicit revenue for the government of the Democratic People's Republic of Korea. Victim companies incurred legal fees, network remediation costs, and other damages of at least $3 million.

Kejia Wang traveled to Shenyang and Dandong, China, twice in 2023 to meet overseas actors, including a former classmate he knew was from North Korea. He then served as the U.S.-based manager, supervising at least five facilitators who collectively hosted hundreds of victim-company computers at their residences. Zhenxing Wang was one of those facilitators. He and the others connected the laptops to keyboard-video-mouse switches so overseas workers could operate the machines remotely.

The two men created shell companies with bank accounts, including Hopana Tech LLC, Tony WKJ LLC, and Independent Lab LLC, to make the overseas workers look like staff of legitimate U.S. businesses. The companies had no employees and no operations. The accounts received millions of dollars from victim companies, much of it then sent overseas. The U.S. facilitators received nearly $700,000 for their roles.

IT workers in the scheme also reached sensitive employer data and source code. That included International Traffic in Arms Regulations data from a California defense contractor that develops AI-powered equipment. Between about January 19, 2024 and April 2, 2024, an overseas co-conspirator accessed the company's laptop and files containing technical data marked as ITAR-controlled.

Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote IT Worker Scheme. April 15, 2026 press release. The identity on the paperwork was the opening move. The laptop in a New Jersey bedroom was the camouflage.

The FBI's Internet Crime Complaint Center published related guidance on July 23, 2025 as alert I-072325-4-PSA. The alert says North Korean IT workers disguise their identities. They use U.S.-based individuals, some witting and some unwitting, to receive devices and to install remote-access software. The goal is to get around hiring controls meant to keep overseas workers off company networks.

IC3 lists the services those U.S. facilitators have provided. A U.S. internet connection through company laptops received on the workers' behalf. Remote desktop setup. Reshipment of laptops overseas. Setup of financial accounts. Accounts on popular job sites. Help buying web services, including artificial intelligence models and background check programs, for use by the North Korean workers. Attendance at virtual interviews on their behalf. Creation of U.S. front businesses that claim to offer short-term technical contractors.

That last cluster is the point for this article. The scheme buys background check programs. A form that accepts a name, a date of birth, and a Social Security number will process a stolen identity as cheerfully as a real one. The check can even come back clean, because it ran on the stolen person.

IC3's own advice starts with identity documents. Check for misspellings. Cross-reference photographs and contact information with social profiles, portfolio sites, and payment platforms. When meetings are virtual, mandate video, keep backgrounds unobscured, and ask the person to wave a hand in front of their face, which may prompt a malfunction in AI-generated video. Capture images for later comparison, because sometimes one person passes the interview and another person does the work. If you ship a laptop, send it only to the address on the identification documents. Do not grant system access until the background check is completed.

North Korean IT Worker Threats to U.S. Businesses. Alert I-072325-4-PSA, July 23, 2025. The identity on the W-2 is not always the person at the keyboard. They have been known to buy background check programs too.

A live face compared to the portrait on a government ID is a different door from a form. It is not a perfect door. It raises the cost of the lie.

What IC3 tells companies to do next

The same July 2025 alert continues past the identity documents. Verify prior employment and education directly with the businesses and schools. When possible, mandate in-person drug tests or fingerprinting to verify identity and claimed location.

On payment, IC3 says to compare payment accounts across employees, flag accounts opened with similar documentation or matching banking information, and watch people who change banks often because banks have been closing accounts of concern. Be wary of agreements to pay in virtual currency, which can move funds internationally with less scrutiny.

On shipping, send laptops and documents only to the address on the identification documents. If the employee asks for a different address, require more documentation. Do not grant system access until the background check is completed.

Contracted IT work is called out separately. North Korean IT workers often arrive through a third-party vendor. The hiring company is then removed from the direct hiring process. IC3 says to educate that vendor about the same guidance.

Those steps are FBI advice to businesses. They are not a vID feature list. The one step this product owns is the identity bound to the check. The rest still sits with the employer.

What identity confirmation does not replace

Once identity is captured, Synapse applies matching rules to each record result. It asks for corroborating identifiers. Common names require stronger evidence. Ambiguous matches go to an analyst.

The CFPB's January 2024 screening opinion is about that record side. Consumer reporting agencies must have procedures that keep sealed, expunged, and duplicative public records out of reports. Identity confirmation does not replace those procedures. It stops you from running an accurate search on the wrong human.

Fair Credit Reporting; Background Screening (advisory opinion). Maximum possible accuracy is a procedure on the compiler. Identity confirmation is a procedure on the subject.

HireRight's 2024 survey of 1,275 respondents put accuracy back ahead of speed and cost. Identity-confirmed screening is how those three stop fighting. $25, no subscription, /start.

Accuracy Regains Top Spot as Crucial Factor in Background Screenings. Accuracy first in March 2024. A fast name search on a stolen identity is a miss that looks like diligence.

What identity confirmation does not prove

It does not prove the person is qualified for the job. It proves the person on camera is the person on the ID.

It does not prove the criminal-record search is complete. Completeness is a compiler problem, which is what the CFPB opinion is about.

It does not prove a clean result means the person should be hired. That decision is the employer's, under Title VII and any state rules that apply.

It does not make a virtual interview safe by itself. IC3 still wants unobscured video, a hand wave to stress AI faces, and a later image comparison, because the interviewer and the worker can be different people. Identity confirmation at check time is one control. It is not the whole hiring process.