What is the difference between verification and authentication and why are both important for your identity management?
When establishing identities, including the authentication of identity documents, these two terms are frequently used: Verification and Authentication. What do these two terms mean, how do they differ and why are they important for anyone who needs to verify identities and ID documents? In this blog article, we show why the differences are relevant and what they mean in practice.
Identity verification in everyday life
As citizens, most of us have probably encountered the issue of identity verification at some point in our everyday lives. It starts with opening a bank account or signing a new mobile phone contract. Both are examples of transactions where identity is verified. This can take place in a branch or online via a video identification procedure. Identity verification usually involves two steps:
- The authentication of an official identification document and
- determining whether the document and holder belong together.
Depending on the provider, sector and technology used, different terms are used, such as
- Verification or verification of identity
- ID card authentication
- Identity or authenticity verification
Even though these terms are often used interchangeably in everyday life, they are by no means interchangeable. For citizens, this does not usually play a major role. However, the situation is different when you are sitting on the other side of the desk - in other words, when you are responsible for carrying out identity checks. Then it becomes clear how important it is to make a precise distinction.
Why is conscientious verification important?
Conscientious verification can prevent major damage. This is because organised crime offences often begin with a false identity. This is used to open an account in order to launder money, for example. Banks are therefore legally obliged to verify identities on the basis of valid, official identification documents. But identities are also verified for mobile phone contracts, car hire, casino visits and, last but not least, when crossing borders in order to prevent criminal offences.
What does authentication mean?
Authentication is also a process that verifies identities or systems. The process ensures that only authorised persons are granted access to certain areas, systems or transactions. Or to put it the other way round: with various methods of authentication, it is possible to deny an unauthorised person access and prevent damage.
Authentication is a central concept in the digital world and we encounter it in numerous areas of application. Many applications require or recommend two-factor authentication (2FA) for their users. Some even require multi-factor authentication (MFA). This simply means that the identity is established with at least two factors, thereby minimising the risk of granting access to an unauthorised person.
We are also talking about authentication when entering an individual password. There are also other methods of authentication, for example
- biometric features: Facial recognition, iris scan, fingerprint, etc.
- Tokens or one-time passkeepers: codes that are sent to a mobile receiving device or generated by a special app, e.g. push TAN in online banking
A special feature is single sign-on (SSO) authentication. The German Federal Office for Information Security describes this procedure as a one-time login or as a login via a third-party provider:
"The idea: a central provider enables users to log in to several other services. It takes on the task of verifying the identity of the user for all other services. Users therefore only have to enter their login details once and can then access multiple services. Various providers offer this function, often including large technology groups."
Verification vs. authentication: the differences at a glance
The differences between authentication and verification can be summarised as follows:
- Authentication checks and confirms the identity of a person or system: Who is it?
- Verification checks the accuracy and validity of the information provided: Is the information correct?
In the context of identity management, both processes are important for establishing the identity of individuals and for checking the authenticity of the associated ID documents. The findings from both processes serve as a basis for decision-making, e.g. to grant access or to carry out transactions. The risk of identity fraud can be minimised with suitable technology(special scanners and software for checking ID documents).
