Welcome to
The Hive
At The Hive, we bring together a dynamic community of HR leaders, compliance experts, technologists, and thinkers who care about getting identity, hiring, and trust right.
Expect practical insights, bold ideas, and real-world stories from across the employment and identity landscape. Not just from ZipID, but from people like you. Because when we swarm together, we build smarter.
Identity Verification Done Right: 9 Questions to Ask | ZipID
A background check confirms records, not the person. Nine questions to ask any identity verification provider on accuracy, security, privacy, and retention.
Our PBSA 2026 session ran 45minutes. This post and the free primer that goes with it cover what we couldnot: what identity verification checks, where it belongs in hiring, and ninequestions to ask before you trust any provider with your applicants' IDs. Authors: Janice Kephart, ZipID, Inc., with Chuck Salvia,Salvia Consulting
Identity Verification Done Right: 9 Questions to Ask Any Provider
Every hiring decision rests onone question that most screening workflows never actually answer: how do weknow the person is who they claim to be?
At the PBSA 2026 AnnualConference in Arlington, Chuck Salvia of Salvia Consulting and I presented"Identity Verification Done Right: Reducing Fraud Without Friction."Forty-five minutes was not enough. So we wrote a primer that goes further than the live session could, with expanded data, more of the fraud research from myPBSA Mid-Year session, and a full set of questions to ask any provider. Download the free primer (PDF). Here is the short version.
Why isn't a background check enough?
A background check confirms that records exist for an identity. It does not confirm that the person presenting that identity is its rightful owner. That gap is now being used at scale:
• Gartner projects that about 1 in 4 job candidate profiles worldwide could be fake by 2028.
• Pindrop, a deepfake detection company, found signs of fraud in 1 in 6 of its own remote applicants.
• Entrust's 2026 Identity Fraud Report puts fraudulent driver's licenses at 37% of U.S. ID fraud, with digital forgeries now at 35% of document fraud.
• DOJ indictments describe North Korean IT workers infiltrating roughly 300 U.S. companies using at least 160 stolen U.S.identities.
• E-Verify does not close the gap. At Glenn ValleyFoods, a decade-long E-Verify user, a 2025 ICE action detained 76 workers, about 70 of them using stolen SSNs and fake identities. E-Verify checks dataagainst federal records. It does not authenticate the document or match a face.
What does identity verification actually check?
Identity verification is not a records search. It is a live test of the person and the document, in three parts:
1. Document authentication. Is the ID genuine and unaltered?
2. Liveness. Is a real person, and a real document, physically present, rather than a screen, a photocopy, or an injected deepfake?
3. Face match. Is that live person the one pictured on the ID?
Fraud in any one of the three is identity fraud, and none of it shows up in a records check. Verifying the ID first also means the name and date of birth on the verified document, not what the applicant typed, drive every search that follows. And it pairs naturally with direct-source validation of the SSN, which Chuck covers in the primer.
Where should identity verification happen?
On the Form I-9. Every employer already completes one for every hire, and federal regulation already requires the employer to determine that documents reasonably appear to be genuine and relate to the person presenting them. Most employers have no reliable way to do that by eye. Building document authentication, liveness, and face match into the I-9 turns an obligation employers already carry into the strongest trust signal in the hiring process. For screeners, it is an employer obligation rather than a consumer report, which is how identity verification can complete a background check without adding a new FCRA question. Confirm how that applies to your program with your own counsel.
What should you ask an identity verification provider?
At the conference we presented four questions on accuracy. September's breaches made clear that accuracy is only half the test. IDScan.net, an identity verification vendor, confirmed a breach after more than 153 million driver's license records linked to it were offered for sale. The same month, the Department of War and the FBI each disclosed breaches of personnel or applicant data. A provider that collects ID images, selfies, and SSNs is holding the most valuable data in your workflow. Ask:
Accuracy and testing
1. Are you NIST tested? Being tested is not the same as performing well. Ask for the specific submission and where it ranks.
2. Whose algorithm is it? Most platforms license someone else's, and some license lower-cost engines that rank well down theNIST results. Ask whose, which version, and when it was last updated. A vendorthat will not name its engine is telling you something.
3. What are the published error rates? Ask for false match and false non-match rates at the threshold they actually run, and how performance varies across demographic groups.
4. What happens when it goes wrong? A false match passes a fraudulent hire. A false non-match can block a lawful worker. Ask how failures get human review.
5. How is liveness tested? Ask for independent presentation attack detection results and what the platform does about injected deepfakes.
Security, privacy, and retention
6. What independent security attestations do you hold?Ask for a current SOC 2 Type II report or ISO/IEC 27001 certificate, and whether ID images and biometric data are encrypted and segregated by customer.
7. If you were breached tomorrow, what would an attacker get? Ask exactly what is stored, where, and who can access it.
8. How do you limit collection and use? Ask about consent, data resale, model training on your applicants' images, and state biometric privacy laws.
9. How long do you keep it, and who decides? Data that is not kept cannot be breached. Ask whether you can set retention to match your clients' own records schedule, and whether deletion is automatic and certified.
If a provider cannot name a test, a number, a certification, and a deletion date, that is your answer.
For more on why algorithm rankings matter, see [link: Why NIST Rankings for Biometric Accuracy Are theMost Important Thing an Employer Has Never Heard Of].
Get the full primer
The free primer, IdentityVerification Done Right: A Primer for Background Screeners, goes deeper onevery point here: the full fraud data, the three layers of verification including SSA and IRS direct-source validation from Chuck Salvia, and the complete provider questions with what to listen for in the answers. Download the primer (PDF).
Want to see what identityverification inside the I-9 looks like in practice? Book a conversation here.
Janice Kephart is Founder and CEO of ZipID, Inc., a biometric Form I-9 compliance and identity verification platform, and served as Border Counsel to the 9/11 Commission.
Chuck Salvia is Founder and Owner of Salvia Consulting, providing IRS IVES andSSA CBSV verification services.
This post is for educational purposes only and is not legal advice.
Frequently Asked Questions
Is ZipID ICE-compliant I-9 software?
ZipID is designed to satisfy all five federal electronic I-9 system requirements under 8 CFR § 274a.2 — including compliant audit trails, electronic signature protocols, and secure storage standards. It is specifically designed to meet the March 2026 ICE reclassification that elevated common errors to substantive violations.
As of January 2025, I-9 paperwork violations carry fines of $288 to $2,861 per form under 8 CFR § 274a.10(b)(2). Knowingly hiring unauthorized workers carries fines up to $28,619 per worker for repeat offenses. ICE audit rates in 2025 ran at least ten times higher than the prior year.
ZipID is a certified E-Verify Web Services Provider. When the employer signs the I-9, ZipID automatically creates the E-Verify case from within the I-9 workflow and records the result in the "Additional Information" box in Section 2 of the I-9.
What is NIST and why does it matter for I-9 verification?
NIST — the National Institute of Standards and Technology — is the federal agency that sets accuracy benchmarks for biometric identity technologies. For I-9 compliance, NIST validation matters because it provides an independent government-verified measure of whether a facial recognition system is reliable enough to trust. ZipID uses NIST-tested algorithms rated at 99.998% accuracy.
ZipID's 1:1 facial recognition is rated at 99.998% accuracy using NIST-validated algorithms — fewer than 2 mismatches per 100,000 verifications. Liveness detection is built in to confirm the selfie is from a real, present person rather than a photo or deepfake.
OCR — Optical Character Recognition — reads and extracts text from government-issued IDs. ZipID uses AI-powered OCR to instantly capture a new hire's ID data and automatically populate the required Form I-9 fields, eliminating manual entry and typos. The new hire confirms the extracted data before it populates the form.
ZipID uses NIST-validated biometric facial recognition to match a live selfie to the photo on the new hire's government-issued ID. AI-powered OCR extracts and autofills document data. Liveness detection and synthetic image screening run on the selfie capture, confirming a real, present person rather than a photo, replay, or deepfake. E-Verify adds further checks, including Social Security number matching, photo matching for U.S. passports and other select documents, and driver's license data matching in participating states.
Facial authentication is entirely the employer's choice. It confirms that the new hire is who they say they are and that the ID they present matches their live self — especially valuable for remote hires, high-security roles, or industries with elevated identity fraud risk.
How long does it take to complete an I-9 with ZipID?
ZipID completes the entire Form I-9 process — including identity verification, document capture, and E-Verify automation within the ZipID workflow — in under 8 minutes, for both remote and in-person new hires.
ZipID is an I-9 compliance and identity verification platform that combines biometric facial recognition, liveness detection, OCR document capture, and E-Verify to verify new hire identities and complete Form I-9 in under 8 minutes, with an audit trail designed to meet federal electronic I-9 requirements. It is the only I-9 platform built by the person who helped write the federal identity doctrine behind the law.
Who built ZipID?
ZipID was founded by Janice Kephart, former counsel to the 9/11 Commission and a national security identity expert with 25 years of federal and private sector experience, including designing border biometric workflows at MorphoTrak, now Idemia. Kephart authored the federal identity doctrine and biometric entry-exit recommendations underlying today's I-9 compliance framework, and has testified before Congress 19 times.