Biometric verification

Biometric verification confirms that a person is present and matches a previously enrolled biometric, such as a face, fingerprint or voiceprint. It compares measurable physical or behavioral traits rather than relying only on passwords or identity documents.

In identity verification, biometric verification is commonly used to confirm that the person completing a check is the same person linked to an account, credential or identity record. Facial verification is the most common remote use case, typically through a selfie or short video.

A system extracts distinctive features from a biometric sample and compares them with a stored reference, often called a biometric template. The process produces a similarity score that is evaluated against a configured threshold, rather than making a perfect one-to-one match.

How it works

• Capture: The user provides a selfie, video, fingerprint, voice sample or other biometric signal.
• Quality checks: Software assesses whether the sample is usable, for example whether a face is visible and adequately lit.
• Liveness detection: The service checks for signs that the sample comes from a live person rather than a photo, recording, mask or synthetic media.
• Comparison: The system compares the new sample with an enrolled template, or, in document-based flows, with the portrait on an identity document.
• Decision: The service accepts, rejects or sends the result for review based on its confidence score and risk rules.

Verification versus identification

Biometric verification is generally a one-to-one comparison: it asks whether a person matches a specific claimed identity or enrolled record. Biometric identification is a one-to-many search: it attempts to find a person within a database of possible matches. Identification usually creates greater privacy, accuracy and governance concerns because it can be used to identify people without first knowing who they claim to be.

Accuracy, privacy and compliance

Performance can vary by sensor quality, lighting, camera angle, accessibility needs and demographic factors. Organizations should test for false accepts, where an incorrect person is accepted, and false rejects, where a legitimate person is denied. Higher security thresholds can reduce false accepts but may increase false rejects.

Biometric data is sensitive because a person cannot readily change their face or fingerprint after a compromise. In the EU, biometric data used to uniquely identify a person is a special category of personal data under the General Data Protection Regulation. US requirements vary by state and sector, with some state laws imposing notice, consent, retention and security obligations. Providers should use clear notices, appropriate consent where required, data minimization, retention limits and secure template storage.