An identity is a set of claims
In everyday life, people recognize each other by face, voice and shared history. Online, none of that is directly visible. A digital identity is a collection of information that represents a person, organization or device in a system: a name, an email address, an account number, a history of activity and sometimes official details. The system relies on that information, and on checks of it, to decide who it is dealing with.
Three questions are worth keeping apart:
- Identification: who does this person claim to be?
- Verification (or identity proofing): is that claim actually true, for example does this name match a real person?
- Authentication: is the person using the account now the same one who set it up?
Many confusing situations come from mixing these up. A password proves, at best, that someone knows the password. It does not prove who they are.
How identity gets established
Self-asserted identity
On many services a person simply types a name and an email address. Nothing is checked beyond whether the email works. This is easy and keeps barriers low, but anyone can claim any name, and a person can create many accounts.
Document-based checks
Some services, such as financial or regulated ones, ask for an official identity document and a photo of the person, then compare them, sometimes with the help of computer vision. This increases confidence but is not foolproof. Documents can be forged, and automated comparisons can make errors. Collecting such documents also creates sensitive personal data that must be stored carefully.
Database and third-party checks
A service may check details against records held by other organizations, such as a bank, a telecom provider or a government registry, where that is permitted. The strength of the check depends on how reliable and current those records are.
Federated and reusable identity
Rather than every site checking people itself, one provider can confirm identity and vouch for it to others. Single sign-on is a familiar example: a person signs in once with an existing account and other services accept that result. Some countries and organizations also offer government-backed or bank-backed digital identity schemes. These can simplify things but concentrate trust in the provider, and designs differ widely.
Verifiable credentials
A newer approach is for an issuer, such as a university or employer, to give a person a digitally signed statement, often stored in a wallet app. The person can then show it to others, who can check the signature without contacting the issuer each time. Some designs let a person reveal only the needed fact, such as being over a certain age, without handing over a full document. These ideas are still developing, and approaches vary by region.
Proving it is still the same person
Once an account exists, authentication keeps it tied to its owner. Common factors are something you know (a password), something you have (a phone or security key) and something you are (a fingerprint or face). Combining them through multi-factor authentication generally makes account takeover harder. Passkey sign-in replaces passwords with cryptographic keys held on a device, and biometric authentication uses physical traits. Each has weaknesses: biometrics cannot be changed if exposed, and phones can be lost.
Organizations manage who can do what inside their systems through identity and access management, a separate topic from the public-facing question of knowing who is online.
Why verification is hard
- Fake and borrowed identities. People can use stolen details or create accounts that imitate someone else. Impersonation is a common starting point for social engineering and phishing scams.
- Automated and fake accounts. Software can create accounts in bulk, which is why some services add checks to separate people from bots.
- New forgery tools. Generative AI can produce convincing faces, voices and documents, making some older checks less reliable. Services respond by adding checks, and the situation keeps shifting.
- Different needs. A discussion forum, a bank and a government service need very different levels of certainty.
Trade-offs: privacy, safety and access
Stronger verification can reduce fraud and impersonation, but it has costs. Requiring real names or documents can put at risk people who rely on anonymity or pseudonyms, such as whistleblowers, abuse survivors or people in places where speech is restricted. Verification also builds databases that could be breached or misused, and it can exclude people who lack official papers, which touches on the digital divide. Choices about how much to collect link to ideas such as data minimization.
Verified-account badges are another form of signal. Depending on the service, a badge may mean that an identity was checked, that a fee was paid or that an account is notable, and the meaning can change over time. A badge alone is therefore a modest guide to trustworthiness, and it says little about whether what an account posts is accurate.
Practical habits
- Treat an unexpected message claiming to come from a known person or organization with caution, and confirm through a separate, trusted channel.
- Use unique passwords and enable stronger sign-in options where offered.
- Share identity documents only with services that clearly need them and explain how they are stored.
- Remember that a profile photo, a follower count and a confident tone are not proof of identity.
Rules about digital identity differ by place and sector, so organizations should consult qualified professionals about their obligations.