How to Verify Someone's Identity UK: A Practical Guide
- Sentry Private Investigators
- 19 hours ago
- 11 min read
You've agreed to rent out a property, hire a new member of staff, or enter a business relationship, and the documents in front of you appear genuine. The name matches, the photograph looks right, and the person seems convincing. That still leaves an important question: are you dealing with the person themselves, and does the wider evidence support what they've told you?
Knowing how to verify someone's identity in the UK means going beyond a quick glance at a passport. A sound process combines document checks, address and activity evidence, company-register research where relevant, behavioural indicators, and proportionate follow-up. In sensitive cases, a professional investigator can help establish whether an identity is genuine, current, and connected to the person presenting it.
Why Identity Verification Matters More Than Ever
A landlord may receive an application from someone who provides a passport, pays a deposit, and appears ready to move in. An employer may onboard a candidate whose documents pass an initial inspection. A business owner may speak with a proposed supplier whose director appears on the public register. In each situation, the immediate temptation is to treat a valid document as the end of the exercise.
That approach is risky. Identity verification confirms who a person says they are. It doesn't automatically confirm their intentions, history, financial reliability, or connection to the address and accounts they provide. A genuine document can be lost, misused, obtained through deception, or presented by somebody who has built a convincing profile around another person's details.
The scale of the problem is reflected in Cifas identity fraud data. Cifas recorded more than 242,000 identity fraud cases in the UK in 2025, representing 54% of all fraud-risk filings. In the first half of that year alone, it reported more than 118,000 identity fraud cases and highlighted AI-enabled synthetic identities and fabricated profiles as developing methods used to bypass security checks.
The real-world consequences
For a landlord, a mistaken identity can create problems with rent recovery, possession proceedings, property damage, or locating a tenant who disappears. In employment, an inaccurate identity can affect right-to-work compliance, safeguarding, access to systems, and internal fraud risk. In a cohabitation dispute, the issue may be whether a partner has been truthful about their address, employment, finances, or relationship with another person.
Businesses face a similar problem when checking a director, beneficial owner, supplier, or prospective partner. A company may exist on the register while the person behind the relationship remains difficult to verify independently.
Practical rule: Treat a document as one piece of evidence, not as a complete character assessment.
The UK is responding by making identity checks part of formal infrastructure. Companies House introduced compulsory identity verification for directors and people with significant control on 18 November 2025, and began publishing quarterly compliance data tracking the number and percentage of appointments meeting the requirements by 30 June 2026. The Companies House identity-verification statistics show how a process once treated as optional due diligence has become measurable corporate compliance.
Identity verification is also operating at national scale through public services. Between 1 August 2023 and 26 March 2024, users successfully verified their identity 1,843,615 times through the GOV.UK ID Check App, 53,801 times through the browser security-question route, and 8,556 times in person at Post Office branches, as recorded in the parliamentary answer on electronic government proof of identity. Even email-based processes depend on trustworthy contact details, so organisations may also benefit from understanding bulk email verification security when checking whether digital contact information is usable and associated with a genuine person.
Understanding the UK Identity Proofing Framework
A sensible UK identity-proofing process starts by deciding how much confidence the situation requires. A low-risk newsletter registration doesn't call for the same evidence as a tenancy, regulated employment role, corporate acquisition, or dispute involving suspected deception. The higher the potential harm, the more independent evidence you should require.
The government's GPG 45 identity-checking guidance provides a structured approach. It involves selecting the required assurance level, gathering evidence across different pillars, comparing the person with the documents, and retaining records of the documents used to validate the identity for at least 2 years.
Four evidence pillars
Document evidence establishes the starting point. This may include a passport, driving licence, immigration document, birth certificate, or another recognised source. The check should consider authenticity, integrity, expiry, and whether the document belongs to the person presenting it.
Activity evidence asks whether the identity has a credible history of use. Names, contact details, accounts, and transactions should form a coherent pattern rather than appearing suddenly for one application. Activity evidence can be particularly useful where a person presents a real document but offers little supporting history.
Address evidence connects the person to a location. Look for consistency between the stated address, correspondence, electoral or public records where lawfully available, employment information, and the circumstances of the application. An address mismatch isn't proof of fraud, but an unexplained mismatch deserves attention.
History evidence looks at the person's wider identity trail. Changes of name, previous addresses, company appointments, linked telephone numbers, and other relevant records can help identify omissions or inconsistencies. The appropriate depth depends on the purpose of the check and the legal basis for processing the information.
Compare the person, not just the paper
The final comparison matters. Check the applicant's likeness against the source photograph, compare declared details such as name and date of birth, and consider whether the answers given during the process fit the documents and supporting evidence. GPG 45 is useful because it turns identity verification into a reasoned assessment rather than a binary tick box.
Keep a clear audit trail. Record what you checked, which documents you relied on, what discrepancies arose, how you resolved them, and why you accepted or rejected the identity. Do not collect information just because it might be interesting. Collect what is relevant, necessary, and proportionate to the decision you're making.
Checking Identity Documents Correctly
The Home Office right-to-work procedure is a strong practical benchmark because it sets out how an employer should inspect documents, compare the holder with the evidence, and record the result. The Home Office employer guidance says to inspect original documents in the holder's presence, confirm they're genuine and unchanged, check that they belong to the individual, and compare photographs and dates of birth.
For a standard check, ask to see the applicant's original documents while they're present. Make copies, record the date of the check, and retain the record in line with the applicable requirements. Biometric residence cards and permits can no longer be accepted for this purpose, so some applicants must use the online immigration-status route and provide a share code instead. The government's right-to-work checking service explains the current process.
Use the correct route
Digital verification through an IDVT provider has a narrow document rule. The Home Office checklist says the route accepts only:
Valid British passports: These can be used for digital identity verification where the document meets the relevant requirements.
Valid Irish passports: A valid Irish passport is accepted through the digital route.
Valid Irish passport cards: A valid Irish passport card is also accepted.
That isn't a general list of every document that proves identity or work status. It applies to digital identity verification through an IDVT provider. Using an unsupported document can invalidate the process even if the document looks official.
The rules for expired documents also differ by document type. An expired driving licence may only be accepted where it expired within the last 90 days, according to the Home Office right-to-work guidance. For a passport or passport card used to create digital identity for a right-to-work check, the supplementary digital-check code allows expiry within the previous six months, provided the document remains acceptable under GPG 45 and isn't visibly clipped.
Document comparison table
Verification Route | Acceptable Documents | Key Rules |
|---|---|---|
Standard right-to-work check | Original acceptable documents presented by the applicant | Inspect originals with the person present, check authenticity and ownership, copy the documents, and record the check date. |
Digital IDVT right-to-work check | Valid British passport, valid Irish passport, or valid Irish passport card | These are the permitted document types for this digital route. |
Online immigration-status route | Current immigration status checked using a share code | Use the Home Office online service where the applicant's status is held digitally. |
Alternative evidence route | UK or Irish birth or adoption certificate, or British registration or naturalisation certificate, with an official supporting letter or document | The supporting evidence must come from a previous employer or government agency. Citizens Advice notes that the two-document route includes evidence showing the person's name and National Insurance number, such as a DWP letter or P45. |
Compare the face, name, date of birth, document number, and consistency between documents. If something feels wrong, pause rather than accepting a rushed explanation. For a wider review of identity, employment, and personal history, arrange professional background checks rather than treating right-to-work compliance as a complete background investigation.
Verifying Company Directors and Officers
A company search answers an important question, but only one question. It can show whether a company is registered and identify its directors or people with significant control. It doesn't, by itself, prove that the person contacting you is the registered individual, that the company operates as described, or that the proposed transaction is safe.
Companies House made compulsory identity verification for all directors and PSCs effective on 18 November 2025. By 30 June 2026, Companies House was publishing quarterly compliance data tracking both the number and percentage of director and PSC appointments that complied with the requirements, as set out in its official identity-verification management information.
Cross-check the corporate identity
Start with the public register, then compare it with the information supplied directly by the officer. Check the company name, registered office, incorporation details, director names, PSC information, filing history, and the role the individual claims to hold. The person's email domain, telephone number, website details, invoices, and bank information should also make sense in relation to the registered business.
The new Companies House process strengthens the formal identity layer, but it shouldn't replace wider due diligence. A verified identity can still be connected to a dormant business, an unsuitable supplier, a disputed transaction, or a company whose commercial claims don't withstand scrutiny.
A verified officer is not the same thing as a verified business relationship.
Build an evidence trail
For a supplier or partner, ask who owns the business, where it operates, who is authorised to sign, and which account should receive payment. Confirm sensitive changes through an independently sourced contact channel, not only the telephone number or email address in a message requesting funds.
The UK digital identity sector now supports this wider environment. Official analysis estimated 275 firms were providing digital identity products and services in the UK as of January 2026, with annual sector revenue of £2,027 million in 2024/25 and an estimated 9,624 FTE jobs, according to the same government sector analysis. It also reported that 75% of providers were involved in identity or attribute verification, while document verification and biometrics or liveness detection were used by 60% and 57% of providers respectively.
Those figures show that digital verification is established infrastructure, not a novelty. They don't remove the need for human judgement, independent records, and investigation where consequences are significant. Businesses considering a new director, supplier, acquisition, or investor can use the due diligence guide by Sentry Private Investigators to structure the wider review.
When Valid Documents Are Not Enough
A passport can be genuine and the person holding it can still be unsuitable for the arrangement you're considering. That distinction matters in tenancy screening, employee vetting, cohabitation disputes, and debtor tracing, where the risk often concerns behaviour, concealment, or future reliability rather than simple impersonation.
Cifas reported more than 118,000 identity fraud cases during the first half of 2025 and described synthetic identities and fabricated profiles as growing methods for bypassing security checks. Its full-year figures recorded nearly 444,000 total fraud filings in 2025. The lesson is straightforward: a document check may establish that data exists, but it may not establish that the applicant has a consistent, trustworthy, and current relationship with that identity.
Layer the checks around the risk
A stronger assessment tests whether separate sources support the same story.
Address history: Compare the current address with the person's stated history and relevant lawful records. Frequent unexplained changes, an address linked to unrelated applicants, or refusal to explain a mismatch should prompt further questions.
Behavioural consistency: Notice whether the person changes key details, avoids normal verification steps, pressures you to decide quickly, or provides answers that shift between conversations.
Device and contact signals: In a digital process, unusual access patterns, inconsistent locations, disposable contact details, or several applications linked to the same device may justify escalation. These signals indicate risk, not guilt.
Adverse information: Search relevant public and lawful sources for litigation, insolvency, regulatory action, fraud allegations, or other material issues. Check that any apparent match is the same person.
Post-verification monitoring: In higher-risk arrangements, review important changes after onboarding. A new address, altered payment details, unexplained account activity, or sudden disappearance can matter as much as the original check.
The best combination depends on the decision. A landlord may need address and tenancy history. An employer may need right-to-work evidence, references, and role-specific safeguarding checks. Someone tracing a debtor may need to establish current contactability rather than just confirm an old name.
Avoid false confidence
Automated tools can scan documents and compare faces quickly, but they can produce false positives and false negatives. A selfie match isn't a substitute for checking context, and a failed automated check doesn't automatically prove deception. Human review becomes important when the person has changed their name, lived abroad, lacks conventional records, or has a legitimate reason for an unusual document history.
For a difficult address or identity problem, UK tracing agents can combine lawful database research with further enquiries and, where appropriate, field verification. The objective isn't to collect everything available. It's to answer a defined question using proportionate evidence.
Red Flags and When to Seek Professional Help
Most identity concerns begin with a small inconsistency. The applicant's name is slightly different across documents, the phone number belongs to somebody else, the address doesn't fit the timeline, or the person becomes unusually defensive when asked for routine evidence. One discrepancy may have an innocent explanation. Several unexplained discrepancies require a controlled response.
A practical escalation checklist
Document irregularities: Look for altered text, damaged security features, inconsistent fonts, unusual cropping, or a photograph that doesn't resemble the holder.
Unstable personal details: Compare names, dates of birth, addresses, employment details, and contact information across the documents and application.
Pressure to skip steps: Be cautious when someone insists on immediate payment, refuses an in-person or approved digital route, or tries to dictate which evidence you may inspect.
Unusual contact patterns: Disposable email addresses, recently created profiles, multiple unrelated contacts, or communication that moves rapidly between platforms can weaken confidence.
Corporate inconsistencies: Check whether the claimed director, registered office, website, invoice details, and payment account belong to the same business relationship.
Post-check changes: Treat sudden changes to bank details, address, telephone number, or availability as a reason to reassess rather than relying on the original approval.
Stay within lawful boundaries
Only obtain information you have a proper reason to use. Explain the purpose of the check, limit collection to what is relevant, protect records from unauthorised access, and set a retention approach that matches the legal and operational need. Don't access private accounts, impersonate another person, obtain protected data through deception, or conduct surveillance without considering privacy and legal restrictions.
DIY checks often fall short when the subject won't cooperate, the matter involves a dispute, the person may be deliberately concealing their location, or the result could affect litigation, employment, housing, or substantial finances. Professional investigators can help with lawful background research, people tracing, surveillance, and technical surveillance countermeasures, while maintaining a documented rationale for the work.
Sentry Private Investigators Ltd provides discreet investigative services for private clients and businesses, including identity-focused background checks, people tracing, surveillance, and corporate due diligence across the UK. Its head office is in Birmingham, with coverage extending through the West Midlands and locations including London, Manchester, Leicester, Coventry, Wolverhampton, Worcester, Nottingham, Northampton, and other UK areas.
If you need to verify an applicant, tenant, employee, company officer, former partner, or debtor, contact Sentry Private Investigators Ltd to discuss the specific risk and the evidence you need. The team can design a confidential, lawful investigation that goes beyond a document check and gives you a clearer basis for your next decision.