2

Whats the best way to get people to verify their identity for the purpose of preventing fake accounts on a social site.

For example, Zoosk does the following:

Members who choose to verify their photo will be prompted by the system to record and submit a video “selfie” that will capture the individual’s face from a variety of angles. If the moderators approve the member’s photo, he or she will be notified and a Photo Verified badge will be added to their profile.

However I'm interested to know if there's a clever way to do this without human intervention (aside from using Amazon Turk service or the like, I mean fully automated)

  • I think the idea with photos remains attractive because almost everyone has a camera. Who knows, maybe fingerprint identity sensors will be the way to solve this problem in the future (store.apple.com/us/question/answers/iphone/…) – Willem Feb 14 '15 at 7:08
  • 2
    Zoosk is a dating site. The motivation for a fake profile on a dating site is different than on a social site. On a social site, there are many more types of fake accounts, and some are just a result of the bad UI in the first place. Socially, people can have different personas, with different levels of disclosure, to their family or their friends. And some will create fake accounts for the purpose of multiplayer games. The worst are the ones that will create fake accounts on a massive scale, with scripts and automation. The question is. Which types of fake accounts are you trying to prevent? – Stephan Branczyk Feb 14 '15 at 8:37
  • Possibly you could explain what the problem is with users 'faking it' in the first place ? – PhillipW Feb 14 '15 at 13:39
6
+50

There are a variety of ways to verify a person on a site, and almost none of them are foolproof.
For example, the Zoosk method can be circumvented because a user could simply submit someone else's photos for approval.

So the real question is, what level of verification is suitable the specific needs of your site? Here are some design questions to as yourself:

  1. Am I willing to pay the cost of higher verification? More verification means more burden for users (submitting evidence, photographs, additional information, captchas, etc). Studies have proven this will turn off users and cause abandonment / no signups. So the more you verify, the more users you may annoy / abandon the site.

  2. Do I need to prevent spam accounts, or verify the identify of a person?. There is a big difference. To prevent spam accounts, it's often enough just to verify that a user is human. You don't need to verify their identity. For example, a captcha is an automatic attempt to verify that a user is human. It doesn't verify the identity of the user. The Zoosk approach also verifies that the user is human, rather than that person's specific identity.

With that in mind, here are various approaches to verifying human vs identity. The choice for your site will depend on how you decide to weigh the tradeoffs in #1 vs #2 above.

Ways to verify that a user is human

  • Use captcha or recpatcha
  • Ask for a mobile phone number and send an SMS code to the phone.
  • Ask for a credit card number.
  • Ask the user to pay a small fee for an account (i.e. provide economic dissuasion for fake accounts)

Ways to verify user's identity

  • Piggyback off a social site's verification system (e.g. require user to log in through Facebook and/or LinkedIn)
  • Ask user for their social security number (this can be automated)
  • Ask for a copy of their driver's license, passport or a recent utilities bill that shows their name (this will be labor intensive)
  • Ask for a notarized copy of their passport or birth certificate, or a public notary identity form.

Obviously all these approaches involved different levels of automation and also vastly different levels of inconvenience to the user. Only you can decide what the ideal tradeoff between inconvenience and accuracy is for your site.

I would not try to "reinvent the wheel" here. Sites like Facebook, LinkedIn, and dating sites have spent a lot of time thinking about verification and spam, so study them carefully to understand why they made the choices they did. Unless your site has unusually high need for verification, I suspect that an existing approach will be suitable for you....but only you can answer that question.

3

Create hurdles not barriers

Aside from highly intrusive methods, any type of verification is subvertable. You can ensure that you get real people creating accounts. You can give them hoops to jump through to make sure they have some level of commitment. But you don't want to make them feel like they're applying for a passport.

Here's a few basic solutions:

  • Email verification: Don't let them access anything until the address is verified.
  • SMS PIN: Require a mobile number to which you send a randomized PIN they'll use to log in the first time.
  • Open ID log in: Require the use of another account to create this one (e.g. Facebook). No assurances, but it's another hoop.

Disclaimer

Any kind of ID verification is intrusive. Be sure you analyze your audience well before deploying a solution. You have to find the right balance of answering security concerns for your app and using a method that feels like a worthwhile exchange to your users.

1

You could verify their credit card number, just let them know that it's for verification only and nothing will be billed.

What is the best way to validate a credit card in PHP?

  • Unfortunately this seems to be not possible. stackoverflow.com/a/7759365/1267778 The link you posted is to verify whether its a valid CC number, but that wouldnt verify the identity. – parliament Feb 14 '15 at 6:50
  • 1
    @parliament, Zoosk doesn't verify identity. It verifies appearance (which can be especially important on a dating web site). It verifies that you still look as slim and as young as your posted picture, or that you didn't use the picture from someone else, it doesn't actually verify your name, or anything of the sort. – Stephan Branczyk Feb 14 '15 at 8:43
  • @parliament You are right, but if you want to prevent fake accounts it would be another step to minimise them. If you want a fully automated process, I think you will need to put up some roadblocks that together prevent enough fake accounts for you to be acceptable, as plainclothes said. – Martin Mühl Feb 15 '15 at 16:55
0

you can use an external service like Yoti that handles verification for you, it handles

  1. Identity Verification
  2. Age Verification
  3. E-signing
  4. Authentication

check out this blog post for more info on how it works https://www.zdnet.com/article/yoti-aims-to-provide-everyone-with-a-biometric-digital-identity-that-works-via-a-smartphone-app/

  • 2
    This answer is pretty thin. Could you describe how that service would help? What does it do and what does it not do? – Ken Mohnkern Aug 12 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.