How to Verify Someone's Identity Online

In August 2026, a renter in San Francisco posted on r/Scams about losing $18,600 to a rental scam. After the money was gone, they looked up the real owner and found that "it actually is the name the scammer spoofed it with. So even had I looked up the records, it would have still matched with the name I was given".

How to verify someone's identity online comes down to two checks: that a real identity exists, through a record, license, ID, or live face, and that the person messaging you controls it, through contact details you found yourself. Imposters often pass the first by borrowing a real one, and the FTC logged more than 1 million imposter reports in 2025.

That gap is where they work, and it is expensive. The FTC's March 2026 testimony to Congress put reported imposter losses for 2025 at more than $3.5 billion.

Why do identity checks miss impersonation scams?

Impersonation scams slip past identity checks because the imposter borrows a real identity, so every record you pull points to a real person. In San Francisco, every record would have pointed to the real owner, and none would have tested the email address that handled the lease and the wire.

The scammer never had to show up, because the real owner did the showing. They posted a fake Craigslist listing for a real apartment and sent the renter to the owner's own open house. Then they ran the lease and the wire from an email signed in the owner's name. In the renter's words, "The apartment was real and vacant, and the person showing it was the actual owner. His name matched the one in the email signature".

One clue did surface before the money moved. The lease listed the owner and "an additional new name", which the renter took for a relative or business partner. That second name was the one on the wire, and according to the renter, Bank of America later closed the recovery claim as unsuccessful.

The renter worked out the missing step too late: "what would have prevented this is if I had confirmed/verified contact info with the real owner at the open house". Identity standards call that step verification, and NIST's digital identity guidelines define it as assurance "that the applicant presenting the evidence is the rightful owner of that evidence".

Which online identity checks can a scammer pass?

Most free checks fail the same way. They confirm that a real person, record, or document exists and stop there, so a borrowed identity passes. Each one feels reassuring because what it proves is true, which is why none of them alone can verify someone is who they say they are.

Every entry in the Doesn't prove column needs an answer through contact details you found yourself, not ones the person you are checking supplied.

ID photos show how far that goes. In one r/Scams thread, a user whose dating match had sent photos of her passport and US visa compared them with images online and judged that "they look real". The passport photo even matched her profile pictures. A reply explained why: scammers send "someone else's real stolen documents". Stolen documents are only one supply line, since a December 2024 FBI warning says criminals now use AI to generate fake IDs, driver's licenses included.

Phone numbers and email addresses are cheaper still to borrow. The FCC defines caller ID spoofing as a caller who "deliberately falsifies the information transmitted to your caller ID display" to hide who they are. For email, the FBI's September 2024 advice is to check that the sender's address matches who the email claims to be from. That catches a misspelled domain, and a new free account set up in the owner's name sails through it.

Live checks are harder to borrow, which is why a video call feels decisive. Deepfakes aside, an undoctored call still leaves the name and the story up to whoever is on camera. One romance scam victim's scammer hid behind a stock photo and an alias, yet still video chatted. As the victim put it, "He was real, but none of it was true".

How to verify someone's identity online, step by step

Five steps close those gaps: find the record yourself, contact its holder at details you found, ask for something live, use a trusted platform's check, and pay last by a protected method. The San Francisco renter skipped the first two.

1. Find the record yourself: Use the county assessor, the state licensing board, or the company's own website. Never start from a link, screenshot, or phone number the other person supplied, because anything they hand you can be staged. For a dating match, the record might be a workplace's staff page or a mutual friend you can reach yourself.
2. Contact the record's holder through a number or address you looked up: Call the number on the board's record, or ask the owner in person whether the email you have been using is theirs. The FCC gives the same advice about anyone who calls claiming to represent a company: hang up and call the number on its own website. A matching ID proves who is standing in front of you and says nothing about who has been writing to you, so ask about the email and phone number.
3. Ask for something live and unpredictable: A request they could not have prepared for, made on a video call you place, is harder to fake than a photo or document they send. No live test is proof against a deepfake, though. Identity verification software meets the same problem with liveness detection.
4. Let a trusted platform check when the stakes are high: A dating app's own face check or a marketplace's built-in checkout moves the judgment away from whatever the other person chooses to show you. A rental or a contractor rarely comes with one, so there, steps one and two carry the load.
5. Move money last, by a method that protects you: Where you can, pay by credit card, which has legal protections, or through a platform checkout that protects buyers. Anyone who insists on payment only by Western Union or MoneyGram wire, gift cards, or cryptocurrency is running a scam, the FTC warns. If you must wire money, confirm the payee's name and account with the owner through the details from step two. The receiving bank can pay the account number without checking that the name matches, so that confirmation call protects you more than the name on the wire form does.

Scale the effort to the stakes. A cash pickup in a busy parking lot needs little of this, while a rental deposit, a contractor in your home, or a weekend away with a match justifies all five.

How to verify a landlord or rental listing is real

A legitimate landlord is one you can trace from the county property record to the person taking your deposit, using contact details you dug up yourself. That trail is worth an evening, because people reported nearly 65,000 rental scams to the FTC from 2020 to mid-2025, at a median loss of $1,000. In the 12 months to June 2025, about half of those started with a fake Facebook ad and another 16% with a fake Craigslist listing.

• Look up the owner: Search the county assessor's site for the address. If the owner is an LLC, your secretary of state's business search may name the people behind it, and in California it lists managers or members and the agent for service of process. Reach the owner or manager through contact details you found that way, and confirm the unit is for rent and who is handling it.
• Search the address: Other ads for the same address under a different owner or company name are a sign of a scam, according to the FTC, and a home listed for sale is a big red flag. If it is for sale, contact the listing agent named on Zillow or Redfin.
• Check any agent: Look up the agent or property manager with your state's real estate licensing agency. California's real estate regulator warned in April 2026 that scammers appear to be borrowing real agents' names, license numbers, and photos, with look-alike websites and email addresses to match. Look the agent's number up yourself, from what the regulator calls "a genuine phone directory", and call to confirm.
• Match the person at the tour to the record: One r/Scams commenter warns that imposters "rent an Airbnb and then have you tour them pretending to be the owners".
• If you can't tour in person: Rental scammers "will not meet you in person to show the property, but they may set you up with a self-guided tour", the FTC warns, and even a video tour doesn't prove the place is real or for rent. Call the manager or listing agent at a number from the record or a directory and ask who you will be paying. Hold the deposit until the person you reached that way confirms the lease.

Asking for proof of ownership can backfire. One r/Landlord poster wrote that if a prospect asked, "I would probably view you as troublemaker and walk away." A question about contact details lands better, because any real owner can answer it on the spot. Ask it face to face at the tour, or on a call to a number from the record: Before I send anything, can you confirm this is the email and number you'll use for the lease?

For the warning signs that show up earlier, read how to avoid rental scams.

How to verify a professional's identity online

A professional's identity holds up when two things check out: the license is valid, and the person quoting you is the one it names. For the first, look the license up with your state or county licensing agency and ask for proof of insurance, as the FTC advises. For the second, California's Contractors State License Board gives advice that works in any state: ask for the pocket license and a photo ID, and make sure "the person you're dealing with is the same person on the license".

That second half matters because licenses get borrowed, or rented out, as one r/HomeImprovement commenter describes it. One r/Construction poster describes a worker who sent his father's license and his father's proof of insurance, with his own name nowhere on the license. So check that the name, business name, and address on the license match the person in front of you, and that its classification covers the job. Then call the business at the number on the board's record to confirm the person you met works there. If you're handed a certificate of insurance, confirm it with the insurer at a number you look up yourself.

The same two checks work for lawyers, nurses, doctors, and other licensed professionals, whose records sit in state bar directories or licensing board lookups.

For a recruiter, client, or other business contact, a LinkedIn verification badge tells you less than it looks. According to LinkedIn's help center, a workplace badge means the member confirmed an employer with a work email or a company-issued credential, and an identity badge means a partner checked a government ID. Neither shows that whoever is writing today is the one who verified it, so call the company's main number from its own website and ask for them by name.

How to check if someone is real online

Checking whether someone is real online starts with a reverse image search of their photos, a video call you set up, and a look at the account's history. None of that proves identity, so send no money until something you checked yourself confirms they are who they say they are, and never read anyone a verification code.

How to verify a dating match is real

By October 2025, Tinder required Face Check, a short video selfie, of all new users in seven countries and California. Its own help center still says photo verification "doesn't guarantee the identity or safety of a particular user."

So add a live check of your own, and word it as interest, the way one r/hingeapp user does: "hey I'd love to talk before our date let's FaceTime". Framed as a test, the same request can sour things. An r/catfish user who asked a match to video call to prove they were the person in the pictures got back "I'm not here to apply for a job."

The FTC's romance scam advice draws its firmest line at money: "Never send money or gifts to a sweetheart you haven't met in person." A match who pushes early to move to WhatsApp, Google Chat, or Telegram is following a pattern the FTC has flagged in romance scams. Keep the chat on the app until you have met, since the app is where you can report the profile if something feels off. Watch where the match came from, too, because many of these scams never start on a dating app at all. In an April 2026 data spotlight, nearly 60% of people who reported losing money to a romance scam in 2025 told the FTC it started on social media.

If they found you on Instagram, a profile's About this account page shows when the account joined, how many times its username has changed, and for some accounts the country it is based in. A run of username changes is worth asking about. A hijacked account keeps its join date, though, so an old account can't rule one out.

How to verify a Facebook Marketplace buyer or seller

Account age, the check many Facebook Marketplace users rely on, says little about who is selling, and scammers know it. One user explained that scammers hack years-old accounts because they "look more trustworthy vs brand new accounts". The signals Facebook's own tips tell buyers to check, such as ratings, badges like Reliable Shipper, and the date a seller joined, all come with a hijacked account. A sign closer to identity, in Facebook's scam guidance, is a seller who asks you to deal with someone other than the account's owner, such as a relative.

• If you're buying: Payment protection matters more than identity in a quick sale, and paying outside the platform's checkout gives up any protection the site offers. On Facebook, "Items exchanged in-person using cash or other person-to-person payment methods are not eligible" for Purchase Protection, so for a local pickup, inspect the item before you pay.
• If you're selling: The FTC warns about buyers who want "to verify that you're a real person" and text you a Google Voice code to read back. That code lets them open a Google Voice number linked to your phone. Don't accept a mobile payment from a stranger, and "Never deposit a check for more than the selling price."

Frequently asked questions

Is it rude to ask someone to verify their identity?

Asking for verification can feel rude when it sounds like a test, and it lands better as a standing rule of yours. One dater on r/datingoverforty tells matches "it is a general rule of mine to know a man's last name before we meet in person", while others in that thread call ID requests out of line. Ask for something light, like a last name or a short call, and offer the same in return.

Can I run a background check on someone I met online?

You can't order a regulated background report on a match or stranger out of curiosity. Consumer reports, used for tenant, employment, or credit decisions, fall under 15 U.S.C. § 1681b, which allows them only for listed purposes, such as the written instructions of the person they cover. You can still search public court dockets. People-search sites carry their own risk: in 2023 the FTC said TruthFinder and Instant Checkmate emails claimed criminal records where the record was "merely a traffic ticket".

Is it safe to send someone a photo of my ID?

An ID photo sent to someone you met online is rarely safe. The FBI advises never sharing sensitive information with people you have met only online, and an ID image is sensitive in two ways. Paired with a selfie, it covers much of what many online financial accounts ask for at sign-up, and scammers show stolen ID photos to their next targets as proof of who they are. Show it in person instead, with the address covered.

Can a deepfake pass a video call?

Deepfakes can already pass video calls, and the FBI warned in December 2024 that criminals generate AI video for real-time video chats with supposed company executives, law enforcement, and other authority figures. Treat a face on a call as one more claim to check, and confirm who they are through a number you looked up yourself. With family, the FBI suggests agreeing on a secret word or phrase.

What should I do if I already paid a scammer?

Move fast, because money sent to a scammer can sometimes be recovered. Contact whoever moved it, whether a bank, payment app, wire service, or gift card issuer, and ask them to reverse the payment or refund your money. For a bank wire, the FBI says to contact your bank immediately and "request a recall of the funds". Then report it at ReportFraud.ftc.gov and IC3.gov. If a scammer used your Social Security number, IdentityTheft.gov has a recovery plan.

Verify every contact detail before money moves

If you run a short-term rental, a property portfolio, or a marketplace, you are the trusted platform in step four. From an Authenticate business account, you can send a Medallion™ verification link, and whoever opens it completes the checks you chose, such as an ID document check, a selfie, and liveness detection. Our platform guide to identity verification shows how that fits onboarding at scale.

For everyone else, the habit is simpler. The San Francisco scam, like most here, ran on a real identity the scammer did not hold, so before money or documents move, sort every contact detail into the ones you found yourself and the ones they handed you. Treat the second group as unverified until something from the first confirms it. By the renter's own account, confirming the contact details with the real owner would have saved the $18,600.