Every check, one by one

Every file the step needs arrived, whole. At upload each one was checked by its first bytes rather than by the type it claims, and held to a size limit.

Each file is fingerprinted and compared with every file received in other sessions, for any company, until it is erased. A photo seen before goes to a reviewer. An upload, which a customer may send twice for good reason, goes when it has turned up in more than one other session. Only the count is shown, never the other session.

What the file says about itself: content credentials that declare generative AI or a screen capture, editing software named in its metadata, metadata a live capture never carries, a PDF written with a document editor or saved again after it was made.

The picture shows an identity document, and not something else.

It is a kind you accept: a passport, identity card, driving licence or residence permit. When you limit the countries, it was issued by one of them. A kind or country that cannot be told goes to a reviewer.

Every detail can be read, without glare or blur. Both sides are there when the document has two, and a passport's machine readable zone is in the picture.

The name, date of birth and document number were read with confidence. Names are kept as printed, in their own script, beside the Latin spelling when the document prints one.

When you ask for it: what was read is confirmed by a second source, either a machine readable zone whose check digits are right or details that match the ones you sent.

Code reads the zone in each of the three layouts ICAO 9303 defines, repairs letters and digits that look alike, and works out every check digit again.

The document number, date of birth, expiry date, sex and name in the zone agree with what is printed on the document.

The expiry date has not passed. When the zone is verified, its date is the one used.

What the AI can point to: printed fields that disagree with each other or with the zone, dates that cannot be true, text off its baseline or in another typeface, edges around the portrait, the word specimen, an element this kind of document should have and does not.

Visible signs that the camera saw a screen or a photocopy rather than the document: a bezel, a pixel grid, an app's interface, the edge of paper. The pattern of a screen is also measured in the picture.

It names a person and their address, and is a kind you accept: a utility, phone or internet bill, a bank statement, a letter from a government office, or a lease.

The name and the full address were read with confidence, together with the postal code, the city, the country and the issuer. A document that cannot be read at all is asked for again.

It was issued within the days you allow, ninety unless you change it. The AI reads the date the document was issued, not a due date or a billing period, in the date format of the document's country. A date in the future goes to a reviewer.

A name or address in a different typeface or size from the text around it, text that does not line up, totals that do not add up, dates that cannot be true, a logo pasted in, or a photo of a screen.

Exactly one face, sharp and large enough to compare, and nobody else in the picture.

The face is compared with the portrait on the identity document. A clear difference, or a match that is not conclusive, goes to a reviewer. A portrait too small to compare is not guessed at.

The AI scores whether the camera saw a living person, or a printed photo or a picture on a screen held up to it.

A detector for faces that were generated or swapped. It is one weak signal among several, and never decides on its own.

The pattern a camera picks up from a display's pixels, measured in the picture.

A few frames taken around the selfie should show a living face moving a little. Frames that do not change, or that show a different face, go to a reviewer.

When you ask for head turns instead of frames, the customer turns their head three times, in an order chosen at that moment. The clip has to show those turns in that order, in time, with one face throughout, and that face is compared with the document too.

The face is visible and uncovered, the document is held next to it with its data towards the camera, and the picture follows your instruction when you gave one. When its number can be read, it has to be the document photographed in the earlier step. A picture of a screen goes to a reviewer.

The file holds video and sound, and is between the shortest and the longest length you set.

The words heard are compared with the words shown, allowing for numbers written as digits. A sentence that was not said is asked for again, with a new sentence.

The recording arrived soon after the sentence was shown, inside the minute it was valid for. Many sentences asked for before one recording was sent goes to a reviewer.

Mouth movement, measured frame by frame, should follow the loudness of the voice.

One face is in view for the whole recording.

The name on the document against the name you sent, allowing for word order, middle names, initials, diacritics and short forms. A name printed in another script is compared with its Latin spelling, allowing for the many accepted ways to write it.

The date of birth read from the document against the one you sent.

The address read against the one you sent, allowing for abbreviations and for a flat or floor number written in a different place. A different house number is a different address.

The document number read against the one you sent.

The name on the identity document against the name on the proof of address, even when one is printed in another script.

The date of birth meets the minimum age you set, eighteen unless you change it or turn it off.

The customer agreed to the current wording. The version, the language and the time are kept.

A camera named after software that plays a file into the browser, a browser that reports that a program is driving it, or a session that moved to another device after it started.

Pictures that arrived faster than a person can take them.