Identity Verification Form: Template & Secure Collection

To collect IDs securely, use a purpose-built upload form instead of email. Give the client a link that needs no account, ask for the exact documents (a photo ID and a proof of address), encrypt the transfer, and check each scan for readability and expiry before you accept it. DokuTrak does this from a single link.

I built DokuTrak after watching professionals waste hours chasing clients for documents. Identity documents are the worst version of that problem. They are the most sensitive files you will ever ask for, they arrive blurry or expired more than any other document, and the tools people reach for either force the client to sign in or dump the file straight into an inbox. Here is what the form needs, how to collect the scans without leaking them, and how to catch a bad ID before it wastes a week.

What is an identity verification form?

An identity verification form is a structured request that collects the documents needed to confirm someone is who they claim to be, typically a government photo ID, a proof of address, and details like full name and date of birth. The form gathers the files. A person or system then checks them against the claimed identity.

There is a distinction worth holding onto. The form is the collection layer. Full identity verification, in the regulated sense, is the decision layer: biometric liveness, a facial match against the ID photo, and screening against sanctions or watchlists. DokuTrak lives in the collection layer. It gathers the ID and flags files that look wrong, unreadable, or expired before they reach you. It does not run liveness or watchlist screening. If a regulator requires those, a dedicated vendor is the honest answer, covered below.

What fields should an identity verification form include?

A usable form asks for the person's full legal name, date of birth, a government photo ID (front and back), and a recent proof of address. If the context is employment, it follows the document categories on Form I-9. If it is account onboarding, it adds a selfie for a manual face check.

For US employment eligibility, the categories are worth copying directly. USCIS Form I-9 lets a person prove identity and work authorization with one List A document (a US passport or permanent resident card, which covers both) or one List B document (a driver's license, proving identity) plus one List C document (a Social Security card, proving work authorization).¹ You must accept any document that reasonably appears genuine and to relate to the person.

A minimal, reusable template looks like this:

• Full legal name (as printed on the ID)
• Date of birth
• Government photo ID, front image
• Government photo ID, back image
• Proof of address issued in the last 90 days (utility bill, bank statement, lease)
• Optional: a selfie for manual face comparison
• Optional: ID expiry date, so you can confirm it is still valid

An identity verification form template should collect the minimum set that proves the claim: a government photo ID for identity, a recent proof of address for residency, and the legal name and date of birth to match against them. Everything beyond that is personal data you now have to store and protect.

One principle from the notary world applies to everyone: you are not always required to keep a copy of an ID after you have checked it.² The less sensitive data you retain, the smaller your exposure if you are ever breached.

Why is collecting ID by email so risky?

Email is the riskiest way to collect an ID because it has no structure, no validation, and a real misdelivery rate. An ID scan is the single most valuable file an attacker can intercept, and once it is sent to the wrong inbox you cannot pull it back.

The numbers make the case. Egress found that 49% of email security incidents are misdelivery, the right file sent to the wrong recipient.³ That is what happens when someone mistypes your address while sending a passport photo. And the payoff for whoever receives it is high: IBM reports that customer personal data was the most frequently compromised data type in 2025, involved in 53% of breaches, with a global average breach cost of $4.44 million.⁴ Identity documents are that data in its most concentrated form.

The fraud built on stolen identity is not abstract. The US Federal Trade Commission logged more than 1.1 million identity-theft reports in 2024, within $12.5 billion of total reported fraud losses across all types.⁵

Emailing an ID scan fails in two directions at once. Outbound, the client's file can land in the wrong inbox, which Egress found is 49% of all email security incidents. Inbound, you now hold a passport image in a system built for messages, not for sensitive document storage. Neither risk is theoretical.

What makes ID scans fail, and how does AI flagging catch it?

ID scans fail because the picture is bad, not because the person is fraudulent. A corner is cut off, glare washes out the number, the photo is blurry, or the card expired last month. Shufti Pro reports that more than a third of ID documents fail verification because the text is not readable or corners are missing, even with modern phone cameras.⁶ You usually discover this days later, on the file you needed most.

This is where the AI flag earns its place. When a scan comes in, DokuTrak checks it and flags the ones that look unreadable, wrong-document, or expired before they reach your desk. AI flags, you decide. It does not reject the client or make a compliance ruling. It tells you, at upload time, that the back of the license is missing or the expiry date has passed, so you ask for the reshoot immediately instead of a week later when the deadline is on top of you.

An AI file flag is a capability, not a verdict. It reads each uploaded ID and surfaces the ones that look unreadable, expired, or clearly the wrong document, at the moment of upload. A human still makes the accept-or-reject call. The value is timing: you catch the blurry scan while the client still has the ID in hand, not three days later when the deadline hits.

How do you collect IDs securely without a client account?

You collect IDs securely by sending a no-account upload link over an encrypted connection, then letting automatic reminders handle the follow-up. The client taps the link, photographs both sides of the ID, and sends it. No signup, no password, no portal to log into. That single design choice removes the most common reason ID collection stalls: the client will not create yet another account.

This is the wedge, and it maps to three real points of failure. No client account kills the login friction. AI flags kill the blurry-scan round trip. Auto-reminders kill the manual chase. No incumbent combines all three, and the popular free tools each break on one of them:

• Google Forms looks free until you add a file-upload field. The moment you do, it forces every respondent to sign in to a Google account, with no toggle to turn that off.⁷ So the client sending a driver's license must log into a Google account first, and the form never checks whether the scan is readable.
• Dropbox File Request does let people upload without an account, which is genuinely better. But reminders are thin: only on a paid plan can you set a deadline, and Dropbox then sends exactly one reminder you cannot customize or repeat.⁸ It is storage, so it never reads the file to tell you an ID is blurry or expired.

Dropbox is a fine place to receive a file. What it does not do is chase the client or flag a bad ID, and for identity documents those two gaps are the expensive ones. For how a no-account upload link should be built, see my guide to a secure document upload portal.

When should you use a dedicated IDV vendor instead?

Use a dedicated identity-verification vendor when a regulator requires biometric proof, not just a collected document. If you must match a live selfie to the ID photo, run liveness detection, or screen a name against sanctions and watchlists for KYC or AML, that is a Jumio, Onfido, or Sumsub job. DokuTrak collects and flags files. It does not do liveness or watchlist screening.

The reason those vendors exist is that document fraud is now industrialized. Entrust's 2025 Identity Fraud Report found a deepfake attempt roughly every five minutes in 2024, alongside a 244% year-over-year surge in digital document forgeries.⁹ Sumsub's Q1 2025 data reported synthetic identity document fraud up 311% in North America.¹⁰ Beating that at scale takes biometric liveness and injection-attack defense, which is what a regulated IDV product is built for and DokuTrak is not.

So draw the line honestly. If you are a bank onboarding at volume, or legally on the hook for facial matching, buy the specialist. If you need to collect an ID cleanly, know it is readable and unexpired, and stop chasing the client, a document-collection layer with AI flagging is lighter, cheaper, and does the job you actually have.

Common questions about identity verification form

What is an identity verification form?

A structured request that collects the documents needed to confirm someone is who they claim to be, usually a government photo ID, a proof of address, and details like full name and date of birth. The form gathers the files; a person or system then checks them against the claimed identity.

What documents count as valid ID on a verification form?

For US employment, Form I-9 accepts one List A document (a US passport, which proves identity and work authorization together) or one List B identity document (a driver's license) plus one List C document (a Social Security card).¹ Outside the I-9 context, most forms accept a government photo ID plus a recent proof of address.

Is it safe to collect ID documents by email?

No. Email has no upload structure, no expiry check, and a high misdelivery rate. Egress found 49% of email security incidents are misdelivery.³ An ID scan sent to the wrong address exposes exactly the personal data attackers want most, and you cannot recall it.

Can I collect IDs without making clients create an account?

Yes. A no-account upload link lets a client photograph their ID and send it in one tap, with no signup or login. Google Forms cannot do this once a file field exists, since a file-upload question forces a Google sign-in.⁷ A purpose-built form removes that wall entirely.

Does DokuTrak replace a KYC or biometric verification vendor?

No. DokuTrak collects ID files, flags scans that look unreadable, wrong, or expired, and reminds clients automatically. It does not run facial liveness or AML watchlist screening. If a regulator requires biometric matching or sanctions checks, a dedicated IDV vendor like Jumio, Onfido, or Sumsub is the right tool.

Start collecting IDs the secure way

Stop emailing passport photos and making clients log into a portal to send a driver's license. Give them one link, catch the bad scans before they reach you, and let the reminders run themselves. Start your free 14-day trial of DokuTrak and set up your first identity verification form today.

Sources

Footnotes

1. U.S. Citizenship and Immigration Services, "Form I-9 Acceptable Documents." https://www.uscis.gov/i-9-central/form-i-9-acceptable-documents ↩ ↩²

2. The American Association of Notaries, "To Keep or Not to Keep Copies." https://www.notary.org/article-to-keep-or-not-to-keep-copies ↩

3. Egress, "Email Security Risk Report 2024." https://www.egress.com/blog/company-news/stats-from-the-email-security-risk-report ↩ ↩²

4. IBM (Ponemon Institute), "Cost of a Data Breach Report 2025." https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai ↩

5. U.S. Federal Trade Commission, "New FTC Data Show Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024," March 2025. https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024 ↩

6. Shufti Pro, "Why Does ID Verification Fail in 2025? Causes and Fixes," 2025. https://shuftipro.com/blog/why-does-id-verification-fail-in-2025-causes-fixes-shufti/ ↩

7. Google Docs Editors Community, "Google Forms: Why Your Respondents Are Being Forced to Login." https://support.google.com/docs/community-guide/395355672/google-forms-why-your-respondents-are-being-forced-to-login ↩ ↩²

8. Content Snare, "How to Use Dropbox File Request (and Its Limits)." https://contentsnare.com/dropbox-file-request/ ↩

9. Entrust, "2025 Identity Fraud Report: Deepfake Attacks Strike Every Five Minutes Amid 244% Surge in Digital Document Forgeries," 2025. https://www.entrust.com/company/newsroom/deepfake-attacks-strike-every-five-minutes-amid-244-surge-in-digital-document-forgeries ↩

10. Sumsub, "Synthetic Identity Document Fraud Surges 300% in the U.S.," Q1 2025 Identity Fraud Trends, June 2025. https://sumsub.com/newsroom/synthetic-identity-document-fraud-surges-300-in-the-u-s-sumsub-warns-e-commerce-healthtech-and-fintech-at-risk/ ↩