Identity Verification Processes

[Paul Chauvet <chauvetp () NEWPALTZ EDU>]

Hello all,

We are trying to improve and standardize our online identity verification processes for our students, alumni, and 
applicants.  We need to do identity verification when someone needs a password reset, and we do not have a current 
personal email address on-file (for us to send a password reset email to).

Would anyone be willing to share their identity verification processes (especially regarding password resets)?

I'll also say one process we are considering would be to have a secure online portal where (if verification is needed) 
the person would upload a scanned copy (or smartphone picture) of their photo ID.  That photo ID would be stored only 
until verification is completed (which would then cause us to update the personal email address for the person, and 
send them a password reset email).  This does increase risk in one way (by storing, even temporarily, the photo ID 
image), but reduces the risk of providing access to someone purporting to be another individual.

Thank you in advance for any advice you can provide!


Paul Chauvet
Information Security Officer
State University of New York at New Paltz
845-257-3828
chauvetp () newpaltz edu<mailto:chauvetp () newpaltz edu>
[emlogo]