Manual Identity Checks Are Failing You. Here Is Why.

Someone in your organisation is looking at a passport right now. Or they did last week, or they will next Monday morning when a new starter arrives. They hold it at the correct angle, check the photo, glance at the expiry date, maybe feel the cover for the laminate texture they were told about at induction three years ago. Then they hand it back, make a copy, and record it as verified.

That process feels thorough. It has the appearance of due diligence. It produces a piece of paper with a photocopy on it that will sit in a file and be presented, if it ever comes to it, as evidence that your organisation checked.

Here is the uncomfortable truth. What you just described is not identity verification. It is a ritual that gives you the feeling of compliance without much of the substance. And in 2026, with AI-generated documents sophisticated enough to pass visual inspection, with BRPs gone, with the DVS Trust Framework 1.0 published just three weeks ago, and with mandatory digital right-to-work checks on the statutory horizon, the gap between what your manual process catches and what it misses is no longer a theoretical concern. It is a live operational risk.

I am not saying this to alarm you. I am saying it because after two decades of processing real vetting files, sitting in the audits, and seeing exactly what gets through and what gets caught, I know that the organisations most at risk are not the ones with no process. They are the ones with a process that looks solid on paper but has never been seriously tested.

What Manual Identity Checks Actually Involve

When we talk about manual identity checks in a pre-employment context, we mean a human being physically examining one or more identity documents, cross-referencing what they see against what the candidate has stated, and making a judgement call about whether that document is genuine and whether the person presenting it is its legitimate owner.

For right to work, that means checking a passport, a share code confirmation from the Home Office online service, or another document from the prescribed list. For DBS checks, it means following the identity checking guidelines and presenting documents across the required combination of groups. For BS7858 sector employers, it means a more extensive identity strand covering five year address history, National Insurance verification and more besides.

In every case, the process depends entirely on the knowledge, attention and judgment of the individual conducting the check. And that is where the structural problem begins.

Most of the people doing these checks are not document fraud specialists. They are HR coordinators, office managers, recruitment administrators. They may have received an hour of training, or a briefing from a colleague, or no formal instruction whatsoever. They are being asked to make a reliable determination about whether a document is genuine, whether its security features are intact, and whether the person in front of them is who they claim to be. Against modern document fraud, that is an extremely difficult ask.

What Digital Identity Verification Actually Does

Digital identity verification, when conducted through a certified Digital Verification Service provider operating under the UK DVS Trust Framework, is a fundamentally different process. It is not simply a faster version of the same check. It is a different category of verification entirely.

A certified DVS provider uses identity document validation technology to examine the machine-readable zone of a document, check chip data where available, run liveness detection to confirm the person presenting the document is a real human being and not a photograph or deepfake, cross-reference the identity against multiple data sources, and produce a scored confidence level aligned to GPG45, the government's identity confidence framework.

The DVS Trust Framework 1.0, published by the Office for Digital Identities and Attributes on 3rd March 2026, sets out detailed standards for certified providers including biometric testing requirements and security controls. A digital identity provided by a DVS certified against the trust framework and the DBS supplementary code is now formally treated as equivalent to meeting the manual verification guidelines for DBS checks. That is not a commercial claim from a technology vendor. That is the government's own position.

For right to work, certified DVS providers are also approved for digital checks. One digital check, conducted properly through a certified provider, can satisfy both your right to work obligation and your DBS identity verification requirement simultaneously. That is not a marginal efficiency saving. For organisations onboarding at any volume, it is a significant operational change.

The Speed Comparison Is Not Even Close

A manual identity check takes as long as it takes. The document needs to be physically present. The person conducting the check needs to be available. If something looks unusual and the checker is uncertain, there is often no reliable escalation path. The check may be repeated, or it may be waved through because there is pressure to get the new starter processing quickly. Copies need to be made, labelled, filed and retained in a way that can be retrieved during an audit.

A digital check through a certified DVS provider can be completed remotely, at any point in the onboarding process, in minutes. The candidate completes the verification on their own device. The result is returned as a scored outcome with a full audit trail. Nothing needs to be physically present. Nothing depends on the availability or attention of an individual staff member.

For organisations handling remote hiring, this is not optional nicety. It is the only realistic way to verify identity securely when the candidate and the employer are never in the same room. If you are hiring remotely and relying on someone emailing a scan of their passport, you do not have an identity check. You have a document that anyone could have created on a laptop.

This connects directly to something we wrote about recently in our piece on AI-generated CVs and deepfake candidates. The fraud threat has moved on considerably. The manual process has not kept pace.

The Fraud Detection Gap

This is where the honest conversation gets uncomfortable for most organisations, because it requires acknowledging something that nobody wants to say out loud.

Visual inspection of identity documents does not reliably detect modern document fraud. It never reliably detected sophisticated forgeries, and AI-generated documents have made the problem considerably worse. The pixel-level accuracy of current AI document generation tools means that a forged passport or driving licence can pass visual inspection by someone who has no specialist training and limited experience of what a genuine document actually looks like under scrutiny.

Manual processes cannot detect synthetic identities, which are composite identities built from fragments of real stolen data. They cannot verify the chip data in a biometric passport without specialist equipment. They cannot run liveness checks. They cannot cross-reference the presented identity against fraud databases or credit bureau records. They produce a record of the check having happened, but they cannot confirm that the outcome of that check was accurate.

Digital verification through a certified provider does all of these things. Automated biometric verification catches deepfakes and synthetic identities. Cross-referencing against multiple data sources identifies inconsistencies that would never surface through a visual check. The liveness detection confirms the person is physically present and genuine. The audit trail proves not just that a check happened but what the check found.

The organisations most exposed to employment fraud are not the ones with no process. They are the ones whose process produces a record without producing reliable assurance. If you want to understand how that exposure builds, our post on how AI deepfake fraud is affecting employment screening sets out the current threat landscape in detail.

The Cost Comparison People Are Getting Wrong

The most common objection to digital verification is cost. A certified DVS provider charges per check. A manual process costs nothing beyond staff time. On a spreadsheet, manual looks cheaper.

This analysis is wrong in almost every case, and here is why.

Staff time is not free. The fully loaded cost of an HR coordinator's time, including salary, employer National Insurance, pension contributions and overhead allocation, is substantial. A manual right to work check that takes fifteen minutes of an experienced person's time, plus the filing, copying and record management around it, has a real cost that rarely appears in the comparison.

Add to that the cost of errors. A civil penalty for an illegal working breach starts at £45,000 per worker for a first breach and £60,000 per worker for a repeat. Those figures are not hypothetical. Illegal working raids reached record levels between July 2024 and December 2025, with arrests up 83% in that period. The Home Office enforcement machine is more active than it has ever been. If a manual check misses something that a digital check would have caught, the cost of that miss is not the price of one DVS transaction. It is the civil penalty, the legal costs, the reputational damage and the management time involved in responding to an enforcement action.

Our post on civil penalties and how they happen to good employers covers exactly this territory. The employers who end up with penalties are rarely negligent in any obvious sense. They have a process. The process just has gaps that were never visible until enforcement exposed them.

There is also the audit cost. A manual process requires physical document retention, organised storage, and the ability to retrieve specific records under time pressure when an auditor asks for them. A digital process produces an immediate, searchable, exportable audit trail. If you have ever tried to pull twenty vetting files together at short notice for a BS7858 audit or an FCA inspection, you will understand the value of that difference.

Where Technology Is Demonstrably Better

I want to be direct about this, because the debate sometimes gets positioned as a matter of preference or organisational culture. It is not.

For remote hiring, digital verification is the only reliable option. You cannot manually verify the identity of someone you have never met in person based on a document they have emailed to you. This is not a close call.

For regulated sector roles, the fraud sophistication directed at those positions is higher than in general employment. FCA regulated firms, CQC registered care providers, SIA licensed security companies and government contractors under BPSS all operate in environments where the candidates most motivated to commit identity fraud are also the candidates applying for those roles. The manual check that works adequately for a low-risk general hire does not provide adequate assurance for a role with access to vulnerable people, financial systems or classified information.

For volume hiring, the scalability argument is straightforward. Manual checks do not scale reliably. The quality of a manual check at the end of a busy onboarding week, conducted by someone who has done thirty of them in a month, is materially different from the quality of the first one. A digital check produces a consistent scored outcome regardless of volume or timing.

For audit readiness, the digital audit trail is simply better. It records what was checked, when, by what method, and what the outcome was. It does not depend on a filing system, a member of staff who remembers where documents are kept, or photocopies that have faded or been misfiled.

If you are in a position of accountability for your organisation's screening compliance and you have not yet had a serious conversation about certified digital verification, I would encourage you to have that conversation now rather than when enforcement or audit makes it necessary. Our post on what a compliant right to work process looks like is a useful starting point, as is our guidance on the BRP phase-out and what employers must do now.

The Direction of Travel Is Not Ambiguous

Digital right-to-work checks will be mandatory by 2029. The GOV.UK Wallet is in public pilot now, with full rollout of the digital driving licence expected in summer 2026. The government's roadmap requires all government services to offer digital credentials alongside paper equivalents by the end of 2027. The DVS Trust Framework 1.0 is live and certified providers are operating under it today.

The question is not whether your organisation will eventually move to digital verification. It will. The question is whether you move on your own timeline, with proper preparation and the right provider in place, or whether you move reactively because an audit, an enforcement action or a fraud incident has made the decision for you.

The organisations I have seen come unstuck over twenty years of doing this work are rarely the ones that made bad decisions deliberately. They are the ones that kept doing something that felt adequate because nobody had told them plainly that it was not. Consider this that conversation.

Working With Vetting Hub

At Vetting Hub, we work alongside organisations that are serious about getting employment screening and vetting compliance right, not just on paper, but in practice. Our subscription gives your team the knowledge to understand every aspect of what compliant screening actually looks like, the tools to implement it correctly from day one, and direct access to Graham and Vivianne Johnson when a specific situation needs a specific answer from people who have two decades of operational experience behind them.

We are not a training company selling individual courses. We are an ongoing consultancy relationship that moves with your organisation as the regulatory landscape shifts. If you have questions about digital verification, your current identity checking process, or where your compliance gaps might be, we are the right people to ask.

Find out more at www.vettinghub.co.uk