Businesses are processing more and more contracts, new accounts, and other services online. At the same time, businesses in Germany must satisfy increasingly strict requirements around data protection, information technology (IT) security, and fraud prevention. For that reason, secure identity verification has become an integral part of many digital business processes.

In this article, we explain why businesses in Germany need to verify customer identities, including available verification methods and regulatory requirements. We also explain how to balance these requirements with a convenient customer experience.

Key takeaways

• Businesses in Germany are managing more and more business processes digitally, which makes secure identity verification increasingly important.
  
• Businesses can verify identities using a variety of methods. These include digital solutions—such as video identification (video ID), photo identification (photo ID), electronic identification (eID)—and post identification (POSTIDENT) from Deutsche Post.
  
• Legal regulations require many businesses to verify customer identities.
  
• Identity verification helps with fraud prevention and protects sensitive data and business finances.
  
• Modern identity verification methods must achieve a balance between high levels of security and simple, user-friendly onboarding.
  

Why do businesses in Germany verify customer identities?

Customer identity verification is about confirming who the real person is behind a business relationship or digital transaction. Typically, a person’s identity can be verified using an official form of identification, such as a government-issued ID, passport, or residence permit. Businesses check the authenticity of the documents and whether the person matches the photo on their ID.

Identity verification can be done in-person or remotely. For the latter, businesses use a variety of digital identification verification methods that allow them to confirm customer identities online. There is also an increase in the use of methods that do not require physical forms of identification. Instead, they rely on identity data that has already been verified.

Identification typically happens at the start of a business relationship. It is different from authentication, which is about confirming an existing customer’s identity during subsequent access attempts. Digital payments often require Strong Customer Authentication (SCA), which combines at least two independent security characteristics.

Fraud prevention

Screening customer identities is an important part of effective fraud prevention. It’s how companies can reliably verify the authenticity of the entities they do business with. It also presents a major obstacle for fraudulent actors and can prevent many acts of fraud altogether. In particular, this includes fraud based on identity theft, such as concluding contracts with false identities or ordering goods and services using stolen payment details.

This safety mechanism is particularly important for digital business models because they do not involve personal contact between businesses and customers. This makes traditional identification checks impossible. Therefore, automated and structured identity verification is increasingly relevant. The greater the financial risk of a transaction—or the more sensitive the data being processed—the greater the need for reliable and accurate identification.

Data security

Identity verification also helps protect sensitive information. Businesses must ensure that only authorized persons can access customer accounts, contract information, and personal documents.

In the EU, Article 5 of the General Data Protection Regulation (GDPR) requires businesses to process personally identifiable information in a way that guarantees an adequate level of security.

Article 32 of the GDPR details appropriate technical and organizational measures for achieving this level of security. This can include reliable identity verification. In addition, unauthorized persons must be prevented from accessing confidential information, especially via self-serve portals, customer accounts, and digital management tools.

Financial implications

Businesses in Germany with a functioning identity verification program enjoy a range of benefits. These include legal protections and data security, as well as financial benefits.

Businesses can significantly reduce the financial losses caused by fraud by employing reliable identification processes. This is because digital identification services can stop many common attacks and scams before they start. This includes fraudulent actors stealing identities, opening new accounts with fake details, or performing fraudulent transactions.

At the same time, robust online identity verification mechanisms help minimize regulatory risks and increase compliance. This helps mitigate the risk of sanctions and reduces the remediation workload of compliance teams.

In addition, secure and transparent identification processes can improve customer trust. Customers feel safer handing over sensitive data to digital service providers. This trust can improve customer loyalty and the likelihood of making purchases.

How do businesses verify customer identities?

Below, we provide an overview of the main tools that businesses in Germany use for secure digital identity verification.

Video identification (video ID)

With video ID, a customer’s identity is verified in a live video chat with a trained agent. The customer holds up their ID to the camera, confirming their identity in real time. Often, a transaction authentication number (TAN) is also texted to the customer for final confirmation. This is a common verification tool that can be used for many purposes, including in regulated sectors.

However, it requires a stable internet connection and suitable technical equipment, such as a camera and microphone. In some cases, customers also need separate apps. Video ID is relatively time-consuming and cost-intensive because it requires trained agents. However, it also offers a personal touch and is easy to follow.

Photo identification (photo ID)

Photo ID verifies a customer’s identity by comparing their ID to a live photo or short video recording. This step is typically performed using AI, making it a largely automated and fast process. It does not require human interaction and can be performed anytime. If the images are not of adequate quality, the process is terminated and must be repeated with high-quality images.

Electronic identification (eID)

With eID, a German government-issued ID is read digitally using the near-field communication (NFC) interface on a smartphone. This method also uses apps and personal identification numbers (PINs). The customer holds their ID to their smartphone and enters their PIN to confirm.

This process is suitable for both regulated and nonregulated applications and can be used for qualified electronic signatures. It requires a government-issued German ID with the eID function activated.

Bank identification (bank ID)

With bank ID, a customer’s identity is verified via their bank’s online banking system. Bank ID uses identity data that has already been verified by the bank, which means a physical ID is not required. Instead, the customer confirms their identity using their online banking login. This makes it a particularly simple process because customers simply select their bank and log in.

It is suitable for many purposes, from simple identification to regulated processes, such as onboarding in compliance with the German Money Laundering Act (GwG).

In-person identification

In-person identification involves a customer physically verifying their identity. For example, this could occur at a bank branch or business location. Trained employees physically check the customer’s ID and then digitally capture the corresponding data. Because this process involves a physical identification check, it is a particularly reliable process that is ideal for situations where customers are already present.

Post identification (POSTIDENT)

POSTIDENT from Deutsche Post is very similar to in-person identification. However, it is performed at a branch of the Deutsche Post, which is the official postal service of Germany.

Customers identify themselves in-person by presenting their IDs, and Deutsche Post employees perform verification. Deutsche Post then sends the data from this review to the relevant company. The identification process is outsourced to a standardized external infrastructure that is widely available across Germany.

Wallet identification (wallet ID)

With wallet ID, previously verified identity data is stored in a digital wallet. Customers can then retrieve this data at a later time and use it for new verification processes. This makes the actual process of verifying their identity significantly easier.

Wallet solutions are considered future-oriented because they make identity data available from a central, secure location. The EU is currently planning a European Union Digital Identity (EUDI) wallet that will expand this concept to the EU level. It is intended to combine digital IDs, documents, and signatures in a single solution to standardize digital identity long term.

What regulatory requirements for digital identity verification do businesses in Germany need to know?

In many industries, identity verification is legally mandated. Businesses must confirm the identities of their customers to prevent money laundering, the financing of terrorism, or other criminal offences.

One of the most important regulations in Germany is the GwG. According to Section 10, Paragraph 1 of the GwG, regulated businesses are required to fulfill certain due diligence obligations. This includes identifying their contract partners in accordance with Section 11 of the GwG. Businesses regulated by the GwG include banks, finance and payment service providers (PSPs), insurance firms, and notaries.

The Federal Financial Supervisory Authority (BaFin) defines specific requirements for identity verification and reliable verification processes for banks and other financial businesses.

The telecommunications sector is also subject to certain legal requirements regarding identity verification. According to Section 172 of the German Telecommunications Act (TKG), service providers must verify customer identities for specific services. The aim is to make it harder for fraudulent actors to misuse anonymous means of communication.

Identity verification in digital business models

While the above industries are subject to strict regulations, online identity verification is also increasingly important for digital business models that operate outside of traditional finance or telecommunications sectors. These include online stores, marketplaces, and digital platforms.

While these businesses are not explicitly required by law to identify their customers, they are often subject to indirect requirements. These can be regulations on fraud prevention, protection of customer accounts, or security for high-value or high-risk transactions, for example. Reliable identity verification can help prevent misuse, especially when processing payments, refunds, or new customer accounts.

Security and convenience: Requirements for digital identity verification tools

For businesses in Germany, a fundamental challenge when selecting and launching online identity verification is ensuring a high level of security in addition to an efficient customer experience. Identity verification must be reliable and tamper-proof to prevent fraud, fulfill regulatory requirements, and protect sensitive data. In addition, processes that are overly complex or time-consuming can be off-putting for customers.

The higher the security requirements, the more complex and controlled the identification process tends to be. While in-person and multistep verification offer particularly high levels of security, they often involve more work for customers. Conversely, heavily automated processes provide quick and convenient onboarding but can entail additional technical requirements or restrictions.

Therefore, many modern identity verification tools aim to balance both aspects. Technological advances in AI have helped unite security and user-friendliness. That said, the optimal identification design for a business depends on the specific application, risk profile, and regulatory requirements.

How Stripe Identity can help with digital identity verification

Verifying identification documents poses a complex challenge for businesses because of varying document standards, country-specific requirements, and data formats. Stripe Identity addresses this issue by enabling standardized, digital verification of identity documents from more than 33 countries. This allows identity verification processes to be standardized internationally and integrated into existing digital workflows.

Businesses can capture and process various types of identity data. This includes images of identification documents, as well as photos that can be used for biometric matching. Additionally, data extracted from documents—such as names or dates of birth—can be automatically read and validated. The process is designed to guide customers through the verification process to reduce errors in data entry and increase success rates.

Identity uses machine learning to detect forged or tampered documents and verify the authenticity of identity documents. In this way, companies can reduce instances of fraud and provide legitimate customers with an efficient onboarding process.

FAQs about digital identity verification in Germany