How Do Banks Verify Identity: Documents, Databases, and Denials

Banks verify your identity by collecting four pieces of information about you — your full legal name, date of birth, street address, and taxpayer identification number — and then matching those details against government and commercial databases, usually alongside a government-issued photo ID or, for online applications, a selfie compared to your ID. The process is required by federal anti-money-laundering rules known as the Customer Identification Program, and it runs whether you walk into a branch or open the account from your phone.¹

The Four Pieces of Information Every Bank Collects

Federal regulations implementing Section 326 of the USA PATRIOT Act require the bank to gather the same four data points from every applicant before opening any account:

Full legal name, exactly as it appears on your government ID.
Date of birth, used to distinguish you from other people with the same name.
Street address. A standard post office box does not qualify. If you don’t have a fixed street address, the bank may accept a military APO or FPO address, or the street address of a close relative or contact person.
Taxpayer identification number. For U.S. citizens and residents this is normally a Social Security number. If you aren’t eligible for one, an Individual Taxpayer Identification Number works, because the rule accepts any IRS-issued taxpayer ID.

If you are not a U.S. person, the bank may instead accept a passport number with country of issuance, an alien identification card number, or the number from another government-issued document showing nationality or residence and bearing a photograph.¹

Documents That Satisfy the ID Check

After collecting those four data points, the bank verifies them. In person, the most common way is by looking at an unexpired, government-issued photo ID. The regulation doesn’t name specific documents, but banks typically accept:

A driver’s license or state-issued ID card, the standard choice for in-branch openings.
A U.S. passport or passport card, useful when your license address doesn’t match your current residence.
A Permanent Resident Card for lawful permanent residents.
A foreign passport for non-U.S. persons, paired with the passport number already recorded.

Some banks also accept a Matricula Consular, the consular identification card issued by the Mexican government, as a photo ID for non-U.S. persons. Treasury declined to prohibit its use when it wrote the CIP regulations, but individual banks decide whether to take it.¹

Whatever you present, it needs to be unexpired, legible, and a recognizable likeness. If you’re uploading images to an online application, capture all four corners of the document in good lighting. Blurry, cropped, or physically damaged IDs get rejected.

The Database Checks Running Behind the Scenes

Handing over a document is only the first step. Within seconds of receiving your application, the bank pushes your information through several systems.

Social Security Number Matching

Banks verify Social Security numbers through the Social Security Administration’s electronic Consent Based SSN Verification service (eCBSV). The system compares the name, date of birth, and SSN you submitted against SSA records and returns a yes or no. If something doesn’t match — a name change the SSA doesn’t know about, a typo, or a number that belongs to someone else — the bank sees which element failed.²

Banking History Reports

Most banks pull a report from a specialty consumer reporting agency such as ChexSystems or Early Warning Services. These agencies track checking account applications, openings, closures, and the reasons for closure, including involuntary closures for overdrafts or suspected fraud. A negative record can lead to a denial or an offer of a limited account.³

Credit Bureau Queries

Some banks also query Equifax, Experian, or TransUnion. Checking account history isn’t part of a standard credit report, so when banks look here during account opening they’re usually confirming that you exist at the address you gave, or checking for fraud alerts and credit freezes. They’re not scoring you the way a lender would.⁴

Backup Verification Methods

When documents alone aren’t enough, or when the usual databases can’t confirm your information, federal rules allow non-documentary alternatives. The bank may contact you directly to confirm details, compare what you provided against public databases, check references with other financial institutions, or ask for a financial statement. These methods matter most for applicants who can’t easily produce a standard photo ID in person.¹

How Online Applications Verify You Without a Branch Visit

Applying through a mobile app or website works the same way in principle, but the bank swaps the in-person document check for a technology stack.

Facial Recognition and Liveness

Most online applications ask you to photograph or scan your ID and then record a short selfie video. Software compares your live face to the photo on the ID by analyzing facial landmarks and calculating a similarity score. To block still photos and deepfakes, the system runs a liveness check: you may be asked to blink, turn your head, or track a dot on the screen. If the similarity score falls below the bank’s threshold, you’ll be asked to retake the images or visit a branch.

Device Fingerprinting

While that’s happening, the bank quietly records identifying details about the device you’re using: IP address, operating system, browser, hardware traits. If the same device has been linked to earlier fraudulent applications, the bank can flag or deny yours even after a clean biometric check. This layer runs automatically.

Knowledge-Based Authentication Questions

When automated checks come back inconclusive, some banks fall back on knowledge-based authentication: a set of multiple-choice questions drawn from your credit history that only you should be able to answer. You might be asked to identify a previous street address, name the lender on an old auto loan, or confirm the year you opened a particular credit card. They’re sometimes called “out-of-wallet” questions because the answers aren’t printed on a stolen driver’s license.

Fail the questions and most banks give you one or two more attempts before suspending the online application and asking you to visit a branch. The questions are timed, and running out of time counts as a failure.

KBA is losing favor. The National Institute of Standards and Technology’s current digital identity guidelines state that knowledge-based authentication “does not constitute an acceptable secret for digital authentication,” largely because the answers surface in data breaches and social-engineering attacks. NIST also flags KBA as error-prone and frustrating for legitimate users. Many banks are moving to biometric verification and one-time passcodes sent to a phone number already on file.⁵

Business Accounts Add Another Layer

Opening an account for a business runs through the same four-data-point check, but the bank verifies the entity as well as the people behind it. At minimum, that means the legal name, the Employer Identification Number, and documentation that the entity exists: articles of incorporation, an LLC operating agreement, or a partnership certificate filed with the state. A sole proprietor using a personal SSN instead of an EIN may need a “doing business as” filing.

Federal anti-money-laundering rules also require the bank to identify the entity’s beneficial owners: anyone who directly or indirectly owns 25 percent or more of the equity, plus at least one individual with significant day-to-day control, typically a CEO, managing member, or general partner. Each provides the same four data points required for a personal account, verified the same way.⁶

As of February 2026, FinCEN granted banks relief from re-verifying beneficial ownership every time an existing business customer opens another account at the same institution. The bank verifies beneficial owners when the entity first opens an account, then again only if it has reason to doubt the information already on file or its own risk-based procedures call for an update. In follow-up situations, the bank may rely on a verbal or written confirmation from the customer that the ownership information is still accurate.⁷

What Happens If the Bank Denies Your Application

If a bank turns you down based on information in a consumer report, including a ChexSystems or Early Warning Services report, federal law gives you specific rights.

The Adverse Action Notice

Under the Fair Credit Reporting Act, the bank must notify you of the denial and provide the name, address, and toll-free phone number of the reporting agency whose data contributed. The notice must state that the reporting agency didn’t make the decision and can’t explain it. You then have 60 days from that notice to request a free copy of the report, and the right to dispute anything you believe is inaccurate or incomplete.⁸

Disputing Inaccurate Records

If a ChexSystems report contains errors, such as a closed account attributed to you that belonged to someone else, you can file a dispute directly with ChexSystems online, by phone at 800-428-9623, or by mail. ChexSystems must complete its reinvestigation within 30 days, or 21 days if you live in Maine. If you send additional documentation during the investigation, the deadline may extend by up to 15 days. Useful supporting documents include an identity theft affidavit, a police report, account statements, or a letter showing the debt was paid or settled.⁹

Second-Chance Accounts

If your ChexSystems record has legitimate negative marks you can’t dispute away, some banks and credit unions offer second-chance checking accounts built for applicants who have been denied a standard account. They often carry monthly fees and may limit check-writing or overdrafts, but they let you back into the banking system while you resolve the underlying issue.

How Long Banks Keep Your Verification Records

Banks don’t discard your verification file when you close the account. Federal regulations require them to hold on to the identifying information they collected — name, date of birth, address, taxpayer ID — for five years after the account closes. Descriptions of the documents used to verify you, the methods used, and how any discrepancies were resolved must be kept for five years after those records were created. For credit card accounts, the clock starts when the account is closed or becomes dormant, whichever is later.¹

1
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
2
Social Security Administration. Electronic Consent Based Social Security Number Verification (eCBSV) Service
3
Consumer Financial Protection Bureau. Chex Systems, Inc.
4
Consumer Financial Protection Bureau. Will It Hurt My Credit If My Bank or Credit Union Closed My Checking Account
5
NIST Pages. NIST Special Publication 800-63-4 – Digital Identity Guidelines
6
FinCEN. CDD Final Rule
7
FinCEN. Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening (FIN-2026-R001)
8
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
9
ChexSystems. Dispute