When a customer or employee signs a contract remotely, one question stays open: is the person who pressed the sign button really the intended person? A verification code proves that the signatory has the email or phone, but not that they are the person named in the contract. Electronic identity verification is the set of technical procedures that closes this gap, by examining the official identity document and matching it to the face of the person in front of the camera at that same moment. In the financial sector this field is known as "know your customer" (KYC) procedures.
In this guide we explain to businesses how this technology works, when they need it, how to choose the right level, how to handle rejections and name mismatches, and what to bear in mind regarding privacy and user experience. For each point we cover why it matters, how to apply it, the common mistake, and a practical example, followed by a checklist and frequently asked questions.
First: Why Is a Verification Code Sometimes Not Enough?
Why it matters: A verification code sent by email or WhatsApp is an excellent method for everyday contracts, but it proves something specific: that the signatory controlled that channel at the moment of signing. If the phone is in a relative's hands, the email has been hacked, or the number is registered in someone else's name, it is proven that the code was entered, but not who entered it.
| Method | What it proves | What it does not prove |
|---|---|---|
| Code by email | Control of the email | The identity of the email's owner |
| Code by WhatsApp | Control of the number | That the phone's holder is the named person |
| Attaching an ID image | That the signatory has an image of a document | That they are actually its holder |
| Identity verification with face matching | That the signatory in front of the camera is the document's holder | — |
Common mistake: Believing that attaching an ID card image equals identity verification. An ID image can be uploaded by anyone who obtained it, and it does not prove that the uploader is its owner.
Example: A car rental company used to ask for an ID image with the electronic contract. Someone rented a car using an image of a relative's ID and disappeared. When the company moved to matching the face to the document, these cases stopped.
Second: How Does Electronic Identity Verification Work?
Why it matters: Understanding the steps helps you explain them to your customers and judge what the result proves.
- Photographing the document: The person photographs the front and back of their ID card, or the passport page, with their phone camera.
- Checking the document: The system verifies that the document is genuine and unaltered, and reads its data such as name, date of birth and document number.
- Capturing the face: The person takes a photo of their face or a short clip.
- Liveness check: The system makes sure the face belongs to a live, present person, not a printed photo, a screen or a mask.
- Matching: The system compares the live face with the photo on the document.
- The result: Acceptance, rejection, or referral to human review in unclear cases.
Who does it: This process is usually handled by specialized providers that own document and face analysis technology, and signing platforms integrate with them. In Wthaiq, identity verification is carried out through a specialized external provider, and its result is stored in the contract's evidence report alongside the signature and the verification code.
Common mistake: Carrying out verification in a place separate from signing, for example the customer verifies in one app and signs somewhere else two days later. Nothing then links the person who verified to the person who signed.
Third: When Does a Business Need Identity Verification?
Why it matters: Identity verification adds a step for the signatory and a cost for the company. Using it on every contract is excessive, and omitting it on sensitive contracts is a risk.
| Case | Need for verification |
|---|---|
| Contracts with parties you do not know personally | High |
| High-value contracts or those involving financing | High |
| Lease and asset rental contracts | High |
| Regulated sectors such as financial services | May be a regulatory requirement |
| Employment contracts for remote employees | Medium |
| Internal acknowledgments with known employees | Low |
| Recurring contracts with a customer previously verified | Low |
How to decide: Set a clear rule for each type of contract, instead of leaving the decision to each employee. For example: every lease or financing contract requires identity verification, and every service contract with a known company needs only a code.
Example: A mortgage finance company requires identity verification from every buyer when signing the financing contract, while it settles for a WhatsApp code on addenda changing installment dates because the buyer was verified earlier.
Fourth: The Signatory's Experience
Why it matters: If the experience is difficult or confusing, the signatory abandons it or makes a mistake and is rejected for no real reason. Every needless rejection means delay and cost.
How to make it easy:
- Tell the signatory in advance that they will need their ID card and a phone with a camera.
- Ask them to be in a well-lit place.
- Remind them to remove sunglasses or anything covering the face.
- Make sure the document is valid and undamaged.
- Explain why you are asking for verification: to protect both parties from impersonation.
Common mistake: Not telling the signatory that verification is required, so they are surprised by it in a car or in a dark place without their card, and they postpone and then forget.
Example: A telecom company added a line to its invitation message saying: "You will need your national ID card and two minutes in a well-lit place." Rejections caused by unclear images fell.
Fifth: Handling Rejection and Review
Why it matters: Not every rejection is evidence of fraud. The image may be unclear, the document damaged, or the lighting poor. Conversely, a rejection may be entirely justified. The company needs a clear policy for both possibilities.
How to handle it: Decide in advance what happens on rejection: is another attempt allowed? Who decides in cases referred to review? Is the contract's sender notified? Since every attempt has a cost, some platforms put a limit on the number of attempts from a single link, and if verification is not accepted, the signatory contacts the contract's sender to have it resent.
Common mistake: Allowing unlimited attempts, so an impersonator keeps trying until they succeed, or the cost of attempts piles up for nothing.
Example: A signatory's verification was rejected because the ID image was cropped. The contract's sender was notified, contacted him and resent the request, and he verified successfully on the new attempt after photographing the whole card.
Sixth: Name Differences Between the Document and the Contract
Why it matters: One of the most common problems is that the name in the contract is shortened or written differently from the document. Is the signatory the intended party despite the difference?
How to handle it: Write the names in the contract in full, as on official documents, from the start, with four names where possible. If a substantial difference appears after verification, it is better not to approve the signature automatically but to present it to the contract's sender to confirm that the signatory is the intended party. In Wthaiq, when there is a substantial difference, the sender is shown the face image from the document and the name on it to decide, and the decision is recorded in the evidence report.
Common mistake: Writing a nickname or familiar name in the contract, then verification is rejected because the name does not match the document.
Example: A contract names "Ahmed Sami" while the document reads "Ahmed Sami Abdel Rahman Mahmoud." The difference here is an abbreviation, not a conflict, and the sender confirmed he was the intended party. But if the name on the document were "Mohamed Sami," a difference in the first name calls for a pause and follow-up.
Seventh: Privacy and Data Protection
Why it matters: Identity verification deals with sensitive personal data: a face image, a document image, an ID number and a date of birth. Egypt's Personal Data Protection Law imposes clear obligations on anyone who collects and processes this data.
- Specific purpose: Collect the data for the purpose of verifying identity in this contract, and do not use it for another purpose without consent.
- Notice: Tell the signatory that verification will take place and why, and in general terms who will process their data.
- Minimization: Do not require identity verification where it is not needed.
- Restricted access: Only those who need them should see verification results and images.
- Retention: Keep in the contract's record what proves the result, without copying document images in scattered places.
Common mistake: Uploading document images and verification results to shared folders that many employees can reach.
Eighth: Identity Verification and the Token
Why it matters: Both tie a signature to a specific person, but in two different ways. Knowing the difference helps you choose the better fit.
| Criterion | Identity verification | Signing with a token |
|---|---|---|
| What the signatory needs | A phone with a camera and an identity document | A token with a certificate from a licensed certification provider, and a computer |
| Time for the first use | Minutes | Days to obtain the token |
| Legal weight | High, with strong evidence | Highest |
| Suitable for | Remote contracts with individuals | High-value or conditional transactions |
Example: In a property sale contract, the selling company's representative signs with his token, and the buyer signs after identity verification by matching his face to his document, so the contract carries the strongest evidence from both sides without requiring the buyer to have a device he does not own.
Ninth: Identity Verification in In-Person Signing
Why it matters: Not every electronic signature takes place remotely. In bank branches, real estate sales offices and car showrooms, the customer comes in person and signs on a tablet or a computer in the office. An employee may think that being present makes any verification unnecessary, because he sees the customer in front of him. But the employee's sight is not stored in the contract's record, and if the signature is denied a year later, the employee will not remember the customer's face, and may have left the job altogether.
How to apply it: Make in-person signing go through the same identity verification, or signing with a token if the customer has one, so the evidence report stores what proves that the person present is the document's holder. The customer photographs his ID card and face on the office device, then signs, and his copy reaches him on his phone or email. That way the contract combines the advantage of presence, the ability to explain and answer questions, with the advantage of digital evidence that does not depend on anyone's memory.
Common mistake: The employee signs on the device instead of the customer "to speed things up," or settles for photographing the ID on his personal phone. The signature then actually comes from someone else, and document images scatter across employees' phones.
Example: A car showroom selling on installments used to have customers sign paper contracts and photograph their ID cards. After denial cases multiplied, the customer began to sign in person on a tablet after identity verification by matching his face to his card, so the result is stored with the contract and no image remains on employees' devices.
Wthaiq offers in-person signing in one of two ways: identity verification or signing with a token, so the contract's record and evidence are kept as if it had been signed remotely.
Tenth: Measuring How Well Verification Works in Your Company
Why it matters: Identity verification is an investment, and you are entitled to know whether it serves its purpose. If the rejection rate is very high, the instructions may be unclear to customers. If nobody is ever rejected, perhaps you are requiring verification on contracts that do not need it.
How to measure it: Each month, track the number of verifications, the acceptance, rejection and review rates, the common reasons for rejection, and the average time the signatory takes. Then improve what can be improved: the invitation message, the lighting instructions, or the list of contracts that require verification.
Identity Verification Checklist
- Have you determined which types of contracts require identity verification?
- Does verification take place within the signing flow itself?
- Have you told the signatory in advance what they need?
- Are the names in the contract complete as on the documents?
- Do you have a clear policy for rejection, review and number of attempts?
- Is the result stored in the evidence report?
- Do you comply with personal data protection principles?
Frequently Asked Questions
Is electronic identity verification secure?
When carried out through a specialized provider that checks the document and liveness and matches the face, it is a strong means of reducing impersonation.
How long does verification take?
Usually a few minutes, if the document is valid and the lighting is good.
What if the signatory has no valid ID card?
In some cases a passport can be used; otherwise it is wise to postpone signing until a valid document is available.
Does the sending company see the signatory's ID image?
That depends on the platform's settings and the company's policy, and it is wise that images are seen only when necessary.
Does identity verification replace the token?
In most contracts with individuals, yes. But when a body requires signing with an approved certificate, the token is still required.
Does the signatory need to install an app to verify their identity?
In most modern solutions, no. Verification takes place directly in the phone's browser using the camera, and then the signatory returns to the signing page to complete the remaining steps.
Conclusion
Electronic identity verification closes the gap left by a verification code, proving that the signatory is the holder of the document, not merely the holder of the phone. Use it where the risk is high, make it part of the signing flow itself, set a clear policy for rejection and name differences, and respect data privacy. If you want to add this layer to your sensitive contracts, try it on your next contract on Wthaiq. And review your policy periodically based on results, since the aim is for verification to protect your contracts without becoming an obstacle for your honest customers. Balance is the key to success here.
This article is for general awareness and does not constitute legal advice.