How Do Banks Verify Identity: Documents, Databases, and Denials

Banks verify your identity by following a federally required Customer Identification Program: they collect four pieces of information from you — your full legal name, date of birth, street address, and taxpayer identification number — then check those details against a government-issued photo ID and one or more databases before letting the account open. The rules come from Section 326 of the USA PATRIOT Act, and every bank in the United States has to follow them, whether you walk into a branch or apply on your phone.¹

The Four Pieces of Information the Bank Will Ask For

Federal rules set a floor. Before opening any account, the bank must gather:

Your full legal name, as it appears on your government-issued ID.
Your date of birth.
A residential or business street address. A standard P.O. box does not qualify. If you don’t have a fixed street address, the bank can accept a military APO or FPO address, or the street address of a close relative or other contact person.
A taxpayer identification number. For U.S. citizens and residents, that’s usually a Social Security number. If you aren’t eligible for an SSN, an Individual Taxpayer Identification Number (ITIN) works, because federal rules define any IRS-issued taxpayer ID as acceptable.

For non-U.S. persons, the bank can substitute a passport number with the country of issuance, an alien identification card number, or a number from another government-issued document showing nationality or residence with a photograph.¹

Which ID Documents Banks Accept

The regulation names examples rather than mandating one specific document. In practice, these are the forms banks accept most consistently:

A driver’s license or state-issued ID card. This is the standard document for in-person openings.
A U.S. passport or passport card. Useful if your driver’s license address is out of date.
A Permanent Resident Card (green card) for lawful permanent residents.
A foreign passport for non-U.S. persons, paired with the passport number the bank collected as your identification number.

Some banks also accept a Matricula Consular, the Mexican government’s consular ID card, as a photo ID for non-U.S. persons. The Treasury Department declined to prohibit it when the CIP rules were written, but individual banks decide whether to take it.¹

Whatever document you present, it needs to be unexpired, legible, and show a photo that still looks like you. For online applications, scans or photos should capture all four corners of the document in good lighting. Blurry, cropped, or damaged images get rejected routinely.

The Database Checks Running in the Background

Handing over your documents starts the process, not finishes it. Within seconds of submitting your application, the bank sends your information through several verification systems.

Social Security Number Verification

Banks can confirm your SSN through the Social Security Administration’s electronic Consent Based SSN Verification (eCBSV) service. The system checks whether the name, date of birth, and SSN you gave match SSA records, and returns a yes-or-no answer. If something doesn’t match — a name change, a typo, or a number that may have been stolen — the bank is told which element failed.²

Banking History Reports

Most banks also pull a report from a specialty consumer reporting agency like ChexSystems or Early Warning Services. These agencies track checking account applications, openings, closures, and the reasons for closure, including involuntary closures for overdrafts or suspected fraud. A negative record can lead to a denial or an offer of a limited account.³

Credit Bureau Queries

Some banks query one or more of the three major credit bureaus (Equifax, Experian, and TransUnion) during account opening. Checking account history is generally not in a standard credit report, so when banks pull credit data at this stage they’re usually confirming that you exist at the address you gave, or checking for active fraud alerts and credit freezes, rather than evaluating your credit score.⁴

Non-Documentary Verification

When documents alone don’t settle the question, or when a database check fails, federal rules allow several fallbacks. The bank can contact you directly to confirm details, compare your information against public databases, check references with other financial institutions, or ask for a financial statement. These methods matter especially for applicants who can’t easily present a standard photo ID.¹

How Online Verification Works

When you apply through a mobile app or website, the bank can’t examine your ID in your hands, so it substitutes technology for the in-person look.

Selfie and Liveness Checks

Most online applications ask you to photograph both sides of your government ID and then record a short selfie video. The bank’s software compares your face to the photo on the ID by measuring facial landmarks and calculating a similarity score. To keep someone from beating the system with a still photo or an AI-generated deepfake, the software also runs a liveness check: you may be asked to blink, turn your head, or follow a moving dot with your eyes. Fall below the similarity threshold and you’ll be prompted to retake the images or visit a branch.

Device Signals

While you’re doing all that, the bank is quietly recording details about the device you’re using: IP address, operating system, browser type, hardware fingerprints. If the same device has appeared in earlier fraudulent applications, the bank may flag or deny your application even after the biometric check passes. You don’t see any of this happen.

Knowledge-Based Authentication Questions

If the automated checks come back inconclusive, some banks fall back on knowledge-based authentication (KBA): a short set of multiple-choice questions pulled from your credit history that only you should be able to answer. You might be asked to identify a former street address, name the lender on a past auto loan, or confirm the year you opened a specific credit card. These are sometimes called “out-of-wallet” questions because the answers don’t sit on a stolen driver’s license.

The questions are timed. Running out of time counts as a failure, and most banks give you one or two retries before suspending the online application and asking you to come into a branch.

KBA is on the way out. The National Institute of Standards and Technology’s current digital identity guidelines state that knowledge-based authentication “does not constitute an acceptable secret for digital authentication,” largely because the answers surface in data breaches or can be pieced together through social engineering. NIST also flags KBA as error-prone and frustrating for legitimate users. Many banks are shifting to biometric verification and one-time passcodes sent to a phone number already on file.⁵

Business Accounts Add Another Layer

The four data points and the ID check cover personal accounts. Opening an account for a business is broader, because the bank has to verify both the entity and the people behind it. Expect to provide the business’s legal name, its Employer Identification Number, and documentation proving the entity legally exists (articles of incorporation, an LLC operating agreement, or a partnership certificate filed with the state). Federal anti-money-laundering rules also require the bank to identify and verify beneficial owners: anyone who directly or indirectly owns 25 percent or more of the entity, plus at least one individual with significant day-to-day control. Each of those individuals goes through the same four-data-point identity check you would as an individual applicant.⁶

What Happens If the Bank Denies Your Application

If a bank turns you down based on information in a consumer report, including a ChexSystems or Early Warning report, federal law gives you a way to respond.

The Adverse Action Notice

Under the Fair Credit Reporting Act, the bank has to tell you about the denial and give you the name, address, and toll-free phone number of the reporting agency whose data contributed to the decision. The notice also has to state that the reporting agency didn’t make the denial decision and can’t explain why it was made. From that notice, you have 60 days to request a free copy of the report the bank used, and you can dispute anything in it you believe is inaccurate or incomplete.⁷

Disputing What’s in Your Record

If your ChexSystems report contains an error, such as a closed account that wasn’t yours, you can file a dispute with ChexSystems online, by phone at 800-428-9623, or by mail. The reinvestigation has to be completed within 30 days, or 21 days if you live in Maine. If you send additional documentation while the investigation is pending, the deadline can extend by up to 15 days. Helpful documents include an identity theft affidavit, a police report, account statements, or a letter showing the debt was paid or settled.⁸

Second-Chance Accounts

If the negative marks are accurate and you can’t dispute them, some banks and credit unions offer second-chance checking accounts built for applicants who’ve been turned down elsewhere. They often carry monthly fees and may limit features like check writing or overdraft access, but they give you a route back into the banking system while you work on the underlying record.

How Long the Bank Keeps Your Records

Once verified, your identifying information doesn’t get discarded when you close the account. Federal rules require banks to keep the identifying information they collected (name, date of birth, address, and taxpayer ID) for five years after the account is closed. Descriptions of the documents used to verify you, the verification methods, and how any discrepancies were resolved must be kept for five years after the records were made. For credit card accounts, the clock starts when the account is closed or becomes dormant, whichever comes later.¹

1
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
2
Social Security Administration. Electronic Consent Based Social Security Number Verification (eCBSV) Service
3
Consumer Financial Protection Bureau. Chex Systems, Inc.
4
Consumer Financial Protection Bureau. Will It Hurt My Credit If My Bank or Credit Union Closed My Checking Account
5
NIST Pages. NIST Special Publication 800-63-4 – Digital Identity Guidelines
6
FinCEN. CDD Final Rule
7
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
8
ChexSystems. Dispute