Verify Remote Contractor Identity & Location

This guide walks you through verifying a remote contractor’s identity and work location before granting system access, reducing fraud, data breach, and compliance risks. You’ll learn practical steps from initial documentation checks to ongoing monitoring, plus what to do when verification fails.

What You’ll Need

• Government-issued ID (passport, driver’s license, national ID)
• Proof of address (utility bill, bank statement, lease)
• Video conferencing tool (Zoom, Teams, Google Meet)
• Access to your HR or vendor management system
• Background check service (optional but recommended)
• IP geolocation tool or VPN detection service
• Company policy on remote work and data access

Step-by-Step

1. Collect identification documents upfront. Request a clear photo or scan of a government-issued ID and a recent proof of address. Ensure the documents are current and not expired. Store them securely in your HR system, encrypted if possible.
2. Perform a live video verification call. Schedule a video call with the contractor. Ask them to hold their ID next to their face and slowly turn it. Compare the photo, name, date of birth, and any visible features. Also ask them to show their surroundings briefly to confirm they appear to be in a residential or office setting consistent with their stated location.
3. Verify the address with a second proof. Ask for an additional document that shows their address, such as a utility bill or bank statement dated within the last three months. Cross-check the name and address against the ID and what they’ve told you.
4. Run a background check (if policy allows). Use a reputable service to verify identity, criminal history, and employment history. This step is especially important for roles with access to sensitive data or financial systems.
5. Check IP geolocation and VPN usage. When the contractor first logs in, capture their IP address. Use a geolocation service to see the approximate location. If the IP is in a different country or city than expected, or if it’s flagged as a VPN or proxy, investigate before granting access.
6. Set up multi-factor authentication (MFA). Require MFA using a mobile authenticator app or hardware token. This adds a layer of security beyond passwords and helps confirm the same person is logging in.
7. Grant least-privilege access. Start with the minimum permissions needed for their role. You can always add more later. Avoid giving blanket access to all systems.
8. Document everything. Record the date, time, method of verification, and who performed it. Keep copies of documents and notes in the contractor’s file. This is crucial for audits and compliance.
9. Conduct periodic re-verification. Set a schedule to re-verify identity and location every 6-12 months, or when there’s a change in role or access level. This catches issues like expired IDs or unauthorized relocation.

Common Mistakes

• Skipping the video call. Relying only on documents can be fooled by stolen or forged IDs. A live call is essential.
• Accepting low-quality images. Blurry or cropped documents may hide alterations. Always request high-resolution, well-lit photos.
• Ignoring IP anomalies. A contractor claiming to be in the US but logging in from another country is a red flag. Investigate before granting access.
• Not checking for VPNs. VPNs can mask the real location. Use a VPN detection service or ask the contractor to disable VPN during initial login.
• Granting access before verification is complete. This is the most critical mistake. Ensure all steps are done before issuing credentials.
• Forgetting to document. Without records, you can’t prove you did due diligence in case of an incident or audit.

Tips

• Use a consistent verification checklist for all contractors to avoid bias and ensure fairness.
• If the contractor is in a different timezone, schedule the call at a time that works for them—it’s a sign of good faith.
• Consider using a specialized identity verification service that combines document checks, biometrics, and liveness detection.
• Be transparent with the contractor about why verification is needed. Most understand it’s for security.
• If the contractor uses a PO box for their address, request a physical address for verification purposes.
• Keep your verification process updated with current best practices and legal requirements.

Troubleshooting

What if the contractor refuses a video call? This is a major red flag. Explain that it’s mandatory for security. If they still refuse, do not grant access and consider ending the engagement.

What if the ID looks altered? Ask for a second form of ID. Use a magnifier or zoom to check for tampering. If you’re still unsure, request a physical copy by mail or use a verification service.

What if the IP location doesn’t match? Ask the contractor to explain. They might be using a VPN or traveling. Ask them to disable VPN and re-login. If the location remains different, investigate further before granting access.

What if the background check reveals issues? Consult your legal and HR departments. Depending on the role and the nature of the issue, you may decide to not proceed or to adjust access levels.

What if the contractor’s documents are in a language you don’t understand? Use a translation service or ask for a certified translation. Never guess.

What if the contractor is in a country with different data protection laws? Consult your legal team to ensure compliance with local regulations regarding data storage and verification.

Frequently Asked Questions

Q: Is it legal to ask for a government-issued ID?
A: Yes, for employment and contractor verification purposes, as long as you comply with local privacy laws. Store the data securely and only use it for verification.

Q: Can I use a selfie as part of verification?
A: Yes, many services use selfie matching with the ID photo. It’s a common and effective method.

Q: What if the contractor works from a co-working space?
A: That’s fine. Ask for proof of the co-working space’s address and a utility bill or lease. The video call can show the space.

Q: How often should I re-verify?
A: At least annually, or whenever there’s a significant change in role, access level, or if you suspect something is off.

Q: What if the contractor is a high-profile individual with privacy concerns?
A: You can use a third-party verification service that handles sensitive data securely. Ensure they comply with privacy laws.

Q: Can I verify identity without a video call?
A: It’s risky. Video calls are the best way to confirm the person matches the ID. Without it, you’re more vulnerable to fraud.

Related

• Dig Ruby Guide: How to Use It
• Multi Site Hosting: What to Check Before Buying
• Malware Protection If You Turn Off S Mode