Identity Verification Is Changing:
What Mailbox Operators Should Know About AI and Deepfakes
October 1, 2026
A new member uploads an ID and a selfie. The application looks complete. But has their identity been verified, or have their documents simply been collected?
For coworking spaces, virtual office providers, and mail centers, identity verification is about more than simply having documents on file. USPS establishes specific identification and Form 1583 requirements for CMRAs, while modern identity-proofing guidance, such as NIST’s Digital Identity Guidelines, illustrates why verifying the person behind those documents matters increasingly in remote onboarding.
AI has made that distinction even more important. Images and videos can now be manipulated in ways that make it harder to determine whether the person completing the verification process is actually who they claim to be.
The answer isn’t to make every member jump through more hoops. It’s to understand what your verification process actually checks and know what happens when something needs a closer look.
Sofia Stolberg
CEO & Founder of PilotoMail
Sofia is the CEO and cofounder of Piloto 151 and PilotoMail. After launching her region’s first coworking space in 2013, she cracked the code to scaling beyond square footage through Virtual Offices and mail automation. Today, she helps operators unlock higher profits with her Freedom from Square Feet methodology.
What are deepfakes, and why should mailbox operators care?
Deepfakes are AI-generated or manipulated media that can make someone appear to be another person. In remote onboarding, forged images and video can be used to challenge document checks, facial comparisons, and human reviewers.
A related risk is an injection attack, in which manipulated or forged media is inserted between the capture point and the system performing the verification. NIST identifies both forged media and injection attacks as risks to remote identity proofing.
In July 2025, NIST finalized Revision 4 of its Digital Identity Guidelines, which includes controls addressing threats such as injection attacks and forged media. NIST’s Digital Identity Guidelines offer a useful framework for evaluating modern remote identity-proofing controls, but they are technical security guidance – not a new USPS requirement for CMRAs or a mandate to purchase a particular detection tool.
For your business, the useful question is: What does our onboarding process actually check?
1. Don’t confuse collecting an ID with verifying an identity
Uploading a document, checking its authenticity, and establishing that it belongs to the applicant are different steps. A completed upload does not, by itself, establish all three.
NIST’s identity-proofing framework distinguishes among identity resolution, validation, and verification: collecting the necessary identity evidence and information, determining whether that evidence is authentic and accurate, and confirmingthat the applicant is the rightful owner of the evidence. Keep your USPS obligations separate, too.
CMRAs still must follow USPS requirements for acceptable identification, address verification, Form 1583 completion and signature, CRD uploads, and ongoing record maintenance, including quarterly CRD certification. A successful selfie or biometric check does not replace those obligations.
Start by mapping your onboarding process. For each step, identify:
- Who handles it?
- What information or result do you receive?
- What is actually being verified?
- What happens when the verification cannot be completed?
Understanding the process helps your team recognize the difference between having documents on file and having a reliable identity-verification workflow.
2. Ask your verification provider better questions
“Do you use AI?” won’t tell you much about how an applicant is checked.
Instead, ask questions that help you understand what happens behind the verification step.
| Ask your provider | What you need to understand |
|---|---|
| How do you validate identity documents? | Which authenticity checks are performed, and what are their limitations? |
| How do you address manipulated photos and video? | Whether protections cover both presentation attacks, such as showing a photo to a camera, and injected media. |
| How are your controls tested? | Which attacks are tested and how missed fraud and incorrectly flagged applicants are measured. |
| What happens when a check is inconclusive? | Who reviews it, what your team sees, and how legitimate applicants can resolve the issue. |
These questions reflect NIST’s emphasis on tested controls and exception handling and can serve as a useful framework when evaluating verification providers.
A face match or “liveness” claim should not be treated as a guarantee against every attack.
No single check removes every possible risk. What matters is understanding what the technology does, where its limitations are, and what process your team follows when something requires further review.
3. Give your team a review process - not a guessing game
A failed check is not automatically fraud.
Technical problems, poor image quality, difficulty capturing documents, or other issues can also interrupt verification.
Create a simple escalation path:
Flag the issue → assign a reviewer → follow the approved verification process → document the outcome.
For example, when a member cannot complete a check, staff should know whom to contact and what instructions to provide, not improvise an approval because the person “looks legitimate.”
Keep review notes factual. Record what failed, what was reviewed, and how the issue was resolved rather than labeling someone fraudulent without evidence. Also avoid turning an exception into a request for every document the member owns. Follow your approved collection and retention procedures and use secure channels rather than scattered inboxes.
The goal is to give your team a repeatable process for exceptions instead of asking employees to make judgment calls without clear guidance.
Where PilotoMail fits
PilotoMail’s Compliance Hub brings together identity and address verification, Form 1583 workflows, compliance-status visibility, and alerts for information requiring attention.
These capabilities support a more organized onboarding and compliance process instead of leaving your team to manually track every step.
The important distinction is between managing compliance workflows and assuming any system eliminates identity fraud. Technology can help standardize processes, automate repetitive work, surface information that needs attention, and make compliance easier to manage. Your team should still understand the checks your verification provider performs and how exceptions should be handled.
Your staff does not need to become deepfake detectives. They need a clear process, appropriate verification tools, and a reliable path for review.
The goal is not more paperwork. It’s greater confidence in who is behind the application.
Explore PilotoMail’s Compliance Hub to bring member onboarding, verification, and ongoing compliance into one workflow.