Digital literacy · 2026-10-29
Identity Evidence Is Different from Authentication Secrets
An identity check and an authentication secret serve different purposes. A person claiming to verify identity has not established a right to every document, password or one-time code.
An identity check and an authentication secret serve different purposes. A person claiming to verify identity has not established a right to every document, password or one-time code.
Identify the requester and purpose
Record who is asking, what information is requested and what purpose is stated. A name or logo in a message is not sufficient evidence of the requester’s identity. Claims about authority need support rather than repetition.
Look beyond collection
An explanation of data handling should address who receives the material, how long it is retained and what deletion arrangements are described. Missing statements should remain marked as missing. Do not infer a legal or security guarantee from the word “verification”.
Keep passwords and one-time codes out of public chats and screenshots. A request to prove who you are does not make it appropriate to hand over the secrets used to access your account.
Redaction needs to preserve the question being asked
An evidence copy can show that a message requested an identity document without showing the document itself. Keep the request's wording and date, while removing personal identifiers from the shared copy. The recipient can then understand the scope of the request without receiving the sensitive material. Preserve private originals separately if they are needed for your own record.