What Uber’s driver selfie teaches IT

Uber keeps checking that the driver it verified is the one behind the wheel. Most companies verify an employee once, at hire, and never again.

Suvodeep Sinha on X (opens in a new tab)Suvodeep Sinha4 min read
A man in a grey suit steps out of the back of a black Uber Black car onto the curb

If you’ve taken an Uber in the last few years, your driver has probably taken a selfie before picking you up. Not for fun. Uber asks drivers, at random, to snap a photo before they go online, and compares it to the verified photo on the account. If it doesn’t match, the account is paused.

Every one of those drivers had already passed a background check. Uber built the selfie check anyway, back in 2016, because screening only proves who signed up. It doesn’t prove who is driving tonight. Accounts were being shared and rented, and the person a rider trusted was not always the person behind the wheel.

DoorDash went further. Dashers take regular selfies, can be asked to verify right after a delivery, and get checked again when a model spots a login that looks off. More than 150,000 Dashers complete these checks every week.

In brief

  • Uber matches a driver’s selfie to a photo it verified once, because a background check proves who signed up, not who is driving tonight.
  • Most companies verify employees once, at hire. After that, a password, a laptop or a convincing help desk call stands in for the person.
  • Attackers use that gap: US laptop farms for North Korean IT workers, real-time deepfake interview personas, and help desk password resets.
  • Three choices carry over to IT: check against a face you already trust, check at the moment of risk, and keep it fast for honest people.
  • TruU Identity Verification verifies a new hire once, issues a passwordless credential, and checks against that same identity at a new laptop, a lockout or a help desk call.

Now look at how most companies treat their employees.

Most verify people once, at hire. A recruiter sees a face on a video call, HR collects documents, IT ships a laptop and emails a temporary password. From then on, the password, the laptop and anyone who can talk their way past the help desk all count as “the employee.”

That gap is exactly what attackers use:

In each case, the person who was verified and the person with access have quietly come apart. Uber’s account-sharing problem, with a company laptop and admin rights attached.

What we can borrow from Uber

Three choices make Uber’s check work, and they carry over to IT.

  1. Check against a face you already trust. Uber doesn’t re-run a background check every shift. It matches a selfie to a photo it verified once. For employees, the strong check happens at hire: a government ID, a liveness check, and a match to the person who interviewed. That verified face becomes the reference.
  2. Check at the moment of risk. Uber checks before a driver can take a rider. The enterprise equivalents are easy to name: day one, a new device, a password or MFA reset, access to something sensitive. Those are the moments to ask “is this still the same person?”
  3. Make it fast for honest people. Uber’s check takes seconds, and more than 99% of drivers are verified. If re-verification feels like re-onboarding, people will route around it, and so will your help desk.

Frequently asked questions

Why isn't a background check at hire enough?

A background check proves who signed up, not who is using the account today. Uber found driver accounts being shared and rented after drivers had passed screening, so in 2016 it began asking drivers for a selfie and matching it to the photo on the account.

What is identity re-verification for employees?

Re-verification confirms that the person using an employee's account is the person who was verified at hire. Like Uber's selfie check, it compares a quick check against a reference face that was verified once, properly, at onboarding.

When should IT re-verify an employee?

At moments of risk: day one, a new device, a password or MFA reset, and access to something sensitive. Those are the moments to ask whether this is still the same person.

Won't re-verification slow employees down?

It shouldn't. Uber's check takes a few seconds. If re-verification feels like re-onboarding, people will route around it, and so will the help desk.

How does TruU Identity Verification re-verify employees?

TruU verifies a new hire once, using the proofing provider the company already trusts or TruU's own, then issues a passwordless credential, so there is no temporary password to intercept or share. Later checks, at a new laptop, a lockout or a help desk call, are made against that same verified identity.

Where we come in

That’s how we built TruU Identity Verification. We verify a new hire once, properly, using the proofing provider you already trust or ours. Then the verified person goes straight into a passwordless credential, so there is no temporary password to intercept or share. The same verified identity is what we check against later, when someone gets a new laptop, gets locked out, or calls the help desk.

Uber figured out years ago that a background check is a starting point, not a guarantee. It’s time IT did the same.

About this article

This article draws on public reporting from the companies and agencies named. Sources:

All posts
Book a Demo (opens in a new tab)Start Free (opens in a new tab)