Visitor Identity Verification: OTP, ID, Photo and Watchlists

Published on 10/21/2026 • Updated on 10/23/2026

A SaaS company in Hyderabad discovers, during an incident review, that a man who walked its floor for an hour as a "printer technician" was nobody's technician. The register has his entry: a name, a phone number that rings unanswered, and a signature. The receptionist did nothing unusual; she followed the process exactly. The process simply never asked the only question that mattered: is this person who they say they are, and does anyone inside expect them? The review's conclusion is uncomfortable and useful: the register recorded the visitor perfectly and verified nothing at all.

Recording and verifying are different jobs. A register records whatever a person writes; verification checks it against something independent. This guide walks through the verification ladder for visitor identity: OTP confirmation, ID capture, photo logs, host confirmation and watchlists, when each rung is worth its friction, and how to combine them without turning reception into an interrogation. It builds on our analysis of the paper visitor register as a security vulnerability and our security guard entry checklist.

Recording is not verifying

The paper register's quiet assumption is that writing something down makes it true. Every field is self-reported: the name is what the visitor says, the phone number is what they write, the "whom to meet" is unconfirmed until the host happens to be called. A determined intruder does not need to defeat this system; they only need to write neatly. And the honest visitor's data is not protected either, since every later visitor can read it.

Verification adds an independent check to at least one field: something the visitor holds (a phone that receives an OTP), something they show (a government ID, captured), something they look like (a photo matched at future visits), or someone who vouches (the host confirming from inside). No single check is perfect; each one raises the cost of lying from "write neatly" to "arrange evidence", and that cost shift is what deters the ordinary opportunist, who is the actual threat model at most gates.

The verification ladder, rung by rung

Matching friction to risk

The design question is not "how much verification can we buy" but "how much does each category need". A practical ladder by category: hosted office visitors get host confirmation plus OTP; interview candidates get the same (they are hosted strangers); contractors and vendors add photo and, for recurring ones, ID capture at enrolment; high-security zones (data centers, cash handling, R&D labs) run the full stack including watchlist screening; and deliveries get vehicle-plus-driver capture at the gate rather than person-level verification at reception.

Two rules keep the friction honest. First, apply verification by category and zone, not by guard's mood; a system that lets the gate decide per person will drift to the easiest path within a month, and drift is how the printer technician happens. Second, make the verified path the fast path: pre-registered visitors with a QR should check in faster than the register ever allowed, so nobody lobbies to skip verification to clear a queue.

What each method proves and misses

Rolling it out without a revolt

Verification fails politically before it fails technically. Employees resent hosts who must approve them "like outsiders", and visitors resent a desk that feels like an embassy. Two moves defuse both. First, announce the why through a recent incident or near-miss, anonymised but real: verification imposed after a scare is accepted, verification imposed as bureaucracy is resisted. Second, launch the frictionless version first: pre-registration with QR entry for a month, so the organisation's first experience of the new system is speed, and the verification runs underneath where nobody feels it. Then layer walk-in approvals, then ID capture for the categories that need it.

Give reception the authority and the script. The guard who must tell a senior vendor "your host has not approved you yet, let me ping them" needs to know the policy backs him, and needs words that make it routine rather than accusatory. The script writes itself once the system does the asking: it is the platform that pings the host, the platform that asks for the OTP, and the guard merely facilitates. That transfer of awkwardness from person to process is most of what you are buying.

Reader Q&A

Bottom line

This week, test your own gate: note three entries and check whether any field was verified against anything independent. If every field is self-reported, your register is a storybook, and the incident review that proves it has simply not happened yet.

This quarter, put host confirmation and OTP on the default flow, add photo and ID capture to the categories that need them, and make the verified path the fast path. The metric to watch is the share of entries with at least one independent verification; from zero to ninety percent is typically a month, and the gate's whole character changes with it.