Short answer: A verified self-showing checks a prospect four ways before handing over access: scan their government ID, match a live selfie to that ID's photo, screen the identity for fraud/watchlist hits, then release a code only inside a defined access window — with every step logged. Fail any check, and no code goes out.
A prospect texts back at 8:40 p.m. asking to see a vacant unit that same night. Ten minutes later, someone is standing at the door holding an access code — and there's no way to tell from the code alone whether that's the applicant who requested it, a friend they handed it to, or a stranger who intercepted a forwarded text. That gap between "requested a showing" and "is physically inside the unit" is exactly what identity verification is built to close, and it has to close it before the code ever leaves the system.
Why Does a Self-Showing Need Identity Verification Before Access?
Because a code by itself doesn't verify anyone — it verifies that someone has a string of digits. In the National Multifamily Housing Council's 2024 Pulse Survey on Fraud, 93.3% of respondents said they'd experienced rental fraud in the prior 12 months, and 70% of those who experienced it reported identity theft, fraudulent ID documents, or use of someone else's personal information.
That's not just an industry-survey number. The FBI's Internet Crime Complaint Center logged 9,359 real estate fraud complaints in 2024 — a category that explicitly includes rental and timeshare fraud — totaling more than $173.5 million in reported losses, and that's only the fraud that got reported.
Self-showings raise the stakes further than a staffed showing does. A leasing agent standing next to a prospect can glance at a driver's license and catch an obvious mismatch. An unattended showing has no one there to look — the access system is the only checkpoint. If that checkpoint is a static code with no identity behind it, the unit is effectively unlocked to whoever holds the string.
Step 1: What Happens During the Government-ID Document Scan?
The prospect photographs the front and back of a government-issued ID, or scans a passport. The system reads the document through OCR, checks the format against known templates for that document type and issuing authority, and flags expired IDs or structurally invalid layouts.
That check matters less on its own than it used to. Digital document forgeries rose 244% year-over-year and overtook physical counterfeits as the most common form of document fraud in 2024, according to Entrust's 2025 Identity Fraud Report. A scanned fake can now pass a template check cleanly — which is exactly why the document scan is step one, not the whole system.
Step 2: How Does the Selfie Liveness Match Catch a Deepfake?
Right after the document scan, the prospect takes a live selfie — sometimes prompted to blink or turn their head, sometimes analyzed passively for depth and texture. The system matches that live face against the photo on the ID and confirms the selfie came from an actual person in front of the camera, not a printed photo, a video replay, or a synthetic face.
This is the step that catches what the document scan can't. Entrust's 2025 report found a deepfake identity-fraud attempt occurred every five minutes in 2024 — fabricated faces are common enough now that liveness detection is a required layer, not an optional add-on.
Step 3: What Does the Fraud and Watchlist Screen Check For?
Once the ID and the live face match, the verified identity runs through a fraud and screening layer — the same category of check a bank runs before opening an account. That covers sanctions and watchlist screening, plus pattern checks: has this same document already been used under a different name, does the device or connection show signals typical of a fraud ring, has this identity been flagged elsewhere in the system.
This step is what turns "the ID looks real and the face matches" into "this is a screenable person with no active red flags" — closing the gap between a document that passes inspection and an identity that's actually safe to grant access to.
Step 4: Why Is the Access Code Time-Boxed Instead of Always-On?
Passing verification isn't the end of the flow — it's the gate the code sits behind. The code releases only inside the prospect's confirmed showing window, tied to the identity that just cleared the first three checks. Outside that window, or without a pass, there's no code to hand over, forward, or intercept.
This works the same whether the unit has a smart lockbox or an ordinary offline lock with a static code. With a smart lockbox, the system can issue a single-use code tied to the window. With an offline lock, the code itself doesn't change — but the prospect never sees it until their verified window opens, so the gate sits on disclosure, not on the hardware. Either way, a self-showing lockbox setup doesn't have to be the expensive part of getting this right.
Step 5: What's in the Audit Trail, and Why Keep It?
Every step above gets logged: which identity was verified, when, which code was issued, and when that code opened the door. That record answers the question that matters most if something goes wrong in the unit — who was actually inside, and when.
It also protects the ordinary case. If a prospect disputes a showing, or an owner asks who's been through a vacant unit this month, the audit trail is the answer — not a guess based on a calendar entry and a hope that the right person showed up.
Does All This Slow Down a Legitimate Renter?
Barely, if it's built right. A verified prospect scans an ID and takes a selfie on their phone — the whole sequence typically runs under a couple of minutes, and it happens once, not at every visit. The friction that actually drives good prospects away isn't a document scan and a selfie; it's a clunky flow that asks for more than it needs, or a process so opaque the prospect isn't sure what's happening to their information.
The goal isn't maximum friction — it's the minimum verification that still closes the gap a bare code leaves open. Get that balance right, and a self-showing stays bookable at 8:40 p.m. on a Tuesday, and the person who shows up is the person who was supposed to.
LetHub verifies a prospect's identity with bank-level checks before any self-showing code releases. See it on a live unit — book a demo.
Frequently Asked Questions
How do property managers verify identity before a self-showing?
By running the prospect through a government-ID scan, a live selfie match against that ID's photo, and a fraud/watchlist screen — then releasing a time-boxed access code only if all three pass, with the entire sequence logged for later reference if a question ever comes up.
What is bank-level ID verification for a self-showing?
Identity verification with the same rigor a bank uses to confirm who's opening an account: document authentication, biometric liveness matching against that document, and fraud/watchlist screening — all applied before an access code is ever issued, not reviewed after the fact.
Can a fake ID get past a self-showing verification system?
A convincing document alone sometimes can — which is why the document scan is step one, not the whole check. Digital forgeries rose 244% year-over-year as of 2024 per Entrust, so verification systems pair the scan with a live selfie match that a static forged document can't pass.
Does self-showing ID verification work without a smart lockbox?
Yes. Verification is separate from the lock hardware — it works whether the unit has a smart lockbox's single-use codes or an ordinary offline lock's static code, since the gate is on when the code gets disclosed to the prospect, not on the lock mechanism itself.
