Design a Profile Verification System

Medium45 min
1 / 30
understanding•10 min read

Problem Statement: Binding a Real Identity to a Social Profile

Frames profile verification as an attestation pipeline with a PII vault, not a form with a badge.

Problem statement

Design a profile verification system for a social platform that confirms a real human identity using official documents, selfies, or phone verification, and reduces fake and bot accounts. The system must collect sensitive artifacts (ID photos, selfies, liveness video, phone numbers), validate authenticity with automated checks, route ambiguous cases to human reviewers, issue and revoke a verified badge, and then retain or securely destroy the sensitive data according to privacy law.

This is not a CRUD feature. It is an adversarial, regulated, multi-modal pipeline sitting on top of the social graph. The platform must decide, under attack, whether a stranger is who they claim to be, using evidence that criminals actively forge with generated selfies, stolen document scans, replayed liveness videos, and virtual phone numbers. Meanwhile, every artifact the system touches is a privacy liability: an ID document is a permanent identity token, a face embedding is biometric data under laws like BIPA and GDPR Article 9, and a leaked vault of selfies is an unrecoverable breach.

Why the problem is distinctive

A feed system can retry a ranking call. A verification system cannot retry a leak. Three properties separate it from ordinary social features. First, asymmetric sensitivity: the data is collected once, but its misuse risk lasts for years, so the default posture is minimization and deletion, not retention. Second, adversarial adaptation: every detection rule (document glare checks, liveness challenges, OTP velocity limits) is probed and bypassed by fraud toolkits, so the pipeline must be measurable and retrainable, not static. Third, regulatory asymmetry: the same feature is routine identity confirmation in one jurisdiction and special-category biometric processing requiring explicit consent in another.

Public evidence shows the scale of both the threat and the category. Meta has reported removing hundreds of millions of fake accounts per quarter, with company-reported figures exceeding one billion removals in some quarters of 2022. LinkedIn crossed one billion members in late 2023 and rolled out identity verification with CLEAR in the U.S. and Persona internationally. X's 2022 relaunch of paid verification without strong identity binding produced a visible impersonation wave, a cautionary lesson this design must address. Identity verification vendors report massive throughput: Jumio announced passing one billion identity verifications, and Veriff claims support for more than 11,000 document types from 235 countries and territories. These are cited company-reported figures, not our design targets.

The five architectural planes

  1. Capture plane: in-app guided document and selfie capture, quality checks, compression, chunked upload.
  2. Decision plane: document authentication, biometric matching, liveness, phone OTP, risk scoring, and the final decision ledger.
  3. Review plane: human review queues, QA sampling, appeals, and reviewer governance.
  4. Badge plane: badge issuance, projection into profiles and search, revocation, and expiry.
  5. Governance plane: consent records, retention and crypto-shredding, audit trail, vendor oversight, compliance reporting.

A strong answer keeps these planes separate. The badge plane may degrade (a badge renders late) without weakening the decision plane, and the governance plane can destroy raw artifacts without invalidating the stored decision. The brief's four functional requirements - collect artifacts, validate authenticity, issue a badge, retain or discard data - map one-to-one onto these planes, and every later section is traceable back to them.

Key Highlights

  • •Verification is an adversarial attestation pipeline, not a form submission with a badge toggle.
  • •Sensitive artifacts are collected once but carry years of misuse risk, so the default is minimization and deletion.
  • •Public signals: Meta reports removing hundreds of millions of fake accounts per quarter; LinkedIn crossed 1B members and ships CLEAR/Persona verification; Jumio reports 1B+ verifications processed.
  • •Five planes: capture, decision, review, badge, governance - each degrades independently.
  • •The badge is a projection of an immutable decision ledger; the ledger never depends on the badge cache.
Lead With Attestation, Not the Badge
State in the first two minutes that the system produces an auditable attestation bound to evidence, and the badge is only a projection of that verdict. This separates a trust architecture from a UI feature.
Do Not Draw a Form and a Database
A design where selfies land in the same bucket as profile pictures, with no encryption split, no retention policy, and no adversarial model, fails both the security review and the interview.

Section Rescue Kit

Buzzwords to use:

AttestationData Minimization

Safe statements:

  • "I will separate the verdict, which must be durable and auditable, from the raw evidence, which should be short-lived."
  • "Before choosing services, let me define which data is collected, which is checked, which is stored, and which is destroyed."
Design a Profile Verification System - System Design | WinJob | WinJob