# What Is Requester Verification? Definition | Kodex Source: https://www.kodexglobal.com/glossary/requester-verification > Requester verification confirms the person behind a data request is a real, authorised officer. Learn why document checks alone are not enough. Verification & Fraud ## Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. Also known as agent verification, law enforcement verification Verification is the point at which a data request programme either has a security model or does not. Everything else (intake, triage, scoping, production) assumes the requester is legitimate. Verification is the step that tests the assumption. ### Verifying the document versus verifying the person These are different activities and are routinely conflated. Document validation asks whether the request is well-formed: is it the right instrument for the data sought, is it signed, does it cite a plausible authority, is it within scope. This catches errors and unsophisticated forgeries. Requester verification asks whether the human behind it is real and authorised. This is what catches a well-crafted request from a compromised account, which document validation cannot. Document validationRequester verification What it checks The request artefact The person making it Catches fabricated agencies Yes Yes Catches spoofed domains Partly Yes Catches compromised genuine accounts No Yes Can be done from the request alone Yes No, requires an independent channel The bottom two rows are the whole argument. Any check performed entirely on material the attacker supplied can be satisfied by an attacker who controls that material. ### What verification actually involves - Independent channel. Contact the agency through a route the requester did not supply. - Identity of the individual. Confirm the named officer is serving at the agency named, not merely that the agency exists. - Authority for this request. A serving officer is not automatically authorised to make every kind of request. - Consistency with history. Prior legitimate contact from the same agency and officer is meaningful context; a first-ever contact arriving as an urgent emergency request is not. ### Why it is hard at scale A single callback is easy. Several hundred requests a month across dozens of jurisdictions, each with different agency structures, contact directories, and identity conventions, is an operations problem. Teams that verify manually tend to converge on verifying only the requests that already looked suspicious, which inverts the logic. The requests worth verifying most carefully are the ones designed to look routine. This is the structural argument for verification infrastructure rather than verification procedure: a check that only happens when someone is already worried is not a control. FAQ ### Frequently asked questions Is checking the sender’s email domain a form of verification? It verifies the channel, not the person. A domain check confirms the message came from an agency’s mail system, which is exactly what is true during a law enforcement email compromise attack. Domain checks are worth doing and are not sufficient on their own. What is the minimum viable verification step? A callback to the agency on a number sourced independently of the request, from the agency’s official website or a known directory, never from the request itself. It is fast, it requires no special tooling, and it defeats attackers who control a mailbox but not the agency’s phone system. How do you verify without slowing down genuine emergencies? By separating verification from disclosure. Preserve the data immediately, which costs a genuine investigation nothing, then verify before disclosing. A callback takes minutes, and a real officer in a real emergency will accept one. Glossary ### Related terms #### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. #### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. #### ORI Number An ORI number is a nine-character Originating Agency Identifier assigned by the FBI to US criminal justice agencies authorised to access national systems. It identifies which agency an action came from, and it is a useful corroborating signal in verification, though it is not a credential. #### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. See how Kodex verifies requesters against a network of 15,000+ agencies. Learn more