Is the ID Request From the Survey Platform, the Researcher or the Payout Provider?

Do not upload an ID until you know who is asking and why. A survey platform may legitimately verify that each participant is a real, unique person. A researcher inside an ordinary survey normally has a different role and may be prohibited from collecting direct identifiers without prior approval. A host site or payout provider can also introduce verification at withdrawal. The same document request can therefore be legitimate, excessive or fraudulent depending on its owner, channel and disclosed purpose.

Pause at the request screen

Save the platform, study title, researcher name, URL, document requested, reason, processor, privacy notice, deadline and reward. Do not photograph the ID until the request has been verified through the platform's own account or support channel.

Use the Four-Party ID Request Map

The requester determines the expected process.

• Survey platform: verifies participant uniqueness, age, country or account security
• Researcher or advertiser: collects study data under the consent and platform rules
• Offerwall or reward host: controls the credited balance and account review
• Payout provider: applies its own identity and compliance process before payment

A platform-level identity check can be legitimate

Prolific currently verifies participants through its account flow and Onfido, using a physical ID and selfie video. It states that the purpose is to confirm unique real participants and protect research quality. This is a platform policy, not a universal rule for every survey site.

The channel matters as much as the request

Prolific says ID verification requests come through official support and never through researcher accounts or the internal messaging system. An authentic-looking researcher message that asks for a passport outside the platform workflow should therefore be rejected and reported.

A researcher should not silently add direct identifiers

Prolific's current researcher rules prohibit collecting direct identifiers in an ordinary study without prior written approval and a participant-facing notice. Approved personal-data studies should disclose the collection before consent. Other survey platforms use their own rules, so verify the host policy.

KYC at cashout is a different checkpoint

A reward host or payout provider may allow surveys before asking for identity at withdrawal. That requirement can be legitimate under its published terms, but it changes the route. The user should have been able to discover it before completing enough work to create a locked balance.

Apply the Necessity and Data-Flow Audit

Require clear answers before continuing.

• Exact purpose of the document and legal or platform basis
• Minimum document fields needed for that purpose
• Identity of the controller and verification processor
• Data transmitted back to the survey platform or researcher
• Storage location, retention period and deletion route
• Whether the document is used for biometrics or face matching
• What happens to the account, submission and reward after refusal

Data minimisation is a useful test

The ICO describes personal data as adequate, relevant and limited to what is necessary for the stated purpose. A request for a complete passport copy, selfie, address and unrelated financial data for a ten-cent opinion survey needs a stronger explanation than an age-band or country check.

The reward does not make the data cheap

Identity documents can support impersonation or account takeover when mishandled. Compare the expected approved reward with the document sensitivity, processor, retention period and future account value. A small reward can rationally be refused even when the platform is legitimate.

Worked legitimate platform request

A participant signs up directly through a known survey platform. The account settings show an ID-verification task handled by the processor named in the privacy notice. The platform explains which fields it receives and the user can review the policy before taking any studies. The request is identifiable and can be accepted or refused as an account-level decision.

Worked researcher red flag

Halfway through a consumer-preference survey, an external form asks the participant to upload a passport and utility bill to receive a $0.50 crypto reward. The study preview disclosed no personal-data collection and the platform account shows no verification request. The user exits, saves the page and reports the researcher.

Worked deferred-withdrawal decision

A host allows several surveys without documents but requires an ID and selfie before crypto cashout. The requirement appears in current support documentation. A user who does not want that verification should stop before more work, not use false information or attempt to evade the check.

Never alter or borrow identity documents

Do not submit another person's ID, edit a document, falsify country data or use VPN changes to preserve access. These actions can violate terms, trigger fraud controls and expose another person's identity. Refusal is safer than bypass.

If the document was uploaded to a suspicious form

Save the domain and request, notify the legitimate platform, change exposed account credentials and monitor for identity misuse. Follow local identity-protection and reporting guidance. Do not pay anyone who promises to delete the document or recover a reward.

The continue-or-refuse rule

Continue only when the requester, purpose, processor, data flow and refusal outcome are disclosed and proportional to the account or study. Refuse and report a request that appears inside an ordinary study without notice, uses an unrelated domain or pressures immediate upload for a tiny reward.

Privacy and survey sources — July 30, 2026

Current platform and regulator documentation was used as concrete evidence. It does not establish the rules of every survey provider or provide a legal conclusion for every jurisdiction.

• Prolific participant identity-verification process: https://participant-help.prolific.com/en/articles/445010-verifying-your-identity-faq
• Prolific repeat identity checks and official channel: https://participant-help.prolific.com/en/articles/445076-why-have-i-been-asked-to-recheck-my-identity
• Prolific researcher personal-data rules: https://researcher-help.prolific.com/en/articles/445117-can-i-ask-participants-for-their-personal-information-identifiers
• Prolific participant data handling: https://researcher-help.prolific.com/en/articles/445116-participants-personal-data
• ICO data-minimisation principle: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/

FAQ