How Lemonade verifies its global workforce and secures passwordless access with Incode
Incode verifies workers anywhere in the world, and confirms the real person before they set up a passwordless login.
Lemonade, an AI-native insurance company, uses Incode to verify its global workforce. Workers prove who they are with a government ID and a live selfie before they get access, and Incode confirms the real, enrolled person again before a passkey or new device is set up. Because identity verification is automated, onboarding happens the moment someone is ready, in any time zone.
a global workforce, onboarded the moment they are ready
passkeys set up securely and remotely, from the start
waiting on the security team to verify an identity
moments covered: onboarding, passwordless enrollment, and access resets
Insurance that runs on automation
Lemonade brings automation to insurance, with a workforce supporting customers internationally, around the clock.
Many of its people are hired remotely, through agencies, and work across many time zones, so they need to be onboarded and have access to their tools when they are ready to go.
For a company that runs on automation, identity has to be certain. Workforce identity verification lets Lemonade onboard remote workers safely and tie every passwordless login to a real, verified person, without putting a security team member in the middle.
A global workforce, active around the clock
Lemonade’s workforce needs access to its tools when people are ready to go, not when someone on the security team is available to verify their identities.
Three realities shaped the requirement:
-
01
Manual verification does not scale
Manual identity verification does not scale across time zones, and it adds friction to onboarding, slowing productive people down.
-
02
Passwordless raised the bar
Lemonade moved to passwordless login years ago, and it needed an equally strong way to let people set up their passkeys remotely, from the start.
-
03
Remote makes identity harder
In an office, identity verification is natural. Remotely, the easy availability of deepfakes makes accurate identification a significant challenge.
The goal was straightforward: accurate, automated identity verification that avoids friction and strengthens Lemonade’s security.
Verified identity, from enrollment to reset
Lemonade deployed Incode Workforce as an additional identity assurance layer for its remote personnel, integrated into its existing identity provider.
Remote workers, verified before access
Identity Verification
A remote worker proves who they are with a government ID and a live selfie, binding a verified, real-person identity to their account before they ever get access, from any country Lemonade allows and on the personal device they have. The check confirms the document’s authenticity and validates that the face matches it, so the person who logs in is the person who was hired.
Passwordless factors, enrolled securely
Authentication
When someone sets up passwordless login or adds a new device, Incode verifies they are the real, enrolled person first. The moment that matters most is enrollment, and Incode handles it up front, plugging into Lemonade’s existing identity provider so every passwordless login is tied to a person Incode has actually verified.
Self-serve resets
When someone needs to reset access, they re-prove their identity and pick up where they left off, instead of waiting on a video call. What was a hands-on, one-at-a-time task becomes a self-serve moment.
Deepfake and injection defense
Deepsight
Deepsight adds defense against synthetic and swapped faces and injection attacks, so automated verification stays trustworthy even as the attack vectors evolve.
One identity layer doing two jobs at once: proving a global workforce is who they say they are, and making sure every passwordless login is set up for the right person. In production, and still expanding.
How it works
Automated and trusted, worldwide
Anyone, anywhere, anytime
Personnel enroll themselves remotely, from various countries and time zones, using their national IDs, in a flow simple enough to need no IT or security support.
Accurate enough to automate
Validation runs without an individual in the loop and detects deepfakes and synthetic faces during the selfie step. Lemonade requires evidence over checkbox compliance.
Certified, benchmarked accuracy
Incode’s passive liveness detection is iBeta certified (Levels 1–3), and its face recognition accuracy is evaluated in the NIST FRTE 1:N benchmark.
Privacy is the architecture
Incode made privacy a founding conviction long before regulation or the market asked for it. Its AI-first identity verification reduces fraud while remaining private and compliant.
Testimonial
“Our workforce is global and active 24 hours a day. Allowing onboarding to occur when it needs to rather than when a Security member is available removes friction. Having accurate, automated ID verification keeps everyone unblocked, and us secure.”
Jonathan Jaffe · CISO, Lemonade
Frequently asked questions
Questions specific to the Lemonade story
Still have questions? Talk to an expertHow does Lemonade verify remote workers?
Workers verify remotely with a government ID and a live selfie. Incode confirms the document is authentic and that the face matches it, binding a verified identity to the account before access is granted.
How does Lemonade secure passwordless and passkey enrollment?
Before a passkey or a new device is enrolled, Incode re-verifies that the person is the real, enrolled individual. The check runs through Lemonade’s existing identity provider, so each passwordless factor belongs to a verified person.
What happens when a Lemonade worker needs to reset access?
A reset runs through the same identity check as enrollment. The worker re-verifies that they are the enrolled person and regains access on the spot, picking up where they left off. The security team stays out of the loop, with no video call to schedule and no request to handle by hand.
How does Lemonade defend against deepfakes during verification?
During the selfie step, Deepsight screens for synthetic and swapped faces and injection attacks, keeping the automated check trustworthy as attack methods evolve.
Why did Lemonade automate workforce identity verification?
Its workforce is global and active around the clock, and manual verification does not scale across time zones. Automation onboards people the moment they are ready, without waiting on the security team.
Does verification work across countries and time zones?
Yes. Personnel enroll themselves remotely from any country Lemonade allows, using their national IDs, on the personal device they have.
What's next
See how Incode verifies the modern workforce
Verify every worker, wherever they are, and make every passwordless login belong to a verified person.