Identity theft and fraud are a big deal – everyone knows it. And most companies are super aware, and are even offering identity services as well. Five years ago, it was enough to know who a customer was online. Today, though, visit any industry trade show and the halls are packed with identity verification products. It seems every company wants to get in on the action.
Why now? The public has become very aware of security incidents that have compromised their data and that of others, and it’s making them ask the tough questions: What does identity mean to them? Who are they, who has their documents and data and how are those things being stored and secured?
The industry has responded by spawning countless solutions, and there is eventually going to have to be regulation covering all these different products. Moreover, there must be some sort of gold standard for identity truth and how to confirm it.
Jumio vice president of products Philipp Pointner is among those experts.
Can I See Some ID?
Perhaps counterintuitively, the key to the future may lie in the past, Pointner said. Customers are comfortable being asked to present their government-issued IDs in brick-and-mortar settings. Why not have them do the same with online businesses?
Jumio, the software company that Pointner is president of, can recognize various types of ID from 250 different countries, Pointner explained, including multiple generations of IDs from all 50 U.S. states. The company knows exactly what these government-issued identity documents should look like, from security characteristics to items encoded in the document to how the photo should be held in place (to prevent fake IDs being used).
Where Device Verification Falls Short
Device fingerprinting determines whether the device making a transaction is the same one that the user was on when he created the account, but it cannot account for a device that has been stolen or for fraudsters who are able to make remote web traffic appear to come from a local point of origin.
Similarly, location services can be used to show whether a purchase is being made from within a reasonable radius of the customer’s usual activity, but it runs into the same roadblock if fraudsters are spoofing IP addresses.
Biometrics have made huge leaps forward in recent years, Pointner noted, and they can confirm that a certain human characteristic — such as a fingerprint, eye print, voice print or other identifiers — is present, thus verifying that the same person is conducting the activity.
However, he argues that biometrics fall short at the point of origin: Who is enrolling the fingerprint? Is this person who he or she is claiming to be? Whether it’s the same fingerprint this time and next time becomes irrelevant if the person who enrolled it in the first place is a fraudster. In that case, Pointner said, a real-world identity check does offer some advantage because a merchant or bank teller can hold up a photo ID next to a customer’s face and compare the two.
“The photo is what ties it to the real-world person,” Pointner said. “Jumio does the same thing online, making it a ‘person-present’ transaction.”
From Plastic to Digital Identity
The big question is whether customers would willingly use a method like this, especially since security researchers have cast doubt on the integrity of Apple’s new Face ID authentication method by fooling it with masks. Pointner still thinks the answer is yes — if not today, then tomorrow.
People have grown used to recording videos of themselves, he said, especially younger generations that are taking a hundred selfies a day. Why not leverage what they’re already doing on Snapchat, Instagram, Facebook and elsewhere to keep their data safer?
Pointner believes physical ID cards will one day give way to digital IDs. Many governments are already experimenting with this approach, he explained, and others are using distributed ledger and blockchain technology to create identity systems, an application that makes sense if innovators can make it work.
As digital natives grow up, it seems likely these methods will also make a lot of sense to them — certainly more sense than the paper, plastic and static identifiers that their parents once used.
But, don’t trash that nice leather wallet just yet.
“Digital identities are definitely going to come,” Pointner said, “but the plastic will stay in our wallets for a while longer.”