Identity Proofing

What is Identity Proofing and Why Does it Matter?

Identity proofing involves confirming that a person’s asserted identity aligns with their true identity. Chances are, you’ve encountered this procedure numerous times, whether at hotels, financial establishments, or when dealing with retailers.

As we increasingly bank, shop, and communicate through our devices, the convenience is accompanied by a significant risk: identity theft. Opportunistic fraudsters continually seek ways to pilfer our personal information, exploiting it for their own benefit.

In 2022, the FBI documented 27,922 instances of identity theft. Moreover, during Q4 2023 alone, the Federal Trade Commission (FTC) received a staggering 231,724 reports of identity theft. Data breaches involving personally identifiable information ranked among the crimes with the highest victim counts in 2022, as highlighted by the Internet Crime Complaint Center. Looking ahead, it’s anticipated that AI-driven identity theft scams will surge in 2024. Furthermore, according to the Bureau of Justice Statistics, in 2021, 12% of individuals aged 16 and above discovered that entities holding their personal information had suffered data breaches.

How Does Identity Proofing Work?

Identity proofing enables the verification of a user’s identity by assessing various factors such as their life history, which may involve scrutinizing credit reports, as well as biometrics, such as conducting facial scans. These measures are implemented before granting the user access to your system, ensuring a robust authentication process that enhances security and trust.

Identity proofing involves several steps to safeguard user identity:

Data Collection: Organizations gather user data through an Identity and Access Management (IAM) system, which manages user identities and access privileges. The IAM monitors access, modifies privileges, and maintains login histories.
Data Validation: Financial institutions verify company data by confirming its authenticity through documents, credit history, and employer identification numbers (EIN). A credible online presence and positive consumer reviews signal legitimacy.
Customer Identity Verification: Financial institutions rigorously verify customer identities, ensuring legitimacy and authority to make company decisions. This involves multiple layers of authentication, including usernames, passwords, and multi-factor authentication (MFA), along with human verification to thwart bots.
Continued Authentication: Authentication measures evolve over time, requiring users to frequently update passwords, verify contact information, and answer security questions. Multi-factor authentication may be periodically enforced, even on opted-out devices, to enhance security. Users may also be prompted to verify personal details to detect any changes or suspicious activity.

By streamlining these processes, organizations bolster security and protect user identities effectively.

Types of Identity Proofing

There are various methods available for identity verification in today’s date. A few of the popular approaches include:

Biometric Verification: Biometric verification offers a heightened level of security for authenticating one’s identity. This approach encompasses various methods such as fingerprints, facial recognition, and iris authentication, all of which necessitate the user’s physical presence to unlock their accounts. Some organizations also employ biometric selfies such as Face Match as an additional means to confirm identity, ensuring that the user is neither an imposter nor a bot.
Verification of Identity Documents: This involves confirming the authenticity of IDs such as driver’s licenses, passports, or government-issued IDs.
Liveness Detection: Liveness detection determines the authenticity of a selfie by detecting potential spoofing attempts, such as the use of face masks or presenting photos of photos.
Knowledge-based Authentication (KBA): This form of authentication relies on personal knowledge that typically involves creating security questions. Common examples include inquiries about one’s maternal grandfather’s name, the make and model of their first car, or the name of their elementary school. While theoretically, this information is known only to close family and friends, hackers have developed methods to gain access to it.
One-time Passcode (OTP) Verification: Sends a single-use passcode via SMS or email to the applicant during the verification process.
Trusted Identity Networks: Utilizes the applicant’s existing bank credentials to verify their identity, streamlining the onboarding process and reducing friction.
Out-of-band proofing: This is a robust verification method that demands multiple avenues to confirm identity. It operates as a form of two-factor authentication, where users first input their username and password, followed by entering a code received via email or SMS. This method significantly raises the bar for cyberthieves, as they would need to breach two distinct communication channels to compromise an account.

Compliance Requirements in Identity Proofing

As per the US National Institute of Standards and Technology, remote identity proofing entails three pivotal factors to ensure comprehensive protection: resolution, validation, and verification.

Identity resolution involves discerning a user’s identity within a customer database, population, or similar user-based system.
Identity validation entails gathering unique evidence from the individual, such as passwords, security questions, etc.
Identity verification occurs before conclusively confirming that the evidence submitted aligns with the provided data.

Consequences of Inadequate Identity Proofing Measures

Without proper identity proofing, a few major problems can arise:

Increased Identity Theft: This is the big one. Without verification, imposters can easily steal someone’s identity and use it for fraudulent purposes. This could involve opening new accounts, taking out loans, or even committing crimes in another person’s name.
Data Breaches and Fraud: Since fake accounts can be created, data breaches become more impactful. Hackers can gain access to a wider pool of personal information, leading to financial losses and identity theft for many people.
Money Laundering: Criminals can exploit weak identity proofing to launder money. By creating fake identities or using stolen ones, they can move dirty money through the financial system without getting caught.
Loss of Trust: If consumers experience identity theft or fraud due to lax identity proofing, they’ll lose trust in businesses and online platforms. This can damage a company’s reputation and lead to lost customers.
Compliance Issues: Many regulations require businesses to implement strong identity proofing measures. Failing to do so can result in hefty fines and legal trouble.
Reputational damage: Security breaches attract negative media attention, causing significant reputational harm and undermining stakeholder confidence. Restoring trust and credibility becomes challenging once a breach occurs.

Conclusion:

Identity proofing serves as a cornerstone in fostering trust between digital platforms and their users. It plays a crucial role in enhancing the digital customer experience, particularly in remote application and onboarding scenarios where abandonment rates pose a significant challenge. Lengthy verification procedures often lead to customer frustration and abandonment. Digital identity proofing alleviates this issue by enabling customers to verify their identity remotely, eliminating the need for physical visits to branches. This streamlined process not only accelerates verification but also enhances convenience and security for users.