IDnow: Putting a new face on identity verification

By Charlie Roberts, Head of Business Development UK&I at IDnow

Munich headquartered IDnow is an identity verification provider which uses AI-based technology to check all security features on ID documents. With its Identity Verification-as-a-Service (IVaaS) platform that combines humans and technology, IDnow has set out to make the connected world a safer place, by enabling the identity verification of more than seven billion potential customers from 193 different countries.

IDnow’s expert knowledge of German regulation, which is considered one of the most highly regulated markets globally, has become critical. Indeed, the firm is currently in talks with the UK government about creating “immunity passports” for people who have recovered from Covid-19 to determine how recently someone has been tested and whether they can return to work.

Since launching its solutions in the UK in November last year, IDnow has seen enormous demand from organisations for its AI-based products.  Compared to the same period in 2019, the firm has reported a 358% increase in order intakes as Covid-19 accelerates the need for digital processes

So why the increased demand? We caught up with Charlie Roberts, Head of Business Development UK&I at IDnow, to talk about the AI identity verification market and how AI can help financial services organisations detect and mitigate identity fraud.

So why has IDnow seen such increased demand for its identification products?

While technology is – on the whole – changing the way people do business for the better, it nevertheless carries with it a certain degree of risk to security.  In the current climate in particular, with an accelerated move towards buying and selling online, identity fraud is on the rise. In fact, our research estimates this type of fraud has doubled in the last year alone. And, while banking and financial services may be the lowest hanging fruit in terms of targets for attempted identity fraud, the threat is certainly not restricted to this sector.

The problem is the cost to the economy. In June this year, Action Fraud announced that over £6.2m has reportedly been lost in the UK due to coronavirus-related scams, making cyber fraud one of the biggest threats in our economy and the fastest growing crime.

So we have seen an enormous uptick in enquiries about AutoIdent and VideoIdent because of their combined human and machine approach. Any identity verification check that doesn’t look 100% accurate gets automatically passed through to a human for extra security, all on the same platform, in a matter of minutes.

What are the most common fraud methods?

Of all fraud methods, social engineering is the biggest issue for companies. It has become the most common fraud method in 2019, accounting for 73% of all attempted attacks. It lures unsuspecting users into providing or using their confidential data and is increasingly popular with fraudsters, being efficient and difficult to recognise.

Fraudsters trick innocent people into registering for a service using their own valid ID. The account they open is then overtaken by the fraudster and used to generate value by withdrawing money or making online transfers.

They mainly look for their victims on online portals where people search for jobs, buy and sell things, or connect with other people. In most of the cases, the fraudsters use fake job ads, app testing offers, cheap loan offers, or fake IT support to lure their victims. People are even contacted on channels like eBay Classifieds, job search engines and Facebook.

Fraudsters are also creating sophisticated architecture to boost the credibility of these cover stories which includes fake corporate email addresses and fake websites.

In addition, we are seeing more applicants being coached, either by messenger or video call, on what to say during the identity process. Specifically, they are instructed to say that they were not prompted to open the account by a third party but are doing so by choice.

How can we fight social engineering?

The first priority is to ensure people are aware of the problem, and then ensure people have the right technology in place to be able to track fraudulent activity and react quickly.

Crucially, it requires a mix of technical and personal mechanisms. Some methods include:

• Device binding: To make sure that only the person who can use an app – and the account behind it – is the person who is entitled to do so, the device binding feature is highly effective. From the moment a customer signs up for a service, the specific app binds with their used device (a mobile phone for example) and, as soon as another device is used, the customer needs to verify themselves again.
• Psychological questions: To detect social engineering, even if it is well disguised, trained staff can be used as an additional safety net both during detection, but also in addition to the standard, automated checks at the start of the verification process. They can ask a customer an additional set of questions once a risk of a social engineering attack has been detected. These questions are constantly updated as new attack patterns emerge.
• Takedown service – with every attack, organisations can learn. This means constantly checking new methods and tricks to identify websites which fraudsters are using to lure in innocent people. And, by working with an identity verification provider that has good links to the most used web hosts, they are able to take hundreds of these websites offline.

Is social engineering the only type of identity fraud?

No! There is also false identity fraud. Our research indicates fake IDs are available on the dark web for as little as £40 and some of them are so realistic – including the use of holograms – they can often fool human passport agents. The most commonly faked documents are national ID cards, followed by passports in second place. Other documents include residence permits and driving licenses.

Similarity fraud is another method of identity fraud in use, although it’s not as common thanks to the development of easier and more efficient ways (like social engineering). This method involves the use of a genuine, stolen, government-issued ID that belongs to a person with similar facial features.

Can anything be done about this?

Biometric security is extremely effective at fighting this kind of fraud. It can check and detect holograms and other features like optical variable inks just by moving the ID in front of the camera. Machine learning algorithms can also be used for dynamic visual detection.

To fight similarity fraud, biometric checks and liveness checks used together are very effective – and they are much more precise and accurate than a human could ever be without the help of state-of-the-art security technology.

The biometric checks scan all the characteristics in the customer’s face and compares it to the picture on their ID card or passport. If the technology confirms all of the important features in both pictures, it hands over to the liveness check. This is a liveness detection program to verify the customer’s presence. It builds a 3D model of their face by taking different angled photos while the customer moves according to instructions.

The biometric check itself could be tricked with a photo but, in combination with the liveness check, it proves there is a real person in front of the camera.

This all sounds like a significant time investment for companies?

It does but, if you can find a solution that offers both a fully automated system AND a video identification solution on a single platform, then it becomes pretty friction-free and part of the workflow. In fact, customers can be checked in a matter of minutes. Organisations worldwide need to be taking this very seriously. With over 1.9 billion websites and counting, there is a huge potential for fraud, and it’s a serious problem that must be slowed down.

The threat of identity fraud is not going away and, as fraudsters become more and more sophisticated, so too must technology. With the right investment in advanced technology measures, organisations will be in a much stronger position to stop fraudsters in their tracks and protect their customers from the risk of identity fraud.