Identity Proofing

What is identity proofing?

Identity proofing is a means of verifying and authenticating the identity of a person trying to access a service or system. Also referred to as identity verification, identity proofing confirms that an identity exists in the real world, and that the individual presenting that identity is its true owner. In financial services, identity proofing often focuses on new, or unknown, customers interacting with a bank for the first time, such as during an account opening, application, registration, or enrollment process.

With an increasing demand for more remote processes due to the COVID-19 pandemic, identity proofing provides financial institutions with a safe and secure way to determine if someone is who they claim to be in an online interaction. Identity proofing also helps protect financial institutions and their customers against fraud and security threats such as application fraud and new account fraud.

How identity proofing works

Identity proofing plays an important role in both new account opening and authentication scenarios. For example, identity proofing comes into play when a remote applicant attempts to open a new account, as the financial institution must be able to confirm the applicant’s identity before issuing them credentials. Identity proofing also plays a role in account maintenance scenarios, such as when an existing bank customer attempt to change their address, or add a spouse or child to their account. In this case, identity proofing is used as a “step-up” method of authentication for an existing customer.

According to Gartner, “Identity proofing services which verify people’s identities before the enterprise issues them accounts and credentials…These services are also used as an additional interactive user authentication method, especially for risky transactions, such as accessing sensitive confidential information or transferring funds to external accounts. Identity-proofing services are typically used when accounts are provisioned over the Web or in a call center. However, they can also be used in face-to-face interactions.”

There are multiple methods of identify proofing available in the market today. Some popular methods include:

• Identity Document Verification: Checks that the ID (e.g., driver’s license, passport, government ID) is legitimate.
• Biometric Verification: Uses selfies to establish that the person presenting the ID is the same individual whose portrait appears on the ID.
• Liveness Detection: Determines whether a selfie is genuine by detecting spoofing attacks like face masks, or photos of photos.
• Knowledge-based Authentication (KBA): Generates “out of wallet” questions based on information in the applicant’s personal credit file.
• One-time Passcode (OTP) Verification: Transmits a single-use passcode via SMS or email to the applicant during the verification process.
• Trusted Identity Networks: Leverages the applicant’s existing bank credentials to verify their identity and reduce friction during onboarding.

 

How identity proofing helps fight fraud

Identity proofing helps financial institutions verify the identity of new customers and authenticate existing customers over the lifecycle of their relationship with their bank to help reduce different types of fraud.

Identity proofing helps in the fight against application fraud, especially given that remote account opening is where application fraud is most likely to occur. When opening a new account remotely, a new applicant is asked to verify their identity by scanning both the front and back of their identity document, such as a driver’s license, passport, or national ID card. Advanced authenticity algorithms and artificial intelligence (AI) analyze the image and data on the identity document, producing an authenticity score to determine whether it is genuine or fake. When ID document verification is paired with facial comparison technology (a user-submitted “selfie” that is compared to the photo on the ID document), fraudsters tend to abandon their attempts at application fraud. According to Jumio, “we have seen 80% less fraud in customers who require both an ID and a selfie verification compared to those that just require the government-issued ID.” The added benefit for the bank is that when application fraud is caught early on, it significantly reduces the possibility of having to mitigate new account fraud later in the customer lifecycle.

How does biometric identity proofing deter application fraud?

Biometric verification can also help prevent application fraud. For example, facial comparison uses algorithms to pull biometric data from a facial image, like the position and size of a person’s eyes, into a standardized data set. Comparing two biometric data sets can determine whether two images are from the same person. If one image is from a pre-verified source like a government-issued identity card and the second image is a real-time selfie photo taken by the applicant with their smartphone at the time of their application, facial comparison can prove the person’s identity and their live presence to help detect application fraud. Application fraud was second only to account takeover fraud as the most pressing challenge for financial institutions, according to research from Aite Group.

Identity proofing is a key ingredient for ongoing fraud monitoring because it helps ensure that the person claiming the identity is its true owner and is genuinely present during the application and onboarding processes.

Identity proofing case study

Identity Proofing Improves Automotive Financing for Financial Services Arm of Major Auto Manufacturer

The Challenge: The Spanish division of a large European captive auto-finance provider wanted to digitize their financing process using identity proofing and e-signatures to enable customers to access finance digitally. The solution needed to identity proof applicants by verifying the authenticity of their passport and national ID card to protect against fraud, and all agreements needed to be signed using an as Advanced Electronic Signature.

The Solution: After a successful agreement automation deployment in the UK, the Spanish division turned to OneSpan to help digitize their auto loan process using document identity verification, one-time passwords and e-signatures. The auto-finance provider’s customers can now complete their motor finance agreement digitally in over 160 dealerships across Spain.

The Benefit: The finance provider’s automated finance agreement process now takes place through a browser-based digital experience. The customer’s name, address, and DOB are captured electronically making the process is easier and faster for customers and reducing manual errors.

Identity proofing plays a key role in helping to protect the finance provider from application fraud as the customer’s ID document is verified using document verification. Once the customer’s identity has been verified, the customer can consent to the agreement with an advanced e-signature. The implementation was so successful that it is now being rolled out across the provider’s dealerships in France, as well as being used to digitize remote finance use cases.

Compliance considerations for identity proofing

Identity proofing practices need to comply with the National Institute of Standards and Technology (NIST) guidelines for digitally validating a person’s identity. NIST defines three key components for matching a person’s claimed identity to their actual identity. While these terms are often used interchangeably, NIST sets them out as three distinct parts of the identity proofing process:

• Identity resolution: Uniquely distinguishing a person’s identity in the context of the population or system.
• Identity validation: Collecting evidence from the person and checking if it is authentic, valid, and accurate.
• Identity verification: Confirming and establishing a link between the claimed identity and the real-life existence of the person presenting the evidence.

Expected Outcomes of Identity Proofing, according to NIST

According to NIST, the expected outcomes of identity proofing are to:

• Resolve a claimed identity to a single, unique identity within the context of the population of users the CSP (Certified Service Provider) serves.
• Validate that all supplied evidence is correct and genuine (e.g., not counterfeit or misappropriated).
• Validate that the claimed identity exists in the real world.
• Verify that the claimed identity is associated with the real person supplying the identity evidence.

How identity proofing benefits the customer

Identity proofing makes the digital customer experience smoother because abandonment remains a key challenge in remote application and onboarding processes. If customers are faced with a lengthy verification process, they often abandon the process in frustration. Digital identity proofing gives customers the means to prove their identity remotely, without having to make a physical visit to the branch, making the process faster, convenient, and more secure.