Select where you would like to search:

  • Search Store
  • Search Site

IDScan.net Blog

The Latest ID Scanning News and Updates

A Comprehensive Guide to Bank Screening Sanctions

/in /by

Screening sanctions refer to the process of screening individuals, organizations, or countries against a list of sanctioned entities maintained by the US government. US banks are required to comply with these screening sanctions in order to prevent money laundering, terrorist financing, and other illegal activities.

The US government maintains several lists of sanctioned entities. These lists contain the names of individuals, entities, and countries that are subject to various US sanctions, such as asset freezes, travel restrictions, and trade embargoes.

US banks are required to screen their customers, transactions, and business partners against these lists on an ongoing basis. This involves using sophisticated screening tools and processes to detect potential matches between the names on the lists and the names of the bank’s customers or counterparties. If a potential match is detected, the bank may be required to investigate further and report the matter to the appropriate authorities.

What Lists Do Banks Check?

US banks are required to check several lists maintained by the US government in order to comply with screening sanctions requirements. The primary lists that US banks are required to check include:

Specially Designated Nationals and Blocked Persons (SDN) List:

An SDN (Specially Designated Nationals) Blocked Persons List is a list maintained by the Office of Foreign Assets Control (OFAC), which is part of the U.S. Department of the Treasury. This list includes individuals, organizations, and entities that are subject to economic sanctions imposed by the United States.

The purpose of the SDN list is to identify and restrict transactions or dealings with individuals or entities that are involved in activities that pose a threat to national security, foreign policy objectives, or international stability. These individuals or entities may include terrorists, narcotics traffickers, arms dealers, and individuals associated with prohibited regimes or activities.

When a person or entity is included on the SDN list, it means that their assets are blocked or frozen within U.S. jurisdiction, and U.S. persons and businesses are generally prohibited from engaging in financial or business transactions with them. This helps prevent the listed individuals or entities from accessing funds, resources, or support from U.S. sources.

The SDN list serves as a tool for compliance with U.S. sanctions laws and regulations. It is important for businesses, financial institutions, and individuals to check the SDN list regularly to ensure they are not engaging in prohibited activities or dealing with blocked persons.

You can search the list at any time here.

Foreign Sanctions Evaders (FSE) List:

The Specially Designated Nationals (SDN) list and the Foreign Sanctions Evaders (FSE) list are both maintained by the Office of Foreign Assets Control (OFAC) within the U.S. Department of the Treasury. However, they serve different purposes and target different types of individuals and entities.

The FSE list is a subset of the SDN list that specifically targets individuals and entities that have violated, attempted to violate, or facilitated deceptive practices to evade U.S. sanctions. The FSE list primarily focuses on individuals, entities, and vessels involved in activities aimed at circumventing U.S. sanctions on countries or entities subject to specific sanctions programs. These individuals and entities may have engaged in deceptive practices or illicit schemes to avoid sanctions enforcement.

So essentially, the FSE List is a list within a list, of individuals who have been caught trying to circumvent their inclusion on broader sanctions lists.

Sectoral Sanctions Identifications (SSI) List: 

The Sectoral Sanctions Identifications (SSI) List is another list maintained by the Office of Foreign Assets Control (OFAC) within the U.S. Department of the Treasury. It differs from the Specially Designated Nationals (SDN) list and the Foreign Sanctions Evaders (FSE) list in terms of its focus and application.

The Sectoral Sanctions List (SSI List) is designed to target specific sectors of the Russian economy. It identifies entities operating in certain sectors that are subject to restrictions due to their connection with the Russian government or involvement in financial services, defense contracting, or the Russian energy sector. These restrictions are imposed as part of U.S. sanctions measures in response to Russia’s actions in Ukraine and it’s annexation of Crimea.

Consolidated Screening List (CSL): 

This list is maintained by the US government that includes a check against all of the above lists, in addition to several other lists maintained by various other government agencies, including:

Entity List

Maintained by the U.S. Department of Commerce, the Entity List identifies entities that are subject to export control restrictions due to involvement in activities related to national security, foreign policy, or nonproliferation concerns.

As an example, in May 2019, the U.S. Department of Commerce added Huawei and its affiliates to the Entity List due to concerns related to national security. This designation placed certain restrictions on U.S. companies’ ability to export or transfer technology, software, or components to Huawei without specific licenses. The Entity List inclusion for Huawei was based on allegations that the company’s activities posed a risk to U.S. national security and that it had violated U.S. laws and regulations. The specific restrictions imposed on Huawei were aimed at limiting its access to sensitive technology and products of U.S. origin.

Denied Persons List

Also maintained by the U.S. Department of Commerce, the Denied Persons List consists of individuals and entities that are prohibited from participating in export activities due to violations of export control laws or other reasons.

As an example, Alexander Fishenko was a Russian-born naturalized U.S. citizen and the owner of an electronics company called Arc Electronics Inc. who was added to the Denied Persons list in 2012.

Alexander Fishenko and several other individuals associated with Arc Electronics were added to the Denied Persons List due to their involvement in illegal export activities. Fishenko and his company were accused of illegally exporting sensitive technology and dual-use items, including microelectronics, to Russia without the required export licenses. Fishenko is now essentially classified as a spy by the US government because of the severity of his activities.

The inclusion on the Denied Persons List imposed severe restrictions on Fishenko and his associates, prohibiting them from participating in any export activities involving items subject to U.S. export controls. It effectively barred them from engaging in future exports or re-exports of controlled goods, software, or technology.

Unverified List

The Unverified List is another list maintained by the U.S. Department of Commerce and includes entities that have been flagged as high-risk due to inadequate or unverifiable information about their activities.

The Unverified List serves as a tool for U.S. exporters and companies involved in international trade to exercise caution when engaging in business transactions with entities on the list. It indicates that the listed entities have been identified as lacking sufficient documentation or verification, which could raise concerns regarding their adherence to export control laws and regulations.

The primary purpose of including entities on the Unverified List is to encourage U.S. companies to conduct additional due diligence and obtain reliable information before proceeding with transactions involving entities listed. It is a precautionary measure to mitigate potential risks associated with inadequate documentation or unverified entities.

Many new businesses may appear on the Unverified List due to insufficient historical documentation, so this list is meant to serve as a yellow flag so that banks perform a deeper level of due diligence.

Nonproliferation Sanctions

This category includes entities and individuals subject to U.S. sanctions related to the proliferation of weapons of mass destruction (WMD), such as nuclear, chemical, or biological weapons.

The specific individuals and entities included on the Nonproliferation Sanctions list can vary over time as new designations are made or existing designations are updated or removed. The list typically targets individuals, companies, organizations, and even entire countries that have been involved in activities related to WMD proliferation.

The sanctions imposed on individuals and entities listed on the Nonproliferation Sanctions list can include restrictions on trade, financial transactions, and other forms of engagement with the designated parties. These measures aim to deter and disrupt the proliferation of weapons of mass destruction and associated technologies.

It is worth noting that the CSL is primarily focused on U.S. export controls and sanctions. However, it can also be a useful resource for compliance with other international trade regulations. Considering the cumulative total across all these lists, it is reasonable to estimate that the number of individuals listed could range from several thousand to tens of thousands of individuals for whom KYC protocols dictate at minimum enhanced due diligence, if not outright prohibition of business interaction.

Penalties for Noncompliance with Sanctions Screening

Non-compliance with screening sanctions can result in severe penalties for US banks, including fines, reputational damage, and loss of business. Therefore, it is essential for US banks to have robust compliance programs in place to ensure that they are effectively screening for sanctioned entities and complying with US sanctions requirements.

Civil Monetary Penalties

US banks that fail to comply with screening sanctions requirements may be subject to civil monetary penalties, which can range from thousands to millions of dollars depending on the severity of the violation. These penalties may be imposed by regulatory agencies such as the Office of the Comptroller of the Currency (OCC), the Federal Reserve, or the Financial Crimes Enforcement Network (FinCEN).

Criminal Penalties

In cases of willful and deliberate noncompliance, US banks may be subject to criminal penalties, which can include fines and imprisonment for individuals involved in the violation. This is rare as most white collar financial crime is not prosecuted criminally.

Damage to reputation

Noncompliance can lead to significant reputational damage for US banks. This can include negative media coverage, loss of customer trust, and a decline in business.

How to automate Sanctions Screening

Screening sanctions and other forms of digital identity verification are imperative to prevent money laundering, terrorist financing, and other illicit activities, so it is important to use a robust screening service. The easiest method is to integrate with a provider who has pre-established access to all of these lists, and can perform checks across these lists quickly and efficiently. Integrating with each database individually is time consuming for any business, so we recommend using a single third party check which can do the heavy lifting of KYC/AML at once.

Additionally, you’ll want to integrate remote ID validation into your onboarding process at the outset in order to verify the customer’s identity up front, so that you can be sure you are checking a real person, and not an identity thief or fraudster against these lists.

Contact us to learn more and receive a free demo of our digital identity verification with sanctions screening.

What is a CIP (Customer Identification Program)?

/in , /by

The Customer Identification Program (CIP) protocols were first implemented in the United States in 2003, as part of the USA PATRIOT Act. The Act was passed in response to the terrorist attacks of September 11, 2001, and included a number of provisions aimed at enhancing national security and preventing money laundering and terrorist financing activities.

One of the key provisions of the USA PATRIOT Act was the requirement for financial institutions to establish and maintain a CIP as part of their anti-money laundering (AML) compliance programs. The CIP regulations require financial institutions to verify the identities of their customers when opening accounts and to maintain records of the information used to verify those identities.

Under the CIP, financial institutions must verify the identity of their customers using various methods, such as obtaining government-issued identification, verifying the identity of the customer through non-documentary methods, and checking the customer against various databases. Financial institutions must also maintain records of their verification methods and customer identities, monitor accounts for suspicious activity, and report suspicious transactions to the appropriate authorities.

Overall, the CIP is a crucial part of the US government’s efforts to combat financial crimes, and financial institutions must comply with the regulations to maintain the integrity of the financial system.

Which types of businesses are required to have a CIP?

Financial institutions that are subject to the Bank Secrecy Act (BSA) are required to have a Customer Identification Program (CIP). The BSA applies to a wide range of financial institutions, including banks, credit unions, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities.

Under the BSA, these financial institutions are required to implement a risk-based approach to their CIPs, taking into account factors such as the type of customer, the nature of the account, and the risk of money laundering or terrorist financing. The CIP must be documented in writing and must include procedures for verifying customer identities, maintaining records, and monitoring accounts for suspicious activity.

In addition to financial institutions, certain other businesses that engage in financial activities or provide financial services may also be subject to CIP requirements. For example, businesses that issue or redeem money orders or traveler’s checks, and businesses that provide certain types of prepaid access, may be required to implement a CIP under the BSA.

It’s important to note that the specific requirements for a CIP may vary depending on the type of business and the nature of its financial activities. Therefore, businesses should consult with their legal and regulatory advisors to determine their specific obligations under the BSA and other applicable laws and regulations.

What technologies do businesses use to comply with CIP?

Financial institutions and other businesses subject to CIP requirements typically use a range of technologies to comply with the regulations.

Customer Identification and Digital Identity Verification Software

These are software applications that use artificial intelligence and machine learning to automate the identity verification process. These systems can quickly scan and validate customer identification documents such as passports, driver’s licenses, and other forms of government-issued ID, reducing the time and cost of manual verification. Additionally, they remove the risk of typos, fat fingers, or manual error by automatically ingesting accurate data directly from the government-issued document.

Risk Assessment and Scoring Tools

Risk assessment tools allow businesses to assess the risk of each customer based on various factors such as their location, transaction history, and type of account. This information is used to prioritize customers for additional verification or monitoring. Businesses that are subject to Customer Identification Program (CIP) requirements may have different risk tolerances depending on the nature of their business, the types of products and services they offer, and the regulatory environment in which they operate. In general, businesses that are more susceptible to money laundering, terrorist financing, or other financial crimes may have a lower risk tolerance and may need to implement more stringent customer identification and verification procedures to manage these risks.

For example, businesses in industries such as banking, securities trading, and money services may have a lower risk tolerance due to the higher likelihood of financial crimes occurring in these industries. Similarly, businesses that operate in high-risk jurisdictions or that have customers who have a history of financial crimes may also have a lower risk tolerance. Enhanced Due Diligence (EDD): EDD is a process that involves conducting additional research and analysis on high-risk customers to better understand their risk profile. This may involve verifying the identity of the customer using additional sources of information, such as credit reports, public records, and other third-party databases.

Know Your Customer (KYC) Data Sources

These are databases that contain information about customers’ identities, risk profiles, and transaction history. They are used to verify the accuracy of customer information and to help identify potential risks or fraud. KYC AML platforms will query lists such as the Office of Foreign Asset Control, EU/UN Sanctions Lists, Politically Exposed Persons lists, and other sources that catalog individuals deemed high-risk for money laundering or criminal activity.

Overall, the technologies used to comply with CIP are designed to improve efficiency, accuracy, and security in the customer identification and verification process, helping businesses to meet regulatory requirements and maintain the integrity of their financial systems.

What are the typical requirements for customer identification software under CIP regulations?

There are no specific requirements for customer identification software under CIP regulations. Instead, financial institutions and other businesses subject to the CIP regulations are required to implement a risk-based approach to customer identification and verification, taking into account factors such as the type of customer, the nature of the account, and the risk of money laundering or terrorist financing.

Identity Verification

The software should be able to verify the identity of customers based on a range of government-issued identification documents, such as passports, driver’s licenses, and national identity cards.

Document Validation

Document validation software should be able to authenticate the documents presented by customers, to ensure that they are not fraudulent and have not been tampered with.

Compliance Reporting

The software should be able to generate reports and audit trails that document the customer identification and verification process, to demonstrate compliance with the CIP regulations. This is important in the event that a financial institution is fined or does illegal business.

What are the risks or fines for businesses that fail to comply with CIP requirements?

Financial institutions and other businesses that are subject to Customer Identification Program (CIP) requirements and fail to comply with the regulations can face significant fines and penalties from regulatory agencies. Regulatory agencies such as the Financial Crimes Enforcement Network (FinCEN) and the Office of the Comptroller of the Currency (OCC) have the authority to impose civil monetary penalties for violations of CIP regulations. The fines can range from a few thousand dollars to millions of dollars, depending on the severity of the violation.

In July 2020, Capital One was fined $80 million by the Office of the Comptroller of the Currency (OCC) for deficiencies in its CIP and anti-money laundering (AML) programs. The OCC found that Capital One had failed to establish and maintain an effective CIP, which had resulted in inadequate customer due diligence and the failure to detect and report suspicious activity. Bank of America, Citigroup, and American Express Bank have also been fined under the Banking Secrecy Act for failure to adequately verify customer identity.

Financial institutions and other businesses that fail to comply with CIP regulations may also be subject to regulatory sanctions such as cease and desist orders, civil injunctions, and restrictions on business activities. In some cases, violations of CIP regulations can result in criminal charges and penalties, such as fines, imprisonment, and forfeiture of assets. In 2012, Standard Chartered Bank agreed to pay $340 million to the New York Department of Financial Services (NYDFS) for violations of AML regulations, including deficiencies in its CIP. As part of the settlement, Standard Chartered Bank agreed to implement extensive reforms to its AML compliance program.

Additionally, reputational damage can have a lasting impact on the credibility of banks and financial institutions with potential customers and partners.

Looking for an affordable CIP solution?

Contact our team or request a demo of our CIP software here.

Best Passport Scanners

/in , , , , /by

Passport scanners are an essential tool for businesses that need to verify identity. They are the preferred tool for bars, nightclubs, and dispensaries which serve a global clientele and regularly need to scan documents other than driver’s licenses. They are also used

Having the ability to scan passports provides flexibility for customers who may not have a driver’s license or ID. A passport is often used as a backup identification document when someone loses their wallet.

Additionally, post-pandemic, travel has rebounded. Border restrictions have been lifted and international travel has grown due to years of pent-up demand. International travel, border crossings, and international identity verification all requires passport scanning.

Here’s our top picks for passport scanners to help you quickly scan passports, parse data stored inside the passport MRZ, and verify identity quickly and securly.

Best Overall Passport Scanner | Thales (formerly Gemalto) AT10K

The Thales AT10K is a full-page passport and document reader with a flatbed. It is the best-in-class passport scanning device, designed to meet the needs to high security environments such as border management, banking, hospitality, and travel. The desktop passport scanner is perfect for those locations needing to capture and authenticate passports, green cards, and other print identity documents. While it does capture passports, it can also authenticate driver’s licenses as well, so you’ll be able to scan passports in addition to catching fake IDs with ID authentication.

The AT10K is efficient from a business perspective, but also a customer perspective. With built in LED “landing lights”, customers are easily guided to proper placement of documents upon the scanner, as well as a green signal when they are able to remove their document from the scanner. The anti-glare technology is able to reduce document reflections and ambient light so that the images are captured with as much accuracy as possible, making it the perfect option for kiosks, airport eGates, cruise terminals and more.

Read more about the AT10K here.

Best Countertop Passport Scanner | IDWare Falcon

We created the IDWare Falcon tablet passport and ID scanner specifically to help customers looking to create a countertop check-in solution. It is perfect for those establishments that need accuracy, but also mobility. A fantastic feature of the IDWare Falcon is that it can either be mounted on a stand for a desktop solution, or you can attach the hand strap and it instantly becomes a mobile solution for scanning passports on the go. This passport scanner can also be used on or offline which makes it a great option for those with spotty WiFi. 

The IDWare Falcon has a whopping 8 LCD inch screen, and the built-in scanner is able to read 1D and 2D barcodes, PDF417, NFC and MRZs. This makes it especially good for those businesses that get a lot of international visitors that may not have a United States driver’s license. The built in VeriScan ID scanning software comes with visitor management, which lets you classify patrons into categories such as VIPs, frequent guests, and banned individuals. It is important to note, however, that while the IDWare Falcon is able to scan, validate, and verify the age and expiration date of an identification document, it is unable to authenticate identity documents. So if you need a scanner that will authenticate documents, there might be better options out there for your business. 

Best Passport Scanner for Authenticating Global Documents | IDWare 7017

Another solid desktop solution is the IDWare 7017. This scanner is another option that is able to scan passports, green cards, visas, driver’s licenses, etc., as well as RFIDs with an available upgrade. This scanner is able to automatically detect documents when they are placed upon the flatbed surface. The passport scanner then captures images in white illumination mode and the data is sent for further processing via SDK.

This is a great option for those businesses that get a lot of customers with international driver’s licenses, but not necessarily passports. It is able to scan the international IDs with VeriScan Global. The only downside is the relatively large profile, meaning you need desktop space to accommodate this passport scanner.

Best Handheld Passport Scanner | Zebra TC21

A great option for a handheld scanner is the Zebra TC21. Similar to the Falcon, it has the capability to scan both driver’s licenses and passports, and features a run time of up to 10 hours. This device can be used both on or offline which can be an essential function for companies delivering age restricted products, or even for bouncers that are too far away from the Wi-Fi inside. This scanner also has the built in VeriScan visitor management system, so if the classification of patrons into categories such as VIPs, frequent guests, and banned individuals is an important feature, this is another great option for you. From an affordability standpoint, this scanner is able to have multiple configurations making it an option that can easily fit into almost any budget.

This is an easy handheld option for those that will be holding the scanner for hours on end. For those businesses that need to verify age such as bars, nightclubs, etc., this is and ideal solution.

Need help choosing the right scanner for you?

Whether you are a bank needing to authenticate the passport of your newest international client, or a bar on the Vegas strip just trying to verify someone’s age before allowing them in for a night of fun, the options above provide a range of functionality that will work for any business. If you still need more guidance and information before making your final decision, be sure to contact one of our industry experts, and we will be more than happy to help you make the best decision for your business.

KYC for Digital Wallets

/in /by

What it is and how do digital wallets work?

Read more
Risk-Based Approach to AML

Risk-Based Approach to AML

/in /by

Money laundering is the process of taking illegally obtained financial gains and making it appear as if they come from a legitimate source. According to the United Nations Office on Drugs and Crime, this crime accounts for somewhere between $800 billion and $2 trillion of annual global transactions.

Read more
How KYC Software is Transforming Banking

How KYC Software is Transforming Banking

/in /by

What is KYC?

In the US, KYC in banking stands for “Know Your Customer” or “Know Your Client” and refers to the systems which a financial institution puts in place in order to protect itself from fraudulent activity. These systems are based on a set of laws enacted in 2001 as a part of the Patriot Act. The Patriot Act was passed in an effort to combat and prevent terrorism after the 9/11 attacks and contains many different laws to that effect; the KYC requirements that we are talking about here are just a slice of that pie. A big part of passing the Know Your Customer laws after 9/11 was to prevent criminals from committing identity theft and fabrication for the purpose of secretly funding terrorist groups, but there is more to it than that. The U.S. government had passed financial protection laws in the Bank Secrecy Act of 1970, but in 2001 these requirements were bulked up in order to prevent fraud, money laundering, and other financial crimes.

Because the KYC requirements are quite broad, each financial institution has its own way of approaching them, but there are elements that must be present for proper KYC compliance. There are two primary components: the Customer Identification Program (CIP) and Customer Due Diligence (CDD).

Customer Identification Program (CIP)

The CIP requirements usually include verifying personal identity documents for both business owners opening business accounts and individuals. For business owners, such documents might be a business license, partnership agreement, and/or trust instrument. For individuals, documents may include government-issued IDs, financial references, and/or information from a consumer reporting agency or public database.

Customer Due Diligence (CDD)

CDD requirements are a way for financial institutions to collect information in an attempt to predict how the account will be used and give each customer a corresponding risk assessment. CDD is not explicitly outlined in the Patriot Act so the details are left to interpretation and what suits the institution best. What is explicit is that banks are required to file a suspicious activity report if they have reason to suspect that suspicious activity is present. However, it’s difficult to know if the activity on an account is suspicious if the bank doesn’t know what a customer’s regular activity looks like. To find out what it looks like, the bank may ask questions like what the source of funds for the account will be, what the purpose of the account will be, and the person’s occupation, just to name a few examples. The bank then assesses the risk involved in conducting business with this person based on how well and how often their account is monitored and who they might do business with.

Why is KYC in banking important?

KYC in banking is important in protecting banks and customers from fraud, and because there is government regulation attached to it, non-compliance results in hefty fines. Know Your Customer also helps prevent financial institutions from engaging with customers whose risk factors make them a potentially bad client. If they aren’t going to adequately monitor their account or if they aren’t financially aware enough to understand the risks of investment, they could lose the bank a substantial amount of money. Additionally, because of the increase in filed suspicious activity reports, the fines for not being KYC compliant have skyrocketed. Billions of dollars in KYC non-compliance fines are issued every year.

How is Know Your Customer done digitally?

In our increasingly digital world, you may be wondering if your institution can maintain KYC compliance digitally. What software is available to this end? IDScan.net offers third party checks to verify identity, criminal background, and whether someone is a politically exposed person (or PEP). All information we process is automatically stored and simply accessed by your institution, but the record storage systems are also secure and up-to-date. This is often a compliance regulation, but it’s also important for your business’ security from personal data hackers. Criminals seeking to commit identity fraud or synthetic identity fraud specifically target databases that potentially have sensitive personal information, as banks’ databases often do. Ensuring that your customers’ information is securely stored is of the utmost importance.

We also offer mobile ID validation which is a simple process. The customer takes 3 images:  

1. Front of the ID 

2. Back of the ID and 

3. A selfie  

The automation performs identity verification by checking that the ID is formatted correctly. It also checks that the information in the barcode matches what is displayed on the front of the ID. It then queries the USPS database to confirm that the address on the ID exists. Lastly, it moves to the pictures, calculating a confidence percentage in facial match between the photo on the ID and the selfie supplied by the customer. The selfie is also run through anti-spoofing processes to assure it is legitimate. 

More specifically, the customer’s picture is first compared to a database of known faces to ensure that a human face is indeed pictured. An algorithm then maps the customer’s face and compares the layout of the pictured face to the face on the ID provided. The identity verification automation can then see more definitively whether or not the faces match and provide a percentage to represent the confidence it has in the faces being the same. Additionally, the confidence percentage threshold is customizable so you can decide what your company is comfortable with accepting. IDScan.net’s digital identity verification experts are available to walk you through the process and determine what percentage is acceptable for your business’ identity verification needs.

Know Your Customer is important to financial institutions who wish to protect themselves from fraud, risky account holders, and substantial government fines. A lot of the way in which businesses go about being Know Your Customer compliant is left up to their discretion, so banks and other financial institutions have some freedom in how they design their KYC processes. Digital solutions are the only way for financial institutions to maintain KYC compliance as they move towards digital platforms. 

5 Common Methods of Digital Identity Verification

/in , /by

According to McKinsey & Co, organizations plan to grow digital interactions by more than 50% by 2024. This means increased emphasis on seamless digital onboarding and account creation, as well as enhanced check-out, reservation, and customer inquiry processes. Today’s consumer wants to onboard as quickly and seamlessly as possible.

In the age of digital platforms, it can be tricky to conduct proper identity verification while maintaining a streamlined customer experience. Usernames and passwords are simply no longer enough identity verification to stand up to today’s cybercriminals. And they don’t meet KYC or AML standards which are increasingly being applied across a broad range of business types.

Confidence in your digital identity verification processes is paramount in ensuring your company’s digital security, so let’s take a look at a few of the identity verification methods available and evaluate possible pros and cons.

Knowledge-Based Authentication (KBA)

You have probably used knowledge-based authentication before as it’s one of the most common forms of identity verification.

KBA uses security questions (also known as “challenge questions”) for identity validation, designed to be easy for the user to answer, but difficult for a stranger to guess. Some common examples being, What is your mother’s maiden name? or Which of the following addresses have you been associated with? KBA questions are generated by querying various public record sources including credit report agencies, cellphone providers, rideshare services, and more.

As an additional level of security, timers can be employed to ensure that the answer isn’t being researched by either a person or a computer program. This is a decent method of identity verification since most users are familiar with it, but unfortunately, the security questions’ answers can often be easily guessed using social media or manipulated out of the customer through social engineering. Social engineering is the act of manipulating someone into divulging personal information about themselves for identity verification, usually via email or text message.

Pros of Knowledge-Based Authentication

  • High level of customer familiarity means low levels of abandonment
  • Inexpensive to implement due to long history, commoditization
  • Hard for fraudsters to use at scale

Cons of Knowledge-Based Authentication

  • Social engineering, such as online quizzes, or social media phishing, can get users to reveal answers to KBA questions, allowing fraudsters to impersonate them later.
  • Users often cannot remember the answers to obscure questions such as childhood addresses, or old services used in the past.

Two-Factor Authentication (2FA)

Two-factor authentication is another method of identity verification that has become de rigeur. NIST protocols now demand multi-factor authentication as a basic layer of security for any business that does business with the US government.

As the name suggests, it includes authentication from two sources for identity verification. The first method is typically a username and password, but the second factor is a random string of number and/or letters that can be sent to the users email address or cell phone number. The code is usually time sensitive and expires after a certain period of time. As with KBA, 2FA is a well-known identity verification method and is usually quite simple to perform as most people have their cell phone nearby to receive authentication codes. However, if this code is given to anyone else or if social engineering is employed to steal the code, this method of identity verification can also be somewhat easily compromised. 2FA is also reliant on the user’s cell and/or internet service so, in some cases, the third party could slow the identity verification process.

Pros of 2FA

  • Real-time. 2FA ensures that the user has access to at least 2 identity sources simultaneously, making it difficult for fraudsters to fake.
  • 2FA apps make it easy for customers to manage 2FA from a single portal, managed by their phone password or biometric login.

Cons of 2FA

  • Two factor authentication requires that the customer have access to their phone and/or email address at the time of account creation. The process of getting the 2FA code from the secondary source can lead to abandonment if the second factor is not readily accessible.

Credit Bureau-Based Solutions 

This form of identity verification relies on information from major credit bureaus such as Experian, Equifax, and TransUnion to provide identity verification information about potential customers, such as name and social security number. Using large credit bureaus to verify that your customer is who they say they are is fast, cost-effective, and easy to implement, but it also comes with some downsides.

The credit bureaus are subject to cybersecurity breaches, e.g., the massive Equifax data breach in 2017, and these data breaches have given cyber-criminals access to personal, extremely sensitive information. This method of identity verification can also be tricky for those who haven’t built up credit yet, such as young people or individuals new to the country, or those who just haven’t used mainstream financial services. Due to the aforementioned reasons, customers like these aren’t easily found within the credit bureaus’ databases and are basically excluded from using this identity verification method. 

Pros of credit bureau based identity verification

  • Data is typically very reliable
  • Credit score and credit worthiness can provide a rich picture of the risk profile of a particular consumer, which has value beyond just verifying their identity.
  • Credit-bureau based reporting is typically KYC compliant due to the stringent requirements that credit bureaus are under.

Cons of credit bureau based identity verification

  • Many users get nervous when they see names like Equifax of Experian because they are worried they are going to trigger a hard credit-pull. This can increase abandonment and customer-service calls

Device or Account-Based Verification

Device or account-based identity verification solutions use online, offline, and social media data for identity validation or to detect if someone committing fraud. They use many different sources for identity verification and provide a confidence score based on how likely it is that fraud is being committed. However, database identity verification solutions are easily spoofed by creating fake social media profiles and online identities. They are also often not KYC (Know Your Customer) or AML (Anti-Money Laundering) compliant, so they might need to be used in conjunction with other identity verification solutions to ensure identity validation. 

Pros of device or account verification

  • Most people have relatively stable patterns of usage for items such as their mobile phone or social media account. Therefore these common logins can typically be trusted.
  • Applications such as Google and Facebook offer OAuth logins, so users can create accounts utilizing platforms where they have already been verified.

Cons of device or account-based verification

  • It is relatively easy for fraudsters to create fake social media profiles or email accounts in another person’s name.
  • If a user has recently changed devices, or opened a new account, they will likely be flagged as fraudulent, even if they are a legitimate customer.

ID Verification-based Solutions

Online identity verification is often a great cybersecurity solution as it also provides identity validation by examining the customer’s ID and comparing it to a selfie the customer takes. This face matching process quickly and efficiently compares the ID image to the selfie by creating a mesh model of the face to check for accuracy and liveness. This anti-spoofing technology is beneficial because it helps to prevent against things like deep fakes and other fraudulent attempts.

The technology automatically performs identity verification by checking that the ID is formatted correctly based on individual state guidelines. It also checks that the information in the barcode matches what is displayed on the front of the ID. The identity verification platform then confirms the accuracy of the address listed by checking it against know databases. The final, and arguably most important step in this process is the face matching process. After creation of the mesh model, the AI technology compares multiple points on the face and head to compare similarity and liveness(meaning you can’t just upload a picture of the person that you got offline. It has to be a specific type of picture).

While this might seem like a long, drawn out process just to confirm identity, 99% of the work is being done by AI in only 1 minute, sometimes less. Once the comparison is complete, the Digital Identity Verification will give you a confidence score based on how likely it is that the ID and selfie both match and are not fraudulent.

In addition to the above checks, the Digital Identity Verification (DIVE API) platform that IDScan.net offers, various third party checks can be layered into the process to add even more insight into the person needing to be verified. One common example is a DMV integration. driver’s licenses or other state issued ID cards have long since been used as proof of identity, so this DMV integration allows the user to check the data on a specific ID against the information stored in the DMV database to ensure the information is accurate.

Overview of the Features of different types of digital identity verification

A quick overview of the different features you’ll find with various digital identity verification options

Type of digital identity verification ID-based Credit Bureau Based 2-Factor Authentication Knowledge Based
Requires access to identity document ✓      
Requires recall of historical data       ✓
Requires SSN   ✓   Possibly
Requires access to secondary account (email/phone)     ✓  
Requires customer history   ✓   ✓
Performs face-matching ✓      
Checks human identity in real-time ✓   ✓ ✓
Protects against spoofing ✓      
At risk due to social engineering     ✓ ✓

There are many out there for digital identity verification, but only a couple that truly ensure accuracy and validity. Be sure to contact our team to learn more about how our Digital Identity Verification solution can be quickly and easily integrated into your pre-existing website or app

What are Third-Party Checks?

/in , /by

Mobile solutions have opened up opportunities for businesses to grow like never before, but they’ve also opened up companies to new risks. Whether doing business in an office, on the go, or remotely, ensure that your company is protected with IDScan.net’s third party checks. Read more

SHARE YOUR CART