Identity Proofing 101

When the pandemic accelerated customers’ move from the physical world to the digital world, it created new opportunities for fraud, and criminals continue to take advantage. The National Council on Identity Theft reported that identity-based fraud increased 70% between 2020 and 2021. According to the 2022 Identity Fraud Study from Javelin Strategy & Research, in the US alone, businesses lost $52 billion to identity fraud in 2021. This includes a 109% growth in new account fraud and a 90% increase in account takeovers.   

With customers routinely creating banking, healthcare, e-commerce, commercial, and other accounts online, organizations must be able to ensure a customer or patient trying to open or access an account really is who they say they are through digital identity proofing.   

 

What is digital identity proofing?  
The process that allows customers to prove their authenticity to an organization is called identity proofing. The customer provides identification when they register or open an account and the business verifies their identity before granting them access. ID proofing enables businesses to confirm that an identity exists and belongs to the same person seeking entry.  

The need for secure credentials has long been a concern in industries like banking or healthcare that routinely handle highly confidential information. But the recent dramatic increase in fraud has made it a concern for a much wider range of organizations.  

 

How do digital identity proofing solutions work?  
When a customer opens an account, or onboards, they provide proof of their identity, which is most often an official document such as a driver’s license or passport. The company validates the identity and allows the customer to digitally onboard and access the account on subsequent visits.  

In its set of digital identity guidelines, the National Institute of Standards and Trust (NIST) has defined the steps of identity proofing:  

• Identity resolution: uniquely distinguishing an individual within a given population or context, using the minimum set of attributes necessary.  

• Identity validation: checking that the documentation provided by the customer is genuine and that the data it contains are valid, current, and related to an actual, live individual.  

• Identity verification: confirming that the customer is who they say they are.  

The UK government’s Good Practice Guide, “How to prove and verify someone’s identity,” outlines five steps for identity proofing:  

• Collecting evidence of identity from an official ID document.  

• Confirming that the document is legitimate.  

• Checking that the identity has existed over time to avoid accepting synthetic or fake identities.  

• Checking the identity against fraud databases.  

• Ensuring the identity belongs to the person claiming it.  

Using automated identity proofing services and solutions allows these steps to be performed quickly and accurately, confirming that the individual is who they say they are while minimizing the time the customer must wait for verification.  

 

Why does digital identity proofing matter?  
Direct financial loss is only one of the costs a business can incur if they fall victim to identity fraud. Depending on the size of the breach, there could also be fines and other governmental levies. And the cost of fraud is magnified when it harms customer relationships.   

The Javelin 2022 Identity Fraud Study reported that the average cost to a consumer of each identity theft incidence is $1,110. That doesn’t take into account the potential impact on their credit and hours of their time spent trying to set things right after their identity has been compromised. The impacted customer is likely to share their experience with friends, family, social media, and beyond. Getting a reputation as a brand that doesn’t do everything it can to protect its customers, their data, and their accounts can cause attrition among current customers and reduce the company’s ability to acquire new customers.   

It’s easier to prevent identity fraud with identity proofing than it is to recover from it. Identity proofing allows businesses to establish trust with their customers from the beginning of the relationship and continue it throughout the entire customer journey.   

 

Popular identity proofing solutions and authentication factors  
To establish their identity, customers are asked to provide proof that they are who they say they are. In person, to open a bank account, board a plane, or otherwise prove their identity, a customer shows government-issued identity documents that contain a photo, such as a driver’s license or passport. And establishing identity online is no different.   

First, customers scan their ID documents, and the business validates the information they contain against other data sources. The increased use of NFC chips in ID documents increases their security by making the data they contain virtually tamper-proof.  

Next, the customer is asked to take a selfie, which is verified as the same person using technologies such as artificial intelligence, machine learning, biometrics, and liveness detection (the ability to recognize the selfie as a picture of the live person rather than a video or previously taken photo.)   

Once their identity has been confirmed, the customer account is accepted, and they are allowed to onboard. As part of their onboarding, the customer will be asked to provide the authentication factors they will use to access their account or information each time they return.  

Different factors offer differing levels of security, and it’s up to the business to find the right balance between security and customer ease as in its authentication factor requirements.   

Here are examples of common authentication factors customers are asked to provide when they onboard:  

Passwords  
The most typical customer identity verification factor is passwords. The longer and more complex a password is required to be, with elements such as capital letters, numbers and special characters, the more security it provides.  

Knowledge-based Factors  
These factors rely on unique identifying information that a customer would know, such as a customer’s mother’s maiden name. Customers routinely provide answers to questions, including their paternal grandfather’s middle name, the school they attended in third grade, the city where they were born, or where they went the first time they traveled on a plane.   

Biometric Factors  
Instead of being based on something a customer knows, biometric factors are based on something that makes up who a customer is: something like their fingerprint, iris, or voice – also known as a biological characteristic. Examples of the use of biometrics are unlocking a mobile phone with facial recognition or accessing a computer with a fingerprint instead of a password.   

 

Is there a difference between identity proofing and authentication?  
Identification and authentication are different parts of a security process. Identity proofing is the first step. As previously mentioned, when a customer opens an account or onboards, they provide an identification claim about who they are. The business checks the identity assets the customer has provided to ensure they are who they say they are. As they onboard, the customer will establish the authentication factors they will use to access their account or information, according to what the business requires. Authentication occurs when the customer returns to their account and presents the required factor or factors, and the business confirms their identity before access is allowed.  

 

What issues does identity proofing solve?   
Identity proofing helps businesses solve several common problems. The stronger the identity factor, the greater number of benefits a business can derive in these areas.  

Preventing identity crimes  
Businesses both large and small are constantly being probed by criminals looking to establish fake accounts or take over real ones. By ensuring someone opening an account is who they say they are, identity proofing enables businesses to reject fake accounts before a criminal gains access, and reject false attempts by criminals trying to access a legitimate account. By heading off crime before it happens, businesses save the money and the resources it takes to recover from a cyber break-in.  

Complying with regulations  
More than 90 countries have regulations mandating that businesses verify customer identities and keep identity records. Designed to reduce online fraud, identity theft, and other cybercrimes, these regulations, such as the EU’s General Data Protection Regulation (GDPR), determine how data are collected, protected, and monitored. Identity proofing helps keep businesses in compliance with these regulations, thus avoiding censure and fines.   

Building customer loyalty  
A fundamental challenge for every company is building the kind of trust with a customer that keeps them happy and garners returning business. It starts with an identity proofing experience that securely, seamlessly, and easily verifies a new customer’s identity, and allows them to onboard across channels. Each time a customer returns, they should feel just how secure and easy it is for them to connect with the organization, achieve a resolution for any problem, and complete new purchases and transactions.  

 

Why you need identity proofing  
Fraud incidence will only continue to rise. More identity theft was reported to the US Federal Trade Commission in 2021 than any other kind of fraud. In the face of increasing ecommerce, digitization of government records and IDs, and digital payments, Credence Research expects the market for global identity theft protection services to expand at a CAGR of 14.2% between now and 2026. Forbes estimates that synthetic identity fraud, which combines authentic and fake elements, will cost businesses $2.5 billion in 2022 and double to $5 billion in 2024.   

Identity proofing protects your business and your customers by ensuring they are really who they say they are, from the first moment they onboard with you. It provides a basis for mutual trust as their relationship with your business grows and they authenticate themselves whenever they access their account. Learn more about the benefits of identity proofing with Daon®.