For decades, identity management technologies and services have been an in-demand commodity in banking and finance. Banks are increasingly relying on identity authentication technologies to protect the privacy and security of the information they have collected about employees, customers, and partners. By enabling the creation of secure and streamlined means to provide identity authentication and access control, identity management technologies are indispensable components in the financial services industry.
The ability to accurately recognize, identify, and verify a person is fundamental to establishing trust between financial service providers and their clients. Let’s find out how identity verification works and how banks can benefit from doing it right.
What is digital identity verification?
A digital identity service is a service that securely provides people the ability to quickly access their financial and legal information. It is through identity verification services that we can efficiently share and protect our personal and sensitive information.
At the age of connected intelligence – Point-of-Sale systems, payment gateways, artificial intelligence, and IoT-enabled devices – identity verification is increasingly becoming the user experience of choice. And gradually, banks are acknowledging that identity can be about much more than security alone. Biometrics, advanced analytics, and various other identity sources are being used to fight fraud, increase customer service relevance, and improve all-round operational efficiencies.
One way or another, security has always been the highest priority for banks. Now, at the rise of digital banking, vulnerabilities of systems are multiplying. Meanwhile, clients expect financial institutions to protect them from threatening cyber-attacks. In response, banks build their own efficient identity management systems that provide clients with unique user identities. These digital identities mean that each customer is associated with their private information, securely stored within a banking system and accessed by a client using one or more authentication methods.
-
What you know
Username and password, PINs and security codes, secret facts, or passphrases.
User-defined credentials like the username and password combination are essentially a basic means to secure private information held in the system. Passphrases, a unique combination of words or phrases (often using certain strings of numbers or letters) are probably another popular additional authentication method. Once the user has provided the username and password, the passphrase is entered into the terminal application, which automatically verifies the password. The problem with this authentication method is that codes are easily forgotten, people often use weak passwords and ignore the recommendation to change them regularly. Therefore, to really prevent unauthorized users from accessing the encrypted data, a more robust authentication method is typically required. For example, calling this system from a trusted mobile phone application (say, Skype) would require a unique verification code.
-
What you have
Identity or bank cards, other IDs, and devices a customer owns (e.g., smartphones).
The majority of two-factor authentication methods rely on paper-based IDs and other personal belongings, which adds an extra layer of security to your online account. A mix of a knowledge-based factor and a physical item you carry around with you should be a more safe bet in giving you a higher level of protection on your accounts. An industry-standard two-factor authentication today combines a password and an SMS code. Therefore, many online services and applications offer the option to link a phone number to an account. Apart from the evident advantage of double-security, it will also allow getting in if a password gets lost or forgotten.
-
What you are
Biometrics, such as fingerprints, face image, iris images, vein images, voiceprints.
The next layer of security is formed by the things a user is. Their thumbnail, face scan, or voice can become their ID. From one perspective, it may seem a return to traditional identity verification methods when a person is recognized by sight, accent, or other physical traits. On the other hand, however, biometrics proves to be a more reliable way to confirm an individual’s right to access a particular service without disclosing unnecessary data. The requirement to present biometrics data can stand in the way of fraudulent activity and help deter phishing and online scams. But also, it eases the burden of proof for users who don’t want to go through complex checks. Nonetheless, it is highly recommended to apply other security measures for interactions with higher stakes and more risks, too.
-
The context
Geolocation, IP address, a mobile number, a mobile app, or a website.
Dynamic data from user interactions (e.g., financial institutions, retail, mobile) could be used by authorities to identify the user. But the context in which the above information is captured matters as well. In the online banking arena, a person must be uniquely identifiable. That means that who we are, things we know, and belongings we own make up the combination of unique identity components that must be entered in a particular context for a banking service to grant access to the account. This contextual information may be home IP address or geolocation, as well as any abnormal user activity, detected based on their behavioral data, or the last sign-in time.
Benefits of digital ID in online banking
Not only single users as natural persons but also companies as legal entities seek security when it comes to dealing with finances online. The range of financial services varies to include online and mobile banking, e-trade, and tax declaration. Alongside banks, governments, municipalities, and other privately owned enterprises engage to provide these e-services.
Luckily, the market has a selection of verified digital identity solutions to offer. They afford electronic customer IDs, advanced authentication and verification methods, electronic signing, and more. Digital identity providers tailor these comprehensive solutions for customers to enjoy significant functional benefits in the areas of security, control, and flexibility.
-
Security. Unlike paper-based IDs that can be lost, stolen, or replicated, digital identity information may be secured with cryptographic methods and security protocols. National or local governments, consortiums, individual entities, private and nonprofit organizations are eligible to issue digital IDs for individuals to perform digital authentication.
Security is a key component of good ID. Verified digital identity solutions have built-in safeguards that ensure the security and privacy of users’ personal data. These safeguards prevent hackers from breaking in, modifying or stealing data. High-assurance digital ID programs generally reduce the risk of forgery and unauthorized use. At the same time, issuing parties are well aware of cybersecurity threats posing risks to digital ID holders. That is why new privacy measures in the form of regulations and acts like GDPR are taken nationwide.
-
Control. A good digital ID must ensure better control over online data for users. In turn, data aggregators need to and are expected to protect user privacy. Data owners, who are also digital ID holders in this context, give these aggregators permission to collect and process information. By doing so, they want to be sure that control over the data is still theirs.
There are several ways to let individuals and legal entities be in control of their data. First, governments can develop policies and cross-border standardization protecting user privacy. Second, tech companies can, in collaboration with governments, innovate processes of data usage management, creating technically reliable systems, and thus making it easier for people to exercise control over their data. Third, civil society institutions can petition for safe and accessible digital ID programs development.
-
Flexibility. Paper-based and other physical IDs offer a fixed view of identity information such as a photograph, name, address, telephone number, or credit information. All these attributes provide only a limited degree of flexibility and exposure to change.
On the other hand, scalability and flexibility are inherent in digital ID systems. They offer increased inclusion, transparency, and adaptability. Using them, individuals and institutions are commonly able to choose the level of authentication that meets their needs. This ability is a must-have of good individual and institutional user experience. And when it comes to companies and other legal entities, it’s an excellent option for them to be able to adopt digital IDs that are flexible enough to be used with their services and adaptable to their business model.
Digital identity verification service providers for a financial sector
A minimal level of digital infrastructure, trust in the digital ID provider, and favorable policies that safeguard platform users are the basic prerequisites for the digital ID system implementation in the financial sector. The digital ID authentication service provider is primarily responsible for (i) verification of ID; (ii) access and issuance of digital ID; (iii) data storage of the digital ID; (iv) processing of personal data of users; and (v) oversight of information security practices, including the retention of data and user security policies. Digital ID system service providers vary depending on the range of services rendered. We would like to single out three big identity verification service providers that are highly regarded in the industry: BankID, NemID, and iDIN.
BankID. It is Sweden’s digital ID solution that was launched in 2003 and now has a roughly 75 percent adoption rate among adults in Sweden, which is equal to 8 million users. EU law was modified in 2001 to recognize an electronic signature as equal to that of a physical signature. So, a signature generated with BankID is legally binding.
The system has an intuitive interface. BankID service is accessed via a mobile application. It eliminates the need for a security token or card reader for user authentication, which can create friction for customers. This digital ID system that is integrated with a bunch of services allows users to get authenticated, send documents, and complete other finance-related operations securely online. It is the app’s high accessibility that has boosted its usage and turned it into an everyday feature for millions of people.
NemID. Denmark’s local alternative to BankID, called NemID, is a solution that provides users with digital signatures for public websites, digital post, online banking, and other online self-services. The adoption of the NemID program in Denmark emulated the success of its predecessor, mostly due to its further enhanced accessibility.
The Danish solution in the first 9 months was issued to 60 percent of the Danish population. It happened to enter the digital arena at the time when both the government and the country’s population were ready for it, and the necessary policies were already adopted, which created a positive legal background. Being a collaboration between the banks and the public sector, NemID provides a secure login mechanism for using the digital ID. As of the beginning of 2020, over 90 percent of the population in Denmark have a NemID.
iDIN. The Netherlands have their own service enabling secure identity verification. iDIN is a Dutch electronic ID system that is developed by all country’s major banks and managed by the Dutch Payment Association. It is used as a method of electronic identification in an online environment so that people can log in and authenticate their identity securely on over 100 websites without repeatedly entering personal data.
All these services (and many others) can be integrated using Signicat. It is a platform that offers flexible verified digital identity solutions to its customers. These solutions are enabled through connections to third-party electronic IDs and verification methods. Using Signicat’s APIs, people can employ identity on-demand services for secure and convenient multi-factor authentication, electronic signing and sealing, document preservation, and identity assurance.
Conclusion
The design, governance, and use of digital ID by economies, governments, businesses, and individuals around the world is a rapidly evolving area. To no small degree, eID will mean greater financial inclusion creating additional value for governments and societies. Greater access to digital ID can alleviate the pressures of ID misuse and fraud, ensure high levels of trust in the digital identity system, and empower individuals to participate fully in the digital economy. Indeed, the integrity of these safeguards, combined with opportunities for public engagement and open dialogs with stakeholders, can serve to make this the leading edge of identity innovation.
© 2020, Vilmate LLC
