/identity

News and resources on digital identity, trust, biometrics and Secure Customer Authentication.

Discussion
No Caller ID: Stopping the onslaught of fraud text messages and phone calls
Ketharaman Swaminathan

Ketharaman Swaminathan

  TBH these measures have been tried for years but they don't work in actual practice.  Let's take #2. Genuine employee XYZ in my bank does not know what genuine employee ABC has told me. If I call the call center, there's no way on earth that genuine employee PQR will know what I'm talking about.  Now let's take #3. Genuine message from bank warns me to inspect the incoming URL very carefully and tells me to click an extremely dodgy - but genuine - URL to learn more.  Lest anyone question the creds of these banks, they're among the three largest banks in India and 20 largest banks in the world.  It's obvious to me that this is banks' way of stonewalling "drunk under lamp post" regulation holding them unilaterally responsible for scams. After all, shareholders of banks will not be happy with their management for absorbing losses caused by customers' (mostly) faulty actions.     IMO the one thing that might work is shared responsibility according to my Three Strike Rule To Eliminate Cybercrime.
2023 – the year of the digital ID wallet
Andrew Smith

Andrew Smith

  Some of this is over complex. For example, we dont need an open policy framework where my wallet knows what jurisdiction I am in. For identity to work, I need to have an ID that is accepted in the US and an ID that is acceptable in the EU. This doesn't mean its the same ID, rather it could be from a different set of identity credentials i hold, some that can be shared. If we keep things simple, by following a Self-Sovereign Identity (SSI) model and its principles, then most of the challenges are mitigated. Digital ID should be SSI simply because a) its my identity I should own it, no third party ever does, and only with SSI can I really control it, and b) because it solves so many of the challenges associated if data isn't self sovereign.  Where governments really need to start looking is at privacy and security of digital ID solutions - and thats not just the wallet, thats the TYPE of credentials that are stored and how capable they are with regards to zero knowledge proofs (ZKP) and selective disclosure. Then if I move between jurisdictions it is a technology thing, if the US supports AnonCreds for example, and the EU does, then all challenges are solved.... A good post here explains the issues with credentials and why we need to ensure that a minimum bar is met with regards to privacy for most identity based solutions. If that bar is consistent, then policy becomes a matter of what types of credentials are trusted and supported primarily.  A call for trust, a call for privacy, a call for AnonCreds – ID Crypt Global News and Blog
Why does digital trust matter for businesses?
A Finextra Member

A Finextra member

  I don't agree with this. I can get trust from the service via technology using true digital identity without friction and without challenging everytime. Digital Identity can be and is with certain solution, significantly more trustworthy than phyiscal identity. Fraudsters are able to pic at the cracks in risk based approaches - this is why push payment fraud is growing. Again, true digital identity can combat this significantly. 
How banks can obtain a valuable single customer view (SCV)
Ketharaman Swaminathan

Ketharaman Swaminathan

  During GFC, UK regulators mooted SCV for UK Banks in order to expedite the insurance payouts of failed banks. It got canned due to prohibitively high costs relative to the low frequency of potential use. Will it be any different now?