What is an Identity Verification System?

An identity verification systems is a type of software that ensures a person is who they claim to be; for businesses, user identities need to be verified to prevent breach, fraud and to comply with compliance regulations.

For many enterprise organizations, verification will fall under two major categories:

  1. Internal: Managing user access to business resources requires identity verification systems that can manage identities and authentication for employees. Internal authentication is focused on how your team accesses resources and can include on-prem access, VPN access, or non-VPN remote access.
  2. External: If you have a digital storefront, or if your site provides user access for features, functionality, or order, then you’re handling a whole different area of verification. External authentication lets your customers or clients use your services on a public-facing platform.

More importantly, these systems can automate and distribute verification across several different devices, access points or even locations across the globe. Digital identification tools will often use one or more verification methods, including:

  • Biometric Verification: Using some sort of physical characteristics, from facial scans and fingerprints to scans of selfies off of physical identification credentials.
  • Liveness Detection: Advanced hacking and spoofing attacks have, in some cases, fooled biometric scanners. Liveness detection algorithms can trace whether or not an item is faked and reject it as such.
  • ID Verification: Scanning or storing documents like licenses or passports to use as a comparison point for a scan.
  • One-Time Codes: Send a user a code via email or SMS to verify that they are interacting with the system.
  • Trusted Identity Networks: Use authenticated credentials from another part of your system to authenticate the user.

With a combination of measures and digital and physical information, a robust system can help onboard remote workers and allow them to work securely on sensitive systems. Your customers will also be able to more seamlessly use your products across multiple devices and integrations with other platforms.

What Does it Mean to Verify a Digital Identity?

When it comes to Identity Access Management (IAM), one of the core ideas or objects is a user’s identity. ISO/IEC 24760-1 defines identity with a simple definition–a set of attributes related to an entity. This is a set of digital attributes related to an entity in this case.

Think about how you identify yourself in normal circumstances, like using a driver’s license. The license has several pieces of information on it, like your birth date, a picture, a license number and the authorizations you have for certain kinds of driving (like for motorcycles or large trucks). Likewise, a digital identity is a collection of information that your users provide to your IT system to represent “who they are” there essentially. This can include information like:

  1. Username
  2. Password
  3. Role in organization
  4. Employee ID number
  5. Biometric information (fingerprints, facial scans, etc.)
  6. Address, phone number and/or email
  7. Security questions and answers

This collection of information represents a user in the system. It lays out who they are and can then be used to determine what they can access and how they log in to the system. This is a limited list, however, as several compliance frameworks in certain industries include official authentication schemas, including the following:

  • eIDAS: A standard in the European Union required of businesses managing any private data that attempts to promote secure and interoperable identities for IT infrastructures.
  • Pan-Canadian Trust Framework: Created by the Digital ID and Authentication Council of Canada, this ID scheme helps Canadian businesses with a standardized and cross-system identification process.
  • Aadhaar: A national ID approach for India used by almost 90% of that country’s residents. This scheme includes physical cards and digital connectivity.

However, the challenge for any authentication system is effectively ensuring that a user attempting to access resources has a corresponding identity that gives them access. That’s where verification comes in.

Verification ensures that the physical person logging in to a system is the authorized user in the system. Consider a driver’s license: anyone verifying a person’s identity can look at the picture or check the license number to determine who they are. Likewise, your IAM setup can check against a user’s credentials, like a password or biometric information.

What Should I Look for in an Identification Verification System?

Risk is a real concern when it comes to managing identities and system access. To reduce your third-party risk from external and internal users, it’s important to pick a system that meets those needs.

Features to look out for include:

  • Know Your Customer and Know Your Business Compliance: Businesses in the finance and investing industries count on user identity verification systems to handle clients’ confidential and sensitive financial information. Organizations that comply with Anti-Money Laundering (AML) and Customer Due Diligence (CDD) requirements will implement Know Your Customer (KYC) and Know Your Business (KYB) workflows.
  • Cross-Referencing From Multiple Sources: Many verification systems leverage information from outside platforms and databases to compile comprehensive profiles to help detect fraud. A solid platform will do so to identify users better and detect the trustworthiness of any given request
  • Biometrics: Biometrics are an incredibly important part of verification, specifically because physical attributes are (mostly) difficult to spoof and fake. Biometrics, therefore, are a critical part of your system.
  • Advanced Document Scanning: Flexible and strong systems should also be able to capture information from a variety of documents to support management and authentication, including licenses, badges, passports, or other physical IDs.
  • Liveness Testing: While it is difficult, it is possible to fake biometric information like fingerprints using artificial means. A liveness test can ensure that a hacker isn’t feeding raw biometric data to your system to gain access.
  • Secure and Distributed User Information: Identities are vulnerable if systems that store them are undermined. A strong, decentralized storage schema built on blockchain, or similar technology could go a long way in protecting identities from disclosure or spoofing.

What Are Some of the Identity Providers Available on the Market?

SEON

SEON specializes in eCommerce anti-fraud prevention systems integrated with popular online platforms like Shopify. SEON includes biometrics, device fingerprinting, and in-depth background checks to fuel behavioral analytics and risk scores.

Ondato

Ondato promotes itself as a core part of Know Your Customer (KYC) identity verification for financial institutions. Their platform includes solutions for compliant identity verification, authentication, background screening, and adaptable capabilities for regulatory compliance.

Trulioo

Trulioo describes itself as a provider of trust, which echoes some of the other providers on this list. This includes person and business lookups in global registries. Additionally, they power an Anti-Money Laundering (AML) service that can monitor against several global watchlists, including OFAC, the U.N. Terrorism List, the EU Sanctions List, and more.

Actico

Actico is a comprehensive credit and business background check service, helping clients perform real-time background checks and risk assessments. They also include identity and authentication services with intelligent automation.

Implement Accurate and Easy Verification with 1Kosmos BlockID Verify

BlockID Verify is a revolutionary identity verification system that uses biometrics, document scanning and several important compliance standards to give your organization streamlined and secure verification.

We accomplish this through a combination of innovative techniques and technologies:

  • KYC compliance: BlockID Verify is KYC compliant to support eKYC verification that meets the demands of the financial industry.
  • Data validation: BlockID Verify ensures that user data is accurate and valid and eliminates the risks of duplicate or fraudulent identities.
  • Compliance adherence: BlockID Verify meets standards like NIST 800 63-3 standards for Identity Assurance Level 2 (IAL2) and Authentication Assurance Level 2 (AAL2).
  • Formless and frictionless use: users can create accounts with no forms or emails. It can be as simple as taking a picture of a few identity documents.
  • Zero-trust security: BlockID Verify is a cornerstone for a zero-trust framework, so you can ensure user authentication happens at every potential access point.

Learn more about 1Kosmos Passwordless Enterprise authentication. Also remember to sign up for our newsletter to stay abreast of 1Kosmos products, events and updates.

FIDO2 Authentication with 1Kosmos
Read More