Written by Philipp Pointner, Chief Product Officer at Jumio
While the Rugby Six Nations doesn’t have quite the same atmosphere this year, it was one of the first sporting highlights to hit our TVs in February. But even without the packed stadiums or pubs full of eager fans, the teams are coming out in full force and the teamwork we continue to witness provides learnings that can be applied to other walks of life and business.
This is most certainly the case for businesses when considering online identity verification. The need for this service has skyrocketed over the past year as the world went virtual. Healthcare organisations need to know their patients so they can reliably deliver telemedicine and prevent prescription fraud. Sharing economy companies often need to verify their drivers as well as customers as a matter of trust and safety. Online dating sites increasingly have to verify the identities and ages of their users in order to protect them from harm and online fraud. And even financial institutions want to “know your transactions” to ensure they’re taking every precaution to detect trends that may indicate money laundering.
In fact, it’s hard to think of any modern enterprise that isn’t seeking a higher assurance related to the identity of their online customers, given the sharp rise in new account fraud, identity theft and account takeover fraud (ATO). So how can businesses do exactly that, to the right level, with the most appropriate techniques and without detrimentally impacting the customer journey? This is where we can look to the Rugby Six Nations for key learnings.
Establishing trust from the start
Every player picked for any country’s Six Nations team is analysed from the start, being selected to play in the tournament based on knowing their exact abilities, past performances and unique skills. Stuart Hogg was picked for the Scotland team based on his speed, while Maro Itoje is known in the England team for his consistency. Knowing a player from the beginning is much like knowing a customer from the start of the relationship.
Businesses should be looking to identity verification platforms that can accurately identify a customer when they come to open an account. That means implementing technologies that use document-based identity verification (using a government-issued ID and a corroborating selfie) to verify online users. With traditional authentication and data-based (e.g., credit bureau lookups) methods, there is no way to know if a person logging in is the actual user, or if it is someone using readily available stolen information from the dark web. Gartner’s 2020 Market Guide for Identity Proofing and Affirmation predicts that by 2022, 80% of organisations will be using document-centric identity proofing as part of their onboarding workflows, which is an increase from approximately 30% today.
To provide even more identity assurance, particularly in higher-risk scenarios, organisations should look to layer in a number of identity services to increase the level of identity assurance and answer the fundamental questions: is the user who they claim to be online and is it safe to start doing business with them? If the business needs to rely on more than one identity-proofing method, having the ability to intelligently orchestrate across these different capabilities is vital.
Maintaining trust along the way
For the rugby teams, it’s a constant game of trust between players, practicing new techniques and tactics along the way which leads them to success. One of the Wales team’s tactics in their match against Ireland was to target Ireland fly-half and captain Johnny Sexton to counteract some of the skills he is otherwise known for. It’s the same for KYC practices – the business needs to be able to switch and draw on new tactics to thwart cybercriminals who are developing and evolving their own playbook for fraud.
In the identity verification space, this comes down to having a holistic identity verification platform that can monitor identity-related fraud signals when required. For example, businesses in the financial services space should be looking to leverage platforms that provide automated database pings, including those for address verification and government watchlists PEPs and sanctions to help identify fraud and anti-money laundering (AML) risks faster. More broadly, having access to ongoing authentication solutions will also be key in preventing ATOs. Account Takeover fraud is when a fraudster seizes control of an online account, changes information such as the username, password or other personal information, and then makes unauthorised transactions with that account. This type of fraud is on the rise, with over a 31% increase YoY according to Forter’s Fifth Fraud Attack Index.
It’s all in the orchestration
Like England has the esteemed and reliable Eddie Jones to organise its team, businesses need their own manager. Identity verification’s Eddie Jones is what’s known as identity orchestration which enables organisations to sequence and layer in multiple methods of identity proofing services to increase the level of assurance. Gartner also sees this as a key area of focus for organisations, predicting that by 2023, 75% of organisations will be using a single vendor with strong identity orchestration capabilities and connections to many other third parties for identity proofing and affirmation, which is an increase from fewer than 15% today.
As more and more organisations have increasingly gone digital, there has been a parallel proliferation of cyberattacks that attempt to damage, disrupt or gain unauthorised access to the computer systems of businesses. It is therefore critical that enterprises are not only able to streamline the onboarding process, but that they can build in the necessary safeguards to protect their ecosystems, reputation and accounts owners.
Only with a sophisticated platform will growing companies be able to tap into rich expertise to create a highly customised onboarding and online identity verification experience based on their unique use cases, risk appetite and budget.
While forceful attacks may be commonplace on the rugby pitch, cyberattacks are not welcome. Organisations that really think through the onboarding and KYC processes are effectively creating their own “haka,” a ceremonial Māori battle cry and challenge popularised by New Zealand’s national rugby team, the All-Blacks, to intimidate their opponents and display their team’s pride, strength and unity.
Only a complete identity verification platform with a range of capabilities will protect their online community and ecosystem from bad actors and simultaneously create a safe and streamlined experience for your good users.
