In one of our previous blogs, we looked at how document verification acts as your first layer of defence against identity fraud. Document verification determines whether a document is genuine or fake through a series of checks. These include field-to-field consistency, data validations and font anomaly detection, among others. You can read the full blog about document verification here.
But the best approach to identity verification combines a document check with biometrics. Document verification plus a facial check not only verifies that the document is genuine, but also confirms that it actually belongs to the person presenting it.
Why biometrics are key to identity verification
There are several different ways you can perform identity checks. Each have their own advantages and disadvantages.
For example, you can compare a person’s data to the information held by a credit bureau. Credit bureau checks are fast and you can process them on mass, hence it is a scalable solution. However, a credit bureau check only protects against fake data. This information doesn’t protect you against fake identities.
If you ask someone for their identity document, the risk of impersonation drops. And document verification protects against forged or counterfeit identity documents. However, it’s nearly impossible to detect IDs that haven’t been reported as stolen or added to a law enforcement database.
This is where biometrics comes in. Once you’ve verified a document, biometric technology can verify that the document truly belongs to the person using it. Facial biometrics compare the characteristics of the user presenting the identity document with the ones on the document itself. This adds a layer of protection against stolen IDs and impersonation attacks.
Fake details e.g., SSN, name, date of birth, address
DETECTABLE by an identity database
Stolen details, fake document
UNDETECTABLE by an identity database
DETECTABLE by document verification
Stolen details, stolen document
UNDETECTABLE by an identity database
UNDETECTABLE by document verification
DETECTABLE by biometric verification
The two types of biometric checks: selfie and liveness
So what do we mean when we talk about facial biometrics? How do you actually compare a person’s face with an image on their document as part of an identity verification process?
Well there are several ways to do this. The first is via selfie verification.
By asking a person to take a live selfie, this is then compared to the extracted photo from the identity document. Our proprietary algorithm has been trained to compare the face in the identity document with the selfie and returns a similarity score.
The selfie is also analyzed for abnormal texture. This helps to capture photos of photos, or photos of screens, which a fraudster may have tried to pass off as a selfie.
Liveness tests add an extra layer of protection from more sophisticated fraud attacks. They deflect the same attack vectors as a selfie check, but also deter spoof selfies, deep fake videos, and 2D and 3D masks.
A liveness test asks the user to take a short video on their phone. They perform a movement, or say something such as randomly generated numbers. Using voice, motion and texture analysis we can determine that the person is actually present and not using a mask or prerecorded video.
To sum up, biometric checks can protect against the following:
- A photo from the web
- A screenshot
- Photo of the photo on the identity document
- Photo of a printed photo
- Photo of a digital screen
- A digitally tampered selfie
- Photo of a digitally tampered selfie
- 2D and 3D masks
Evaluating biometric solutions: what you need to consider
It’s important for your business to keep up with new fraud techniques. But it’s also important to minimize rejections and drop-offs during an onboarding or purchase process. And finally, you need to scale this process in a cost-efficient way. The balance is tough, and you should take these points into account when considering a biometric solution.
You also need to consider your business’ risk appetite. Not all customers or situations are the same. Increased reward means increased incentive for fraud. For high-value products, high-risk users or highly regulated geographies, you might want extra levels of protection. Or you might want to put different types of customers through different levels of identity verification.
For example, you might only want to leverage biometric checks at certain times, or for certain people or products. Having flexibility when it comes to biometrics and identity verification is important so that you can balance risk appetite and end-user friction.
To find out more about why biometrics is key to proving digital identity, take a look at our report on the subject.