How tokenising digital identities can reduce fraud and protect data

Con­sumers are becom­ing increas­ing­ly con­cerned about the lack of con­trol they have over their per­son­al data and how it is used. More than eight in 10 Amer­i­cans believe they have lit­tle or no con­trol over their data once it is shared with a com­pa­ny, accord­ing to a study by Wake­field Research and Au10tix, an iden­ti­ty ver­i­fi­ca­tion tech­nol­o­gy provider. Mean­while, almost two in three Amer­i­cans believe threats to their per­son­al data are grow­ing faster than com­pa­nies can keep pace.

With cyber­crime on the rise, finan­cial ser­vices com­pa­nies need to do more to pro­tect their cus­tomers’ per­son­al data. Last year, the num­ber of data com­pro­mis­es in the US hit 1,862 – the most on record and a 68% jump from 2020 – accord­ing to the Iden­ti­ty Theft Center’s 2021 Data Breach Annu­al Report and the num­ber of report­ed cas­es of iden­ti­ty theft increased to 51,629 last year, accord­ing to the FBI’s 2021 Inter­net Crime Report. In 2019, that num­ber was 16,053.

The Au10tix and Wake­field Research study showed that more than half of respon­dents are wor­ried about their per­son­al data falling into the wrong hands, while 44% said they had already been vic­tims of per­son­al data theft.

“Cur­rent­ly, third-par­ty organ­i­sa­tions often retain the dig­i­tal cre­den­tials peo­ple share with them rather than using them for ver­i­fi­ca­tion and dis­card­ing them,” says Guy Mor­doch, chief oper­at­ing offi­cer at Au10tix. “That means every time a con­sumer shares a piece of them­selves it enables oth­ers to cap­ture that infor­ma­tion and poten­tial­ly mis­use it in the future.”

To reduce that risk, finan­cial ser­vices com­pa­nies should only be using the min­i­mum amount of per­son­al data required to prop­er­ly authen­ti­cate an indi­vid­ual – some­thing that is a decep­tive­ly dif­fi­cult prob­lem – says Mor­doch. “The future lies in the tokeni­sa­tion of dig­i­tal iden­ti­ties; the abil­i­ty to split these iden­ti­ties into mod­u­lar ele­ments, enabling con­sumers to share only the spe­cif­ic data points they choose,” she says. “This tokeni­sa­tion will lead to less infor­ma­tion exchanged, lim­it­ing risk for the own­er and the user of that iden­ti­ty data.”

Com­pa­nies also need to clear­ly explain in sim­ple lan­guage how an individual’s per­son­al data is being used, while out­lin­ing the ben­e­fits of giv­ing com­pa­nies access to that data. Com­pa­nies should also ensure they have clear pro­ce­dures that gov­ern the requests for the removal or trans­fer of an individual’s per­son­al data – made eas­i­er by the tech­nol­o­gy pow­er­ing this tokeni­sa­tion.

Tokeni­sa­tion is where we can not only ver­i­fy the authen­tic­i­ty of an ID but can cre­ate a tokenised cre­den­tial that sits with­in a ‘dig­i­tal wal­let of choice.’ This is just one of many exam­ples of Au10tix’s com­mit­ment to a self-sov­er­eign iden­ti­ty infra­struc­ture. One that fur­thers a safer, more inclu­sive world in which a user’s iden­ti­ty is theirs alone.

“Users should be pro­vid­ed with dif­fer­ent options for data shar­ing, and con­sent should be secured for the option that an indi­vid­ual is most com­fort­able with,” Mor­doch says. “Com­pa­nies should take this one step fur­ther and edu­cate their cus­tomers. Users can’t trust you if they don’t under­stand your process­es.”

W3C – which defines stan­dards for the world wide web – has cre­at­ed a data stan­dard called ‘ver­i­fi­able cre­den­tials,’ which gives indi­vid­u­als con­trol of their own dig­i­tal ID and cre­ates secure dig­i­tal cre­den­tials that can be used and shared as they wish.

“Allow­ing con­sumers agency over their per­son­al infor­ma­tion proves that trust over trans­ac­tion is the new glob­al iden­ti­ty man­date for busi­ness­es,” says Jonathan Wil­son, chief risk and com­pli­ance offi­cer at Au10tix. “Con­sumers prov­ing their iden­ti­ty in an age of increas­ing dig­i­tal fak­ery has become imper­a­tive and now is the time to safe­guard per­son­al data against secu­ri­ty breach­es.”

Many con­sumers are also unhap­py with the amount of per­son­al infor­ma­tion they are being encour­aged to hand over. As many as 86% of Amer­i­cans believe com­pa­nies and organ­i­sa­tions col­lect more infor­ma­tion than they need, while almost two-thirds of con­sumers (64%) have quit doing busi­ness or work­ing with an organ­i­sa­tion because it has asked for too much per­son­al infor­ma­tion. Iden­ti­ty ver­i­fi­ca­tion process­es often involve pages of per­son­al data being col­lect­ed, com­pa­nies have the oppor­tu­ni­ty here to meet con­sumer demands by doing more with less.

This would require con­sumers to share the small­est amount of data nec­es­sary to achieve a spe­cif­ic pur­pose rather than pro­vid­ing exces­sive amounts of sen­si­tive infor­ma­tion that can be mon­e­tised or com­pro­mised. By under­stand­ing what a cus­tomer is intend­ing to do, busi­ness­es can iden­ti­fy what infor­ma­tion is required for that pur­pose. By lim­it­ing the amount of data request­ed, busi­ness­es can increase con­sumer trust while con­tin­u­ing to pro­tect their cus­tomers against the risks asso­ci­at­ed with com­pro­mised data.

“With increas­ing pres­sure on organ­i­sa­tions to keep iden­ti­ties safe, there is an imper­a­tive to cre­ate secure dig­i­tal cre­den­tials for all aspects of life, tru­ly putting indi­vid­u­als in con­trol of who has access to which cre­den­tials,” says Wil­son.

While greater per­son­al­i­sa­tion in finan­cial ser­vices is being dri­ven by insights gen­er­at­ed from cus­tomers’ per­son­al data, organ­i­sa­tions need to bal­ance that with secu­ri­ty and com­pli­ance con­sid­er­a­tions to increase trust with cus­tomers and improve oper­a­tional resilience.
“Cus­tomer data is crit­i­cal to inno­va­tion and growth for finan­cial ser­vices com­pa­nies, how­ev­er mis­use and fail­ure to pro­tect this data could wreak hav­oc on the finan­cial ser­vices indus­try,” says Wil­son. “For busi­ness­es, not tak­ing ade­quate steps to pro­tect cus­tomer data could lead to reg­u­la­to­ry penal­ties or rep­u­ta­tion­al dam­age that could lead to a loss of cus­tomers and oper­a­tional loss­es from fraud or oth­er cyber­at­tacks.”

Near­ly all of Amer­i­cans (97%) expect organ­i­sa­tions to take action after suf­fer­ing a data breach, with 70% say­ing that busi­ness­es should alert all cur­rent cus­tomers if their per­son­al data has been com­pro­mised, accord­ing to Au10tix.

“Anoth­er 69% believe that busi­ness­es that have suf­fered a breach have a respon­si­bil­i­ty to help vic­tims recov­er stolen iden­ti­ties. That mat­ters because also at stake are poten­tial finan­cial loss­es for cus­tomers, loss of pri­va­cy and poten­tial exclu­sion from prod­ucts or ser­vices due to per­ceived risks,” says Wil­son.

He adds: “Busi­ness­es that do not ade­quate­ly address con­sumer pri­va­cy and data con­cerns will be left behind as this new era approach­es. Busi­ness­es will have to not just stay in com­pli­ance when it comes to pro­tect­ing their cus­tomers’ data, they will have to main­tain the cus­tomers’ trust, which our data shows is para­mount to doing busi­ness any­where.”

With the abun­dance of per­son­al infor­ma­tion col­lect­ed dur­ing the appli­ca­tion process for bank accounts, lines of cred­it, loans, and mort­gages, finan­cial ser­vices organ­i­sa­tions are respon­si­ble for main­tain­ing secur­ing and pro­tect­ing this sen­si­tive data.

“Cur­rent­ly, these com­pa­nies rou­tine­ly trans­fer large amounts of per­son­al­ly iden­ti­fi­able infor­ma­tion (PII) through a com­plex web of data agree­ments, com­pro­mis­ing both pri­va­cy and secu­ri­ty,” says Mor­doch. “There is an oppor­tu­ni­ty for organ­i­sa­tions in this sec­tor to work towards a sin­gu­lar, secure repos­i­to­ry where cus­tomer data lives and can be accessed through a cer­ti­fi­ca­tion sys­tem. Today’s tech­nol­o­gy – par­tic­u­lar­ly fed­er­at­ed learn­ing and trust net­works – makes it pos­si­ble to acquire insight from data with­out acquir­ing or trans­fer­ring the data itself.”

More impor­tant­ly, tech­nol­o­gy can help reduce fraud. By automat­ing iden­ti­ty ver­i­fi­ca­tion, Au10tix’s tech can detect fraud­u­lent trans­ac­tions in sec­onds using a com­bi­na­tion of machine learn­ing and com­put­er vision.

“Con­sumers’ online iden­ti­ties are the new cur­ren­cy, and the stakes around this cur­ren­cy are high,” Mor­doch says. “It’s time for con­sumers to claim their dig­i­tal iden­ti­ty, and like all forms of cur­ren­cy, it must be pro­tect­ed from theft and fraud.”

Since the start of last year, Au10tix tech­nol­o­gy has pre­vent­ed more than $4.5bn in fraud-relat­ed loss­es across a range of indus­tries, includ­ing finan­cial ser­vices.

For more, please vis­it au10tix.com

Pro­mot­ed by Au10tix