A good identification verification system should balance security, convenience, and privacy – but this is often easier said than done
Police, border agencies, and businesses needing to check the identity of individuals are struggling to verify documents online, according to law enforcement experts.
Online document checking is growing in importance in areas such as financial services, job and visa applications, and legal cases.
During the Covid-19 pandemic, more organizations have turned to online verification because of the difficulties of meeting applicants face to face.
Even in normal times, online checks should be quicker and more convenient than in-person identity verification.
Increased difficulties in verifying documents – including passports and drivers’ licenses – raises the risk of fraud and could make it easier for criminals to use forged or stolen documents.
“Terrorists frequently use fake ID and travel documents to carry out crimes,” warned Malik Alibegovic from Interpol’s Counterfeit Currency and Security Documents Branch during an online webinar last week.
“Genuine documents are used by imposters, and most dangerous [of all] they fraudulently acquire genuine documents.”
Another dimension
The challenge for law enforcement, government, and businesses is that identity and travel documents are designed for the physical, three-dimensional world.
These documents are developed with the intention of being checked by the human eye – either alone or in combination with machine-readable data, chips, and biometric scanning.
These checks are harder, or even impossible, to carry out online.
INSIGHT Darknet markets likely to continue despite exit scams and law enforcement takedowns
A physical document, such as a passport, has between 30 and 40 security features ranging from watermarks, typefaces, and the type and weight of the paper, as well as more advanced features such as contactless chips.
According to Michael Van Gestel, online document fraud specialist at Onfido, an ID verification vendor, this falls to as few as five to 10 identifying checks, if an agent checks a document from a ‘2D’ image such as a photograph or scan.
Some of the more robust security and checking features, such as the biometric chips used at automated border gates, are also not accessible online.
Online checks
Consumers’ smartphones and PCs lack the appropriate hardware to read chip information and governments are wary of sharing ID chip technology with the private sector.
But with growing pressure on companies to identify their customers and employees, demand for robust online identity checks is growing.
According to Van Gestel, a good ID checking system should balance security, convenience, accessibility, and privacy.
Checking physical documents online means creating a “chain of custody” from the consumer or citizen’s device, usually a smartphone, through to the identity checking system and their backend databases.
As a result, vendors are working with Interpol and other law enforcement agencies to create a robust process for ID checks online, and to train users.
“You can’t know all the features of four or five thousand documents, but a systematic approach will make your life easier,” said Van Gestel.
Automated verification
Online systems can automate the ID verification process, but they must be secure.
The first step is to control image capture, typically of the ID document, and the user’s face. Vendors need to lock this down so that a malicious hacker cannot interfere with the stream or upload a faked document.
Online checks that require a ‘live’ video feed are said to be more robust. One check Onfido uses is to challenge the applicant to read a series of numbers live to the camera.
Read more of the latest computer-enabled fraud news
Criminals, the company argues, are unlikely to want their image captured, even to acquire fake documents or access to systems.
And investing in secure ID checks will only increase in importance, according to Daniela Djidrovska, also of Interpol.
Areas such as visa fraud, which has grown rapidly between 2017 and 2019, are also putting more pressure on identity checkers.
“Applications are often checked by non-law enforcement authorities,” Djidrovska said, adding that automation, as well as training, should help improve the security of ID verification systems in the future.
READ MORE CCPA regulations go live, ushering in tighter data privacy controls for California residents
