Carpadium Consulting

More and more banks and financial institutions are looking at Electronic Verification (EV) as a way to improve their customers’ online experience, while at the same time improving the efficiency and accuracy of customer enrolment to tackle the ever-increasing threats of online crime.

EV is coming up more and more often in our consulting activities, so we thought it would be useful to provide a quick introductory overview of the basic concepts for anyone wondering what it is all about.

What is Electronic Verification?

Electronic Verification (EV) is a process that verifies the identity of a new customer to a bank or financial institution using a combination of publicly and privately available electronic data sources.

EV is the electronic equivalent of sighting a physical identity document to verify the correctness of information provided by a customer. EV is attractive to financial services organisations because it can remove the need for a new customer to present physical identity documents in person or via certified copy.

In general, the EV process works as follows:

• An individual’s identity information finds its way onto a government or private sector database through an existing identity collection and verification process.
• The individual provides identity information to the financial services organization as part of a customer or product origination process, typically performed by the customer using the financial institution’s web site.
• The organisation tries to match that information against available government or private sector databases to verify the customer’s identity.

It is important to note that any rejection via electronic means does not exclude the customer; it only excludes them for this type of verification. Traditional paper based identification is still available, and so EV is typically used in conjunction with other forms of identity verification.

At its best, Electronic Verification:

• Is a very cost effective way of complying with the identity verification component of anti-money-laundering/know-your-customer (AML/KYC) requirements,
• Removes the need for new customers to produce paper-based identification documents face-to-face or via mail as a certified copy, and
• Removes human error and provides a separation between customer-facing staff and the original identification due-diligence process.

However, EV is not perfect. It can also:

• Open the door to the creation of many fraudulent accounts,
• Expose the Australian public to an increased threat of identity takeover,
• Lead to a downward spiral in the value of existing identity credentials, and
• Result in contracts and agreements becoming unenforceable in court.

Balancing these risks and rewards as Australian financial services organisations roll out EV programs is critical to acceptance of the approach by the general public.

The Electronic Verification landscape

There are five main elements to the EV landscape in Australia:

• The Legislative Environment is the combination of the Australian anti-money-laundering/counter-terrorism financing (AML/CTF) and Privacy legislation, including how it is applied and interpreted.
• Data Providers are those Government and Private entities and organizations that allow access to data for identity verification purposes.
• Service Providers allow access to identity data, including the ability to verify and score it against an identity scorecard.
• Businesses (also known as relying parties) are the entities that use this data for the purposes of verifying the identity of new customers.
• Private Individuals are people living in Australia that have physical or electronic identity information.

The Legislative Environment

Part B of the Australian Government’s AML legislation provides for a “risk-based approach” to customer identity collection and verification, along with guidance on minimum requirements. In addition, the legislation also provides for a second level of identification collection and verification called “safe harbour”.

The extent to which the Privacy Act influences the EV landscape is limited to the Government’s agreement on access and disclosure of new sources of identity verification data. The most contentious part of the legislation to date is the provision and use of consumer credit data. Part IIIA of the Privacy Act expressly excludes the use of credit information for the purposes of accessing transaction history. At this point in time the debate continues without official guidance.

Data Providers

Existing Sources of EV Data

Data providers are those government and private entities that hold data and make it available for the purposes of identity verification. There are two principal sources of this kind of identity data in Australia:

• Government sanctioned data sources including the Australian Electoral Roll, OFAC, DFAT, Department of Immigration and Citizenship Visa Verification Service.
• Privately held databases including Sensis White Pages DirectAccess™, Public Number Database, Historical Public Number Database and the National Homeowners File.

Future Sources of EV Data

Existing identity verification companies are actively trying to unlock new data sources from both government and privately held sources. In Australia there are six other government data sources that remain essentially untapped:

• Electoral Roll, including date of birth information
• Birth Deaths and Marriages, including full name and date of birth
• Tax File number, including full name and address
• Drivers Licence, including full name, address and date of birth
• Passport Office, including full name and date of birth
• Medicare, including full name and date of birth

Other Sources of EV Data

Credit data is explicitly restricted in its uses by the Privacy Act. There are two major sources of credit data in Australia: Veda Advantage and Dunn and Bradstreet. While there has been significant rhetoric from financial services organisations and data providers regarding the use of credit data as a safe harbour mechanism for electronic verifications, to date there has been little or no regulatory guidance.

Service Providers

Electronic Verification service providers offer the ability to verify identity credentials against a list of both publicly and privately held databases. This takes the form of a technical interface that allows data to be matched and/or compared.

For the most part, these companies act as a data hub, allowing a relying party to verify against multiple sources with a single call into the Service Provider’s technical infrastructure. Some Service Providers also offer an identity scorecard that allows a relying party to make a risk-based decision to either accept or reject the EV data.

EV Service Providers create their value by gaining access to and aggregating publicly and privately available databases. Their success in matching an individual’s identity details depends entirely on the quality and breadth of the data held in the databases they access.

All Australian EV vendors offer access to similar public databases, and they all claim to be able to verify to a satisfactory level according to the AML/CTF legislation, including the safe harbour provisions.

Businesses

Businesses that make use of EV service providers typically do so to reduce the risks associated with original identification and customer or product enrolment processes. Before embarking down this path, it is important that businesses understand the risks and rewards of EV.

Risks worth considering include:

• Compliance risk, including their adherence to AML/CTF rules, impact on the future value of identity credentials, and how their implementation approach aligns with the organisation’s existing audit and compliance regime.
• Legal/privacy risk, including product terms and conditions and existing privacy principals.
• Fraud risk, including understanding how attacks happen and how to mitigate them.

Rewards to consider include:

• Better customer experience, including removal of the need to be physically present to enrol, which can then enable straight through processing.
• Capture of market share, by removing time delays involved in customer and product enrolment process.
• Cost reduction, by removing the need for face-to-face identity verification and handling physical identity documentation.

Experience shows that the benefits of EV can outweigh the risks, as long as the program is properly executed.

Individuals

Private individuals are potentially the most impacted by changes in the EV landscape because it is their detailed, personally identifying information with which relying parties and service providers transact. This raises two significant issues that individuals need to consider:

• The validity of personally identifying information depends entirely on an individual’s ability to maintain the correctness of their credentials on the various databases in which their data resides.
• The decision to EV (generally) lies with the individual. However, if a fraudster chooses to EV, then it is very unlikely that the defrauded person will have any idea – at least until is too late. This raises the question of just who is responsible for protecting individuals’ personally identifying information.

Individuals are most at risk when problems in the EV process manifest, yet it can be argued that they derive only marginal benefits. This misalignment between risks and rewards means that there is a very strong role for Government and regulators to ensure that relying parties and service providers do not exploit their positions at the expense of the individual.

The Top-5 Issues Hindering EV Adoption in Australia

Based on our experience with EV programs, we think that the Top-5 issues hindering EV adoption in Australia are:

• The validity and availability of current sources of identity for the purpose of identity verification
• Lack of a secure centralised identity verification service.
• Any degradation of identity credentials on any one part of the system degrades the whole.
• Ensuring that individuals keep their identity credentials up to date
• Understanding who is ultimately responsible for protecting the public from identity fraud: individuals or Government?

Addressing these issues is something that we are well placed to help our clients with over the coming years, because developing elegant solutions is a pre-requisite for further EV adoption in the Australian financial services marketplace.

Andrew

There are a few agencies reporting today on the news that Visa is mandating that credit cards will need to be chip-and-pin enabled by 2013.

While it’s obviously a good thing to improve card security, Australia actually has pretty low card fraud by World standards (although it is on the rise, and in some areas more than others). Because of these relatively low levels of fraud, our Banks have been a little slow to fully roll out new security measures. What has been standard in the UK for some years is only now just becoming standard in Australia. The reason for this is simple: Banks only ever spend on fraud reduction an amount less than they are losing in fraud.

What I find particularly interesting about this announcement is that it won’t really do too much to stop one of the main pain points: card-not-present fraud. Chips are great when you have a chip reader at the point of sale, but they don’t do too much when you don’t. The obvious example of card-not-present transactions is Internet commerce. Chip cards don’t help much to stop fraud here, unless you have some extra countermeasures. And that starts to get a little tricky in terms of cost, and not least of all in terms of the end user’s experience.

So, while this is a good step forward, it’s definitely not a panacea for all credit card security.

M@

An article in yesterday’s Australian commented on the latest Unisys Cybercrime Report.

The Unisys report is an interesting one. It comes out each year and it tends to get quite a bit of press here in Australia each time.

There is one aspect to it that I think is worth drilling into: and that is the issue of change of behaviour. So, whilst the report suggests that just under 9m Australians are extremely concerned about financial fraud and identity theft, the question that I would ask is this: is that fear enough to motivate a change of behaviour?

The majority of the detailed analysis that I have seem in this space tends to indicate that although people are very worried about this kind of thing, it almost never motivates them enough to change their behaviour. To be more specific, I have seen some evidence that banking customers take fraud and security into consideration, but little evidence to suggest that customers actually change banks because of this issue.

I think that there is an underlying psychological factor at work here, which is that people are actually prepared to give up quite a lot of security and privacy, as long as they obtain some utility in return. We obviously see this a lot with the likes of social networking sites like FaceBook. Often this utility can be simply a perception of utility, and in other cases it can be more real. The hassles associated with changing banks are so great, that most people end up being genuinely concerned about fraud and identity theft, but are happy enough to stick with their institution regardless.

There’s also another factor at work here in Australia, and that’s the fact that the Banks all conform to the “EFT Code of Conduct“. This code is actually voluntary for online banking (originally designed for EFT), but the banks are happy enough to stand by it for online transactions as well. This means that banks will reimburse a customer for any fraudulent activity that occurs on their online banking accounts (assuming that the customer didn’t do something provably stupid). This tends to put the onus on banks, rather than customers, to be concerned about online fraud.

And when it sometimes looks like banks spend as much on advertising about how secure their credit card and online banking services are as they do on countermeasures, I guess that gives you a sense of how they view the threat.

M@

Well, it’s been a while since I had an opportunity to post. The last couple of months have been very busy. Anyway, I stumbled across this link today (thanks to my brother):

The Six Dumbest Ideas in Computer Security, by Macrus Ranum

It’s not new (Sept 2005), but it’s really good on a number of dimensions. First up, it’s spot on topic. The computer security industry seems to get bigger ever year (on both sides of the legal fence), but it still manages to congratulate itself over and over again about how things are going so well. But I also really like the way that Marcus gives very useful names to the “anti-good ideas” he discusses. Phenomenology is always (is it?) the first step in breaking down complex problems.

M@