Facebook's Libra

JULY 2019

Facebook’s Libra AND THE FUTURE OF DIGITAL IDENTITIES Page 6 (Feature Story)

Apple launches its own digital ID program 9Page 9 (News and Trends)

The challenges of digital IDs in the mobile space 13Page 13 (Deep Dive)

FEATURE STORY Wayne Vaughan, co-founder of the 06 Decentralized Identity Foundation, on Facebook’s Libra cryptocurrency and how it will impact the digital identity industry

NEWS AND TRENDS METHODOLOGY The latest headlines from around the digital Who’s on top and how they got there, including 09 identity space, including Apple's new digital ID 15 three sets of top provider rankings program, 3D finger vein scanners at hospitals and more

DEEP DIVE SCORECARD An in-depth look at mobile digital IDs and the The results are in. See the highest-ranked 13 issues world governments have faced during 16 companies in a provider directory featuring implementation more than 200 major digital identity players.

ABOUT 89 Information about PYMNTS.com and Jumio TABLE OF CONTENTS

ACKNOWLEDGMENT The Digital Identity Tracker is done in collaboration with Jumio, and PYMNTS is grateful for the company’s support and insight. PYMNTS.com retains full editorial control over the presented findings, methodology and data analysis. WHAT’S INSIDE

The digital identity market is expected to reach $15 billion paralysis of choice with so many options available. One by 2024, and giants such as Google and Apple are rac- potential solution is a decentralized, self-sovereign stan- ing to improve identity verification experiences. Utilizing dard that allows consumers to own their digital identities Facebook and Google to log into third-party websites and use them for anything they need. This would prevent has become ubiquitous, along with the ability to pay them from having to create multiple accounts on different for goods and services via developers’ proprietary pay- platforms or relying on a single login tool, like those pro- ment methods. vided by Apple or Google.

Concerns about digital ID security continue to make head- Such a solution is a way off, but firms and governments lines, howerver. The 2017 Equifax data breach, which around the world are continuing to innovate in the space. exposed more than 148 million digital identities, serves as developers’ nightmare scenario, painting a picture of what Digital identity developments around the world could happen if they’re not thorough. Poor security could Apple announced its own digital ID program, Sign In with result in billions lost to fraud, with more to follow if con- Apple, at its recent Worldwide Developers Conference. All sumers leave their platforms over data concerns. App Store apps that offer third-party sign on systems will be required to offer Apple’s program as well. The company Many developers are leveraging biometrics to protect noted that Sign In with Apple will be available for develop- their customers, as such technologies provide safer er testing later this summer. alternatives to passwords and knowledge-based verification systems. The biometric market is projected to reach Switzerland’s Jura Hospital is currently testing a 3D fin- $59 billion by 2024, and its solutions include everything ger vein scanner to more effectively secure patient data. from facial recognition to behavioral analysis to blood The move is part of Switzerland’s E-Health initiative, which vessel scans. requires the nationwide implementation of two-factor authentication (2FA) in healthcare. Jura chose this system More players are involving themselves in the digital ID specifically because it is capable of recognizing blood market as it grows, but many industry experts fear a vessels through surgical gloves.

South Korea’s Financial Services Commission (FSC) has approved blockchain operator ICONLOOP’s my-ID sys- Executive Insight tem to protect data collected for digital identities. my-ID stores identifying information on customers’ phones, preventing them from having to create new accounts when accessing different services. ICONLOOP expects How can platforms better balance secure that my-ID data will be readily accepted by banks and authentication with usability? FinTechs without the need for further verification.

For more on these stories and other digital identity developments, read the Tracker’s News and Trends sec- “There are a few key ingredients required when it comes to optimizing usability. Traditional methods of tion (p. 9). authentication have their own set of [user experience] challenges. Facebook’s Libra cryptocurrency raises concerns Passwords: The average person [has] 90 online ac- among privacy and security advocates counts [that require] passwords, and the number Facebook made waves last month when it announced keeps growing. … About a third of online purchases are abandoned at checkout because consumers cannot Libra, a cryptocurrency set to launch next year. The so- remember their passwords. cial media company also quietly revealed its intention to SMS-based two-factor authentication: Many websites explore a decentralized digital identity standard, which send security codes to your phone number to confirm has long been a dream of groups like the Decentralized your identity when signing in. But what happens if you lose your phone? You can try using recovery methods Identity Foundation (DIF). For this month’s Feature to access your accounts, but it’s generally an unpleas- Story, (p. 6) DIF’s co-founder Wayne Vaughan spoke ant experience.

with PYMNTS about how Libra has disrupted the Knowledge-based authentication: [This method] is digital ID space, and his concerns over the cryptocurren- plagued with usability and security challenges, includ- cy’s security. ing users forgetting the answers to their supposedly secret questions. Deep Dive: The latest initiatives and challenges to Biometric authentication, however, holds much more expanding mobile ID promise. Thanks to [facial recognition], all you need is to create a 3D face map when the original account Digital identities are more widespread than ever, but is created. … Users can [then] unlock their accounts and [complete] high-risk transactions — including wire there are still more than a billion people around the globe transfers and password resets — with … selfies. It’s who lack identifying documentation. Smartphone-based simple, fast and dramatically more secure than tradi- mobile ID systems could close this gap by providing fast tional authentication methods.” access to vital online services to anyone who owns such a device, but the growth of mobile IDs is not without its difficulties. This month’s Deep Dive (p. 13) explores the latest public and private mobile ID programs, as well as REINHARD HOCHRIESER the teething issues they face during implementation. vice president of product management, Jumio

Number of people worldwide without 1b any proof of identity

Number of data records exposed due to data 1.6B breaches since 2005

Projected value of the digital identity Five Fast Facts $15b market by 2024

Amount lost to new account fraud in North $3.4b America in 2018

Portion of Indian citizens over the 99% age of 18 who are enrolled in the country’s digital ID program

Facebook’s Libra AND THE FUTURE OF DIGITAL IDENTITIES

Social networking giant Facebook made headlines last service or relying on a single log-in tool from a massive month when it announced Libra, a new cryptocurren- corporation like Apple or Google. cy expected to launch in 2020. Cryptocurrencies are The Decentralized Identity Foundation (DIF) has been well-trodden ideas in the FinTech world — more than 1,600 working with corporations and regulators to one day are currently in circulation — but Libra has the largest fi- reach this goal, but the foundation’s co-founder, Wayne nancial backing of any to date. Vaughan, has some concerns surrounding Libra’s impact The main buzz surrounded the cryptocurrency itself, but on the future of digital identity. a Libra-focused white paper also held a pair of sentences that painted Facebook’s intentions in a new light: “An addi- Libra’s privacy concerns tional goal of the association is to develop and promote an Facebook is no stranger to the concept of digital identi- open identity standard. We believe that decentralized and ty, and many websites that require users to log in often portable digital identity is a prerequisite to financial inclu- allow visitors to use their existing Facebook credentials sion and competition.” rather than create new accounts. With that convenience comes a trove of data that Facebook can access about its A truly decentralized digital identity standard has been a users, however. Libra will provide the social media giant white whale for tech companies for decades. Such a solu- with similar information about its users’ financial habits tion would allow consumers to own their digitial identities as spending occurs. and use them for whatever they need, rather than having to create individual accounts and passwords for every “There has to be a way to identify who is transacting within the system,” Vaughan explained. “The identity component

of this is probably not being driven by nefarious motives. “But, if you have a hundred partners, those hundred part- It's being driven by the need for having regulatory compli- ners are responsible for securing themselves — and that’s ance in multiple jurisdictions, not an identity that is tied to a hundred points of failure.” any one particular government.” Facebook has few options available when it comes to en- Concerns would be exacerbated if Libra ran on a public suring all its partners are on the same security page. ledger, which is the case for many other cryptocurrencies “You could also certainly reduce risk by using cryptog- like bitcoin. Public ledgers could expose financial data, raphy to increase the security of the ledger and keep allowing outsiders utilizing artificial intelligence (AI) and transactions private,” Vaughan speculated. “Or, you could pattern recognition to identify and name the individuals try to implement some sort of certification program or an who are making purchases. audit process. I think that regulators and governments “Just five data points might be enough [for a company] to might insist on something like that.” say, ‘I’m pretty sure that this identity that’s anonymized on Just days after the Libra announcement, the House the Libra ledger is Wayne Vaughan because he purchased Financial Services Committee called on Facebook to halt something of this amount at this store at this time,’” all development until Congress and federal regulators Vaughan said. “Now [the firm] can search the entire public could investigate how the cryptocurrency might cause ledger for a set of data for all the transactions that are as- danger to the global financial system. sociated with that identity.” “If products and services like these are left improper- Online retailers would likely have a targeted marketing ly regulated and without sufficient oversight, they could field day if they received these complete purchase histo- pose systemic risks that endanger U.S. and global fi- ries from the Libra platform. nancial stability,” committee chairwoman Rep. Maxine Can Facebook be trusted to secure financial data? Waters (D-CA) wrote in a letter to Facebook CEO Mark Zuckerberg. “These vulnerabilities could be exploited and Facebook has experienced well-publicized data breaches, obscured by bad actors, as other cryptocurrencies, ex- including exposing approximately 50 million accounts in changes and wallets have been in the past.” a single attack last year. Financial data is a prime target for hackers and fraudsters, leaving consumers concerned It appears that Facebook is moving full steam ahead with about Libra’s potential security holes and avenues for Libra’s implementation despite regulators’ concerns. attacks. Facebook partnered with 28 corporations to de- There are still some questions regarding how the system velop Libra’s infrastructure, but the company intends to will operate, and whether the privacy and security con- expand that number to more than a hundred. cerns will be relevant when Libra goes live next year. How Facebook addresses these issues could be the determi- “[Facebook’s] development operations team is respon- nant for Libra’s future success. sible for securing its own infrastructure,” Vaughan said.

New Digital ID solutions fraud accounting for $3.4 billion and pressuring financial institutions (FIs) to keep customers safe. Apple announces sign-in solution Secure Agreement Authentication includes an identity Technology giant Apple announced a new digital ID pro- verification hub that checks multiple facets of applicants’ gram at its recent Worldwide Developers Conference, and digital IDs, including their credit histories and biometrics. revealed that all apps in the App Store that offer third-party Customers can also use the platform’s eSignature func- sign-on systems, such as Google or Facebook login, will tion to complete the onboarding process. The platform be required to offer Sign In with Apple. The service is cur- runs on open application programming interfaces (APIs) rently unavailable, but Apple plans to release the program and integrates with OneSpan’s Trusted Identity offering, for developer testing later this summer. which is designed for risk analytics and mobile applica- Sign In with Apple will allow users to restrict the infor- tion security. mation — such as email addresses — that is shared with apps. The solution will generate proxy email addresses WISeKey releases updated version of WISeID suite for users looking to keep their identities safe, enabling Cybersecurity and internet of things (IoT) solutions pro- them to create accounts on apps without revealing their vider WISeKey recently announced the latest version of personal contact information. its proprietary WISeID suite. The company added two new features to its Personal Vault app to strengthen user au- OneSpan launches cloud-based onboarding thentication and email security. One of the items is WISeID platform Authenticator, a login solution that generates one-time Digital identity provider and cybersecurity compa- passwords for compatible websites like Facebook and ny OneSpan recently launched its Secure Agreement Gmail. This offering is based on the keyed-hash message Authentication cloud solution to automate account open- authentication code (HMAC) standard and is compatible ing processes and reduce fraud. Research from the with Google Authenticator. company found that global fraud losses totaled more than The second feature is a simplified digital certificate $31 billion in North America last year, with new account system that integrates with users’ email providers and

encrypts messages with digital signatures. The tool is Swiss hospital trials finger vein biometrics based on X.509 and S/MIME standards and is compatible Switzerland’s Jura Hospital is also considering biomet- with any device and operating system. rics, currently testing a 3D finger vein scanning system to more effectively secure patient data. The move is part Digital ID partnerships of the Swiss Confederation’s E-Health project, which requires the nationwide implementation of 2FA for access Bank ABC to integrate Jumio platform for biometric to patient data. functionality The hospital’s system was designed by New Jersey-based Bahrain’s Bank ABC has partnered with identity service developer Global ID, a provider offering a scanner that is provider Jumio on a biometric-based identity verifica- capable of recognizing blood vessels — which are unique tion solution. The former will integrate the latter’s Identity to each individual — through surgical gloves. The tool Verification Platform, which includes a selfie-based shines near-infrared LED light at a user’s finger, darken- authentication system and allows users to open new ac- ing the hemoglobin in the blood and making the veins counts without visiting physical branches. The offering more visible. The finger is then scanned and an AI solu- aims to accelerate what is typically a two-week onboard- tion matches blood vessel patterns to information from ing process. a database to authenticate identites. The entire process The partnership positions Bank ABC as the first bank in the is done via a small terminal and typically takes less than Middle East to deploy a biometric-based, digital know your two seconds. customer (KYC) tool. The Identity Verification Platform has been adopted by several other businesses, including UK’s ACS implements Yoti age verification system digital bank Monzo, online gaming platform Novibet and The United Kingdom’s Association of Convenience Stores information technology provider TruNarrative. (ACS) has approved biometric developer Yoti as a digital identity solution provider for its member stores. The International ID innovations former plans to integrate the latter’s digital ID app for age-restricted purchases such as tobacco, energy drinks Bank of Thailand to adopt biometric verification and lottery tickets. Alcoholic beverages are governed by Thailand's central bank, Bank of Thailand, has announced a different set of regulations and are therefore excluded plans to adopt facial and fingerprint biometric verifica- from the solution. tion by Q3 2019. The system is currently being tested for Consumers scan QR codes provided to the retailer and regulatory compliance, but will enable digital lending and share their personal information through the app, which likely be adopted by 12 other Thai FIs — including Bank of then retrieves the user’s age and optional photograph for Ayudhya, Kasikornbank and Siam Commercial Bank. additional security. Merchants are alerted if the customer The Bank of Thailand is also testing machine learning is underage but receive no other details. (ML), electronic wallets and peer-to-peer (P2P) lending solutions. Siritida Panomwan Na Ayudhya, its assistant IATA votes to adopt biometric authentication governor for payment systems, stated these innovations The International Air Transport Association (IATA) is look- are part of efforts to increase account openings. ing to bring biometrics to airports with the OneID initiative,

which calls for airlines, airports and government author- standards for the secure and convenient exchange of dig- ities to adopt paperless authentication methods. The ital identity information. group voted to accelerate the program at its 75th Annual General Meeting in an effort to implement more biometric GAO calls for federal agencies to tighten ID systems and resultantly free up 40 percent more terminal security practices space. OneID concepts are currently being tested at sever- The Government Accountability Office (GAO), the su- al airports around the world, including Hartsfield-Jackson preme audit institution of the United States, has issued Atlanta International Airport, Heathrow Airport and a report calling for federal agencies to strengthen their Sydney Airport. online verification procedures. The report stated that identifiable data obtained by the three major credit agen- The IATA also called for International Civil Aviation cies — Equifax, Experian and TransUnion — should not be Organization (ICAO) member states to endorse digital cre- used for knowledge-based verification questions as such dentials as an alternative to traditional passports, and has information became available on the darknet during the asked airlines and world governments to develop global 2017 Equifax breach. Agencies should instead rely on

alternative verification methods, such as comparing pho- operator ICONLOOP’s my-ID system has been approved for to IDs to documents on file. the FSC’s “Innovative Financial Services and Regulations Sandbox,” an exemption system in which selected fi- The General Services Administration (GSA) and the nancial services are exempt from certain regulations. Internal Revenue Service (IRS) have already phased out knowledge-based verification methods, while the Social my-ID is a blockchain based digital identity authentication Security Administration (SSA) and United States Postal service that stores identifying information on custom- Service (USPS) are currently planning to reduce their users’ phones, preventing users from having to create new age. Other agencies, including the Centers for Medicare accounts when accessing other services. Data is kept se- and Medicaid Services (CMS), have no plans to eliminate cure on the blockchain after it is provided, though users knowledge-based verification as the process of doing so will need to conventionally verify their identities if they would likely prove too expensive. want to change any of the stored information. ICONLOOP expects my-ID’s data will be readily accepted by banks Blockchain solutions and FinTech providers, as the blockchain is more secure than such institutions' own security systems. Polymath integrates Blockpass ID verification solution Brazilian banks leverage blockchain tech for new ID Security token platform Polymath revealed in a recent solution press release that it intends to integrate blockchain- Blockchain technologies are also making headway in South based digital identity verification solution Blockpass into America, with Brazil’s central bank, Câmara Interbancária its platform. The move will allow the former’s users to reg- de Pagamentos (CIP), introducing Device ID last month. ister accounts using the latter, simplifying onboarding and The blockchain-based solution is currently used by nine of reducing the computing power necessary for ID verifica- the country’s banks, and is integrated into Brazil's domes- tion. The integration will also free Polymath up to focus tic clearing system, the Brazilian Payment System (BPS). on the creation and management of security tokens. The platform uses cell phone and SIM card information Blockpass has collaborated with several other companies to authenticates and verify digital idenitties. That data is in the past year, including token trading platform Ethfinex, then used to generate secure digital identities recorded security token platform Tokenomica and blockchain de- on the blockchain, and can be used by FIs for verification veloper Waves. purposes. Device ID is the first blockchain-based bank- ing solution in the world used by multiple FIs, according to South Korean government approves blockchain- based digital identity solution Cointelegraph Brazil. The South Korean Financial Services Commission (FSC) is also forming a blockchain-related partnership. Blockchain

Global Mobile ID Demand And Barriers To Adoption

The world’s population is expanding and many citizens — Device manufacturers explore mobile ID particularly those in developing nations — have no means Digital wallets that hold plane tickets, credit cards or club of proving their identities. This can restrict their access memberships have been in use for several years now, but to vital services like education and healthcare, and rep- digital IDs still have a long way to go before they can en- resents a crisis so pronounced that the United Nations tirely replace their physical counterparts. Smartphones listed it on its Agenda for Sustainable Development: “By are currently unable to store government-issued IDs 2030, [we must] provide legal [identities] for all, including like passports or drivers licenses due to the extensive birth registration.” cryptography necessary to prevent fraud. Technology Mobile-based digital identities could play an important giant Google is looking to change that with its recent- role in solving this issue. Smartphone ownership has be- ly announced initiative to bring digital IDs to its Android come more widespread, paving a natural avenue for such devices. The company also plans to make these IDs tools. These mobile devices enable fast and secure ac- accessible even when a device’s battery is depleted, elim- cess to services, many of which are solely available inating another concern that often accompanies digital ID online. Private businesses and world governments are programs. quickly growing aware of mobile digital identities’ bene- Personal electronics manufacturer Samsung is looking fits, too, and dozens of initiatives are now taking place to at its own mobile digital ID solutions. Its Nexsign tool implement them around the world.

verifies users’ identities with biometrics, replacing Malaysia is making strides on its own national mobile easily breached or forgotten passwords and security ID initative, with the country’s communications and questions. Samsung also recently made a significant multimedia minister, Gobind Singh Deo, announcing investment in SentinelOne, a developer that specializes a voluntary program last year that is meant to supple- in endpoint detection and response (EDR) technology. ment its existing compulsory ID cards. The government The latter, which uses AI and ML to detect malware is currently taking bids from several technology com- and ransomware and protect users’ digital identities, panies that want to institute biometric identities for recently demonstrated the industry's interest in such Malaysian citizens, and expects the program to be fi- offerings by raising $120 million in a Series D funding. nalized by the end of 2019.

Governmental mobile ID initiatives Teething issues The city-state of Singapore has long been at the fore- Mobile digital ID programs have faced their share of front of digital identity, first introducing its SingPass complications, however. Kenya’s digital ID program, national ID card in 2003. The government plans to Huduma Namba, has been unable to register all 50 mil- adapt SingPass for smartphones this year by rolling out lion of its citizens, as many of them lack the paperwork a new national digital identity (NDI). This new system necessary to sign up for the system. One anecdote will encrypt identity information on citizens’ smart- comes from 18-year-old Nyangi who, like many phones, and utilize facial recognition, quick response Kenyans, was born at home and did not receive a birth (QR) codes and software tokens for authentication pur- certificate. Officials turned her away when she attempt- poses. The NDI is expected to be fully operational by ed to apply for the Huduma Namba, which is necessary the end of 2020. for smooth application for the Kipande national ID. Kipande grants citizens access to government aid pro- Singapore is also taking mobile ID steps with SG-Verify, grams such as the Community Development Fund and a new government-developed tool that will enable cit- Joint College Admission, and young Kenyans without it izens to use the NDI to access non-governmental are frequent targets of police harassment. functions like registering at hospitals or opening bank accounts. Enrolled citizens will be able to scan QR The Huduma Namba rollout is a prime case study for codes on their SingPass apps to upload necessary in- other governments exploring mobile digital ID pro- formation to the business they are looking to access, grams and the pitfalls that may result. Such systems preventing them from having to manually enter person- may provide convenient and valuable public services, al details. Singapore’s Government Technology Agency but citizens may decide it is not worth the trouble if stated the feature will be live by the end of Q3. they face too much hardship when enrolling.

Scoring overview Companies featured in the Tracker Scorecard have been evaluated based on four primary criteria:

Consumer data Online, physical identity, social identity and knowledge-based question data

Device intelligence Device fingerprint, IP geolocation, true app and device emulator features Scoring overview Transaction behavior Click flow, payment history and payment transaction features

Multifactor authentication PIN, biometric and security token features

If you would like your company to be considered for inclusion in the Tracker’s Scorecard, or wish to have an existing listing reconsidered for an update, please head over to our profile submission/update page.

01 Systems is a software application and solution provider. Its products include Arabization, signature management, biometric solutions, enterprise content management and digital vouchers.

Products: Biometric authentication, enterprise content management, signature management Customer Focus: Financial services