About Somebody

Posts by Joe Somebody:

Reputable Companies Rejecting Facial Recognition Due to Racial Bias

A Guide To Customer Verification Ans ID Authentication in 2020 | Insights

Facial recognition is the cutting-edge science that allows programs to recognize and match a scan of a person’s face to a databased photo of that same person’s face for the purposes of identification. Although the practical applications for such technology are vast, unfortunately, the technology still has significant problems, at least not as far as many large companies are concerned.

FREE TRIAL

Learn More

As it exists at present, facial recognition technology has a racial bias problem. According to a facial recognition race test by MIT, three facial recognition programs produced identification errors at a rate of 0.8% for men with light skin. However, the error rate increased to 20% to 34% for women with dark skin.

Additionally, Amazon’s facial recognition program reportedly misidentified 28 members of Congress as people arrested for committing crimes. While only 20% of the congressional members were people of color, the group was still misidentified at a rate of 39%.

Founder of facial recognition tech company Kairos, Brian Brackeen offers some potential explanations for the disproportionate errors and bias of facial recognition race tests in identifying people of color. He notes that the algorithms used by American facial recognition programs operate using programmed datasets of images. These imagines often reflect the creators of the programs, which in this case happen to be overwhelmingly white and predominately men. Brackeen points out that similar software created in Asian countries tend to have lower error rates when identifying Asian people.

While there may be fixes to the technology down the road, many of the top tech companies are either extensively retooling or abandoning plans to provide facial recognition altogether.

Most specifically, companies like Amazon, IBM, and Microsoft are withdrawing their programs from government and law enforcement clients for fear of the consequences of such racially-biased technology.

Why the Cannabis Industry Needs to Be Better About Age Verification

Facial Recognition Bias and Law Enforcement

It is no coincidence that these companies are withdrawing facial recognition programs especially in the context of law enforcement at this current moment in time. The United States is in the midst of a pivotal moment in terms of police relations, particularly with minority citizens. Although it is still uncertain what American policing will look like when all the chips have fallen, utilizing technology designed to identify criminals, that is known to possess racial biases would do nothing more than exacerbate an already precarious situation.

The evidence of facial recognition bias is far from incidental. In a government-funded facial recognition race test, federal researchers found racial bias in nearly 200 facial recognition algorithms. What’s worse, several of these programs were intended for use by law enforcement.

The National Institute for Standards and Technology (NIST) pointed out that people of Asian, African, and Native American descent were the most likely to be misidentified.

It is difficult to nail down the exact number of law enforcement agencies still making use of facial recognition despite its glaring flaw and in what ways they incorporate it into their investigatory activities. According to a 2016 study by the Georgetown Law Center on Privacy and Technology, there is no notable regulation on the use of facial recognition by law enforcement bodies. This is an alarming reality, considering the existence of a bug as substantial as racial bias.

FREE TRIAL

Clare Garvie, who worked on the aforementioned study noted, “We ourselves were surprised by some of the findings we had, mostly in terms of the sheer scope of use of facial recognition at the state and local level across the country.”

She continued, “Also, [we were surprised] at the complete absence of any legal imposed regulations or even policies implemented by law enforcement to constrain its use.”

Facial Recognition Bias and Customer Identification

Some companies have tried to make use of facial recognition software as a means of customer identification. Customer identification has become extremely important in this age of highly sophisticated hackers. However, using technology with clear racial biases is almost certainly a misstep.

“We do not use facial recognition” has become a mantra for various automated customer identification providers. One such company noted that: “[r]eports of racial bias in facial recognition technologies have been percolating for years. We saw this coming, and avoided these technologies altogether”. The same company added that “[t]here are much better and more reliable ways of achieving automated customer verification.”

One of these methods includes “selfie ID” photo and video verification. Instead of using facial recognition, selfie ID photos and videos are checked for recency and authenticity. This provides an easy way to automate ID verification that is not dissimilar to providing ID in-person to purchase age-restricted products.

Conclusion

Creators of facial recognition software are understandably pulling their products from use by law enforcement agencies, and other contexts. When taking into account the racial biases present in the current versions of the technology, not doing so could have disastrous consequences.

These tech giants have acknowledged that a problem exists. If law enforcement or any other businesses try to make use of facial recognition in its current form, they are taking on the unnecessary risks of their own accord.

When it comes to customer verification, there are better choices available that don’t have a downside as incendiary as racial bias. Moreover, racial bias is only one of the problems inherent in facial recognition. In fact, Facebook had to pay upwards of $550 Million in a settlement having to do with the privacy concerns presented by the use of the technology.

Of course, beyond the ethical concerns — if facial recognition simply doesn’t work the way it is supposed to, what real use is it to anyone? Federal studies have shown that more often than not, the software just doesn’t work properly. False positives and false negatives could lead to injury on the side of the customer and a damaged reputation for the company in a time when race relations are under a bright spotlight.

CCPA and CPRA: What You Need to Know and Consider for Customer Requests

If you have customers in California, listen up! The California Consumer Privacy Act (CCPA) is here, the proposed modifications to the CCPA regulations are coming, and the California Privacy Rights Act (CPRA) is not far behind. They all affect you.

FREE TRIAL

Learn More

The following guide highlights the key aspects of the CCPA and CPRA and how they affect you and your business with customer identity verification.

What is the CCPA?

The California Consumer Privacy Act of 2018, or CCPA, directs businesses in their digital collection, storage and security of information of California-based customers.

While passed in 2018, the CCPA went into effect on January 1, 2020 with enforcement having started July 1, 2020. One round of implementing regulations came into effect in August 2020, and there are two more sets of proposed modifications pending as of the date of this article. Additional amendments through Proposition 24 – California Privacy Rights Act, which we will address shortly, will go into effect starting January 1, 2023.

Under the CCPA currently in effect, Californian consumers gain the protections of:

Learning what personal data a business has collected about them
Learning if and to whom their personal information has been sold or disclosed
Denying the sharing of their information
Receiving the same pricing and service, regardless of whether or not they’ve used any of these privacy rights

The CCPA affects legal, for-profit entities operating in California that collect personal information from consumers – provided they meet one or more of the following criteria:

An annual gross revenue that totals $25 million or higher
Buy, receive, sell, or share consumer data from 50,000 or more consumers, households, or devices
Make the majority of their annual revenue from selling personal data

What is the CPRA?

The California Privacy Rights Act of 2020 (CPRA), is the California ballot Proposition 24 which further expands California consumer privacy rights originally founded by the CCPA. Passed on November 3, 2020, the CPRA will take effect on January 1, 2023 and will affect data collected on or after January 1, 2022.

The CPRA affects legal, for-profit entities that collect personal information from consumers provided they meet one or more of the following criteria:

An annual gross revenue that totals $25 million or more
Buys, sells or shares personal data from 100,000 or more consumers or households
Makes at least 50% of their annual revenue from selling or sharing personal data

CPRA also amends the CCPA to include the following key changes:

Expanded definition personal information. “Sensitive personal information” includes standard private data as social security number, driver license number, and geolocation, but will also sensitive information such as genetic data, biometric data, ethnic origin, religious beliefs, union membership and sexual orientation among other data.

Specifications and restrictions on sensitive personal information. Consumers will be able to request limits on how their information is used and request corrections thereof. Additional disclosures, opt-in/opt-out consents and requirement and purpose limitation are also specified.

The creation of the California Privacy Protection Agency, or CalPPA. CalPPA will be established as an “independent watchdog whose mission is to protect consumer privacy… .” The CalPPA’s aim is to enforce the privacy laws and impose penalties.

Additional and enhanced protections for minors. CPRA will require businesses to obtain permission to obtain information from consumers younger than 16 and to obtain parental/guardian consent of consumers under age 13.

Inclusion of service providers, third-parties and contractors. Contractors and service providers will also be required to only use California consumer information for a limited time and specified reason.

FREE TRIAL

These external groups must also comply with CPRA in privacy protection and allow the contracting business access to monitor the compliance.

Explicit mention of prudent data security and liability. CPRA will require businesses to provide reasonable security procedures and practices to protect private personal information including regular audits and risk assessments. Companies who experience a data breach compromising consumers’ email, password and security question will be liable to private right of action.

Fines and Penalties

Companies that do not meet the current CPPA requirements leave themselves open to lawsuits from both California residents and the state itself.

Non-compliant companies can face civil penalties of $2,500 for each violation or $7,500 for each intentional violation that goes unaddressed for over 30 days. For instances of data breaches in which data is not harmed, consumers may collect between $100 and $750 for each instance. If harm is done, consumers may collect more than $750.

As imagined, data breaches can end up being extremely costly to businesses, not only in the managing and recovery of the breach, but in company reputation and CCPA penalties.

Under the CPRA, fines for violations for mishandling minor’s data will be at $7,500 per incident.

What Do The CCPA and CPRA Mean for Companies?

In light of the current CCPA and future CPRA, companies must not only ensure consumer data is secured from hackers and breaches, but companies also need to evaluate their current data awareness, collection, and distribution policies and practices.

The National Law Review provides a solid list of ten things companies should do to become compliant with the CCPA:

Delegate CCPA compliance oversight to a knowledgeable employee or team
Maintain and regularly update a business-wide privacy policy
Implement and maintain reasonable security practices
Maintain procedures to respond to request for access to personal data and specific pieces of information
Maintain procedures to respond to requests to delete personal information
Maintain procedures to respond to request to opt-out of sale of personal information
Update vendor contracts to comply with CCPA and avoid being characterized as “selling” personal information to vendors
Maintain procedures for collection and use of personal information of minors
Conduct appropriate privacy training for personnel depending on their job function
Assess affiliates’ need to comply with the CCPA

“Verifiable” Customer Requests?

A key aspect of the CCPA relates to how companies interact with customers wanting to exercise their CCPA information rights.

Learn More

The “right to know” and “right to delete” personal information are both options to consumers under CCPA. In both instances, businesses must “reasonably verify” that the person who is making the request is indeed the correct person.

However, according to the International Association of Privacy Professionals notes that changes to the CCPA “will make it more difficult for businesses to receive, verify, and respond to data requests submitted by customers.” This means companies will need to examine and perhaps improve their customer verification process.

The CCPA requires that:

Businesses create, document and enact a reasonable process for identity verification
Generally avoid asking for extra information to verify the customer unless it cannot do so with the information it has
Businesses not impose any fees on customers for identity verification for purposes of information access or deletion
Implement reasonable security measures to avoid and detect fraud in customer identity verification

For businesses that have a password-protected accounts, businesses may use those accounts and related password access to meet the reasonable verification standard.

However, for businesses that do not have password-protected account, verification is a bit more complicated. Non-accountholders must be verified through a reasonable degree of certainty “matching at least two data points provided by the consumer with data points maintained by the business that it has determined to be reliable for the purpose of verifying the consumer.”

This begs the question: how can businesses with customers who do not have accounts comply with these CCPA requirements to ensure reasonable identity verification? Below are three options:

Manual Verification– businesses could create processes and allocate employee resources to manually handle requests as they come in. Although this may appear simple at first glance, it would actually take considerable time to create the processes, and depending on how large the business and customer base is, will take considerable employee resources to oversee and implement.

Internal Software Automation– businesses could create their own bespoke automated software to handle requests and verify customers. While this could be a good long-term solution, the amount of time and financial resources to create this software would be a considerable upfront cost. And if a business does not have the internal technical resources, the business would need to employ an external technical manager and software developers. Keep in mind that advanced, multi-feature apps can cost between “$150,000 and $250,000” which does not include the long-term software maintenance.

Third-Party Solutions– businesses could source and employ a third-party solution that already has the functionalities in place to verify identities. Businesses need not be afraid of this solution especially if the third-party is CCPA compliant and has safeguards in place to protect personal information. Additionally, third-party options already exist that are easily to integrate into an existing website and are reasonably priced.

Final Words

The likelihood that your company has or will have a California-based customer is almost certain with California’s 39.5 million residents and fifth largest world economy worth $2.7 trillion. As such, companies cannot afford to ignore these groundbreaking legislative activities.

The CCPA and CPRA are likely only the beginning of more stringent consumer data collection regulation. Companies should immediately review their policies and procedures to ensure CCPA compliance or risk facing dire consequences.

Age Verification in International E-Commerce

While age verification has been a global issue in the e-commerce space for many years, it is now gaining additional attention with the surge of online retailers selling e-cigarette products, online betting services, mature video games, pornography, and cannabis, and new government legislation.

FREE TRIAL

Learn More

A commonly used method for online age verification employed around the world is “age gates.” Age gates typically take the form of a field that asks the prospective customer to enter their birth date or simply agree they are over the required age in order to proceed into the website proper. Having an age gate is one tool websites can employ to show that they are making an effort to keep their products and services away from those deemed too young. Moreover, as a benefit to the website owner, age gates are typically considered a “low cost, low effort way to…cover one’s assets.”

Unfortunately, age gates are not the robust and reliable barriers the name suggests. In fact, some find age gates simply useless. Age gates almost universally operate on the honor system. With rarely penalty for lying or reward for honesty, most people lie on age gates whether they actually need to or not. In most instances, it’s simply just faster to click boxes of some random qualifying birth date than it is to look for the real one.

Regardless of the country in which they are used, age gates are meant to be a digital barrier to discourage access to age-restricted goods and services from under-aged individuals. Yet the effectiveness of age gates has always been questionable at best.

A Global Need

Around the globe, governments have proposed and are enacting legislation that requires some online retailers to restrict access to minors. Many of these laws require reliable age verification that age gates do not provide. For instance, in some European countries such as Great Britain, the Netherlands, and Germany, online gambling is age-restricted to those 18 and over. Yet age gates do not meet the qualifications necessary to confirm a user’s age. Another example is in pornography. In the countries in which pornography is legal, age verification is required for online viewing, yet non-reinforced age gates typically do not suffice as proper verification.

Age Verification In International E-Commerce | Konfirmi Insights

Furthermore, new strict international legislation requires fortified age verification processes in order to avoid substantial penalties. Examples of recent legislation include the following:

In the UK, the Online Harms legislation proposal calls for “a new age of accountability” for social media to, among other things, keep children safe which would fine companies who fail to provide a safe environment with the higher of $24M or 10% of global turnover and criminal sanctions on senior management.

In Germany, online gaming is facing tighter restrictions with new legislations coming into effect on July 1, 2021. Failure to provide a robust age and identity verification will result in new online gaming licenses being rejected or existing operators facing fines up to 500, 000 Euros and the revocation of their license.

In mid-2020, the French Parliament introduced age verification requirements for online pornography viewing. Aiming to protect children from viewing this type of mature material, this legislation will penalize those companies who do not comply by imposing sanctions including having their websites blocked in France.

In India, the proposed Personal Data Collection Bill, 2019 aims to protect a child’s personal data with use of age verification. According to this legislation, a child’s (anyone under the age of 18) “data cannot be processed without the consent of parents or a guardian and verification of the child’s age.” Additionally, the bill aims to protect those deemed children from goods and services meant for a more mature audience which would require strict parent/guardian and age verification methods.

Canada’s Cannabis Act, which nationally legalized cannabis, advised retailers in 2019 that a “simple self-attestation of age” (the use of an age gate) does not comply with the Cannabis Act’s ruling to restrict the sale and/or marketing of cannabis to minors. Those retailers who do not comply could face license suspensions, loss of administrative fees, financial penalties up to $5,000,000 and imprisonment.

Advanced Solutions

Undoubtedly, having a strong and reliable age verification system has become even more important to e-commerce companies around the globe. Furthermore, with the complexity of global identification including varying types of personal naming traditions, government IDs, and access to third-party information, the international e-commerce community needs a variety of strong methods to verify age and identification in general.

Learn More

This begs the question: what tools can these websites use to meet legal requirements and provide a safe and friendly online experience for customers?

While companies legally required to age verify don’t have a choice in whether or not they use verification software, they may have a choice in what kind they use. These types of companies most commonly decide on said tools based on cost, ease of implementation, and customer user experience. Applications such as Konfirmi accommodate businesses in all of these factors. Companies like Konfirmi offer easy-to-use and cost-effective ways to verify the customer’s age along with identity.

As additional age verification legislation is sure to be passed around the world in the years to come, e-commerce companies must begin to consider how to improve their verification processes now.

The Most Useless Thing on the Internet

“Age gates,” or the most commonly employed age verification method to ensure a customer is of the appropriate age to view or purchase a product, are nothing new to the internet. They are intended to be a digital barrier to prevent under-aged individuals from gaining access to age-restricted commodities and services.

FREE TRIAL

Learn More

With the growing popularity of e-commerce, age gates are being implemented much more by websites selling vaping products, online betting platforms, pornography, and cannabis. However, their effectiveness has always been questionable at best.

Age gates most commonly take the form of a field that asks the prospective customer to enter their birth date or simply agreeing they are over the required age in order to proceed into the website proper. Having an age gate is an approach that websites can take to show that they are at least making an effort to keep their product away from those too young to legally purchase or access them. Moreover, age gates are a “low cost, low effort way to…cover one’s assets.” In fact, the ubiquity of age gates means their implementation often amounts to little more than drag and drop or copy and paste.

Unfortunately, age gates are not the impregnable fortresses the name might suggest. In fact, they almost universally operate on the honor system. Moreover, most people lie on age gates whether they actually need to or not. In most instances, it’s faster, and with no penalty or reward, to click the boxes of some random qualifying date of birth than it is to actually look for their actual one.

A Pew study confirmed that “39% of online teenagers in the US (admit) to lying about their age in order to access age-restricted services…”. Texas A&M University alcohol researcher Adam Barry notes that “Alcohol brand age gates are weak, at best, and likely an inconsequential barrier that someone with limited math abilities can easily overcome.” Moreover, few age gates have any functionality beyond blocking ages under 21 and allowing ages 21 and up. This means that despite the fact that someone born in the year 1900 is unlikely to even be alive to try to buy an e-cigarette, it raises no red flags on the e-commerce website.

The ineffectualness of age gating is starting to catch up to it. As Surly Brewing’s senior marketing manager Holly Manthei commented “The age gate is maybe the most useless thing on the internet.” So then, what’s the point of their existence at all if they can be bypassed with a simple deception? The unsatisfying answer is that they are often seen as better than nothing. With a need for stronger verification methods, age gates are reaching obsolescence.

Compliance Issues in the United States

While the Federal Trade Commission has encouraged the alcohol industry “to adopt and comply with self-regulatory standards to reduce the extent to which alcohol advertising targets teens, whether by placement or content,” the internet has brought a huge challenge to address this for not only alcohol, but other adult-targeted products.

The original purpose of age gating was to show legal and government authorities that a business was making efforts to age-restrict their products. Despite age gate’s ineffectualness, they placed the responsibility back on the consumer who would either need to be of age or lie about being of age to proceed.

The time of age gating providing effect cover for business is rapidly coming to an end. For instance, in California has determined that age gates do not constitute verification for the sale of tobacco and nicotine vaping materials. According to California’s Stop Tobacco Access to Kids Enforcement Act, the sale of tobacco and nicotine vaping products requires the seller to “match the name, address, and date of birth provided by the customer to information contained in records in a database of individuals whose age has been verified to be 21 years or older.” Additionally, California law requires sellers to “also verify that the billing address on the check or credit card offered for payment by the purchaser matches the address listed in the database.”

Similarly, in many states, the online sale of wine and liquor requires more stringent verification than what age gates can provide. The most common standard is that buyers must show a current and valid government-issued form of identification to prove their age, much the same way they would if they bought the product in a grocery store. And still, states such as Michigan, Georgia, and Ohio require the use of an identity verification service when the order is made as opposed to the presentation of a valid government-issued ID. A simple age gate would not meet this standard of verification.

For tobacco products in the United States, it is now illegal “to sell any tobacco product — including cigarettes, cigars, and e-cigarettes — to anyone under 21.” Adding further concern for the seller, it is the retailer who is responsible should any such sale take place. This reality eliminates any lingering illusions of perceived protection implementing an age-gate for these products might have provided.

FREE TRIAL

Despite age restrictions, flavored e-cigarettes are products that are particularly popular with minors. For this reason, the United States Food and Drug Administration (FDA) has made it clear that they will give priority to enforcement towards sellers that fail to employ “independent, third-party, age- and identity-verification services that compare customer information against third-party data sources.”

The problem is deeper than governments simply not allowing the use of age gates. Even if an age gate is allowed, it is still illegal to sell age-restricted products to minors, whether they lie or not. Hence, actually knowing your customer’s true identity is even more important. The point is: age gating is simply not a viable verification tool.

More Effective Age Verification Options

In most cases, the use of age verification software is done so because of a legal mandate. While companies for which they are required don’t have much choice in whether or not they use verification software, they do have a choice in what kind they use. The most common deciding factors come down to cost, ease of implementation, and customer user experience.

Applications like Konfirmi accommodate businesses in all of these factors.

Konfirmi is a very low-cost option. No monthly fees or minimum usage requirements means you only pay for what you use, and the usage fee is low as well. Konfirmi charges only $0.019 – only about 2 cents – per use.

Additionally, when it comes to age verifications with third-party data sources, Konfirmi suggests that its clients buy directly from several different data providers which will further reduce overall costs. For client convenience, Konfirmi makes it possible for you to easily verify your customer’s age by cross-referencing information with billions of online records maintained by reputable third-party data providers.

Learn More

Next, Konfirmi is very easy to set up. The app’s website provides a video taking you step-by-step through the setup procedure for Konfirmi in only about four minutes- almost the amount of time it takes to order and start drinking your Starbucks coffee.

Lastly, and perhaps most noteworthy, Konfirmi is no more intrusive to your customers than an age gate. The app obtains information directly from your website’s purchase or age verification form and then gets the consents required under the various laws. That’s all there is to it!

Konfirmi and products like it provide the means for low-cost and low-overhead age and general customer verification. It should be mentioned, Konfirmi offers a free trial with no credit card required.

Conclusion

The days of age gates are quickly coming to an end. Yet the need for reliable customer verification still remains. Moving forward, it will be intuitive and inexpensive applications like Konfirmi that pick up the slack, protecting both seller and customer.

The Benefits and Types of Knowledge-Based Authentication for Your Business

The Benefits And Types Of Knowledge Based Authentication | Insights

Delivering a satisfying online customer experience is critical for any organization with a web presence. A big part of this is trust. Most customers will shy away from a website or app that does not appear trustworthy.

FREE TRIAL

Learn More

This is why every organization should be taking the right steps to protect its customers’ personal information during online transactions. Getting a customer to trust you today means they will do business with you tomorrow.

Global consumer review website Trustpilot notes that “brands have to be accurate, dependable, and provide the service they guaranteed.” And with this, identity verification is a huge part of how customers perceive their accurate and dependable experience with your brand leading to loyalty and retention.

Companies that don’t take the necessary security precautions see the consequences. In 2020 alone, many organizations such as Marriott, T-Mobile and GE have faced security breaches. To combat these security vulnerabilities, organizations need to implement new and innovative ways to protect their customers’ identities and convey trust. The best way to ensure this is by implementing a multi-level security strategy including Knowledge-Based Authentication.

Knowledge Based Authentication

Knowledge-Based Authentication, commonly known as KBA, is a simple process that requires customers to answer secret questions before they can utilize secure sections of your website or services. It allows an organization to verify a customer’s identity, using information like mailing address, phone number, age, email address, or any other piece of information expected to be unique to the customer.

KBA can work with commercial data providers such as credit bureaus that possess extensive customer records to verify information about nearly anyone. This level of authentication brings peace of mind to not only the organization but also the customer. In Q1 of 2020 alone, over 8.4 billion records have been exposed. Having Knowledge-Based Authentication (KBA) as part of your security strategy will help keep your customers’ private information secure against these breaches.

Knowledge-Based Authentication also helps businesses comply with security regulations, especially for companies in the finance sector. Systems like these help reduce fraud and in turn, reduce the cost of fraud prevention and recovery. At the same time methods such as KBA provide increased security for customers boosting confidence in the business. Yet finance-related businesses are not the only ones employing the security power of Knowledge-Based Authentication.

At least 21% of businesses in the e-commerce sector are currently using and implementing Knowledge-Based Authentication on their websites. And about 20% of businesses in the healthcare sector use Knowledge-Based Authentication to secure patient records in their database. Some businesses also use KBA to verify access to digital services like a service portal or transaction portal, age and identity verification, user enrollment, and password retrieval.

Types of Knowledge Based Authentication

There are two types of Knowledge-Based Authentication; 1) Static KBA and 2) Dynamic KBA. Both types of KBA differ on their degrees of security, how they are implemented, and how they are used.

FREE TRIAL

Static Knowledge-Based Authentication, or SKBA, is the more commonly used of the two KBA types. In Static KBA, the customer inputs his/her answers to security questions.

Should the customer need to reset a password or retrieve his/her username, the customer would need to accurately answer the security questions with the previously supplied answers. Thus, Static KBA is sometimes referred to as a “shared secrets” or “shared secret questions.”

Questions range from “What is the name of your elementary school?” to “What is your favorite food?”. Static KBA is typically employed by banks, financial institutions, and services like email providers to authenticate the identity of the customer before allowing access to secure data or an account.

Behind the scenes, Static Knowledged-Based Authentication is rather simple to set-up on a website. It is also straightforward and friendly in terms of the customer experience as the customers are the ones choosing the pre-determined questions and providing their specific answers.

Dynamic Knowledge-Based Authentication, or DKBA, provides a higher degree of security because Dynamic KBA uses “out-of-wallet” questions that are not predetermined but are generated in real-time using information from different data sources. These data sources include credit bureaus, marketing databases and customer surveys. An example of a Dynamic Knowledge-Based Authentication would be “Which of the following addresses did you live at in the past?”. From there, the customer would need to select the correct option from a provided answer list.

Because Dynamic KBA does not use a set of pre-determined questions and answers but rather accesses external databases, it is more difficult to implement compared to Static KBA. However, Dynamic KBA does provide a higher degree of security because it uses data from several different sources and questions customers on information not easily found online.

Unfortunately, this higher level security can come at the expense of ease of use for the customer. Yet, the customer experience can actually be enhanced by adding these additional security features through thoughtful design and educating users on how the security features work and add value to their experience.

Best Practices

With Dynamic KBA specifically, the security benefits associated with the use of out-of-wallet questions are dependent on the data used during authentication. That is why it is important to follow industry best practices including using trustworthy data sources and using meaningful questions.

Learn More

The first best practice is using reliable data sources. The reliability of the source of the data is directly related to the level of security the authentication provides.

These sources, such as existing account information or trusted third-party sources such as credit bureaus, should utilize non-traditional data to generate unique questions including a diversionary question designed to throw a fraudster off.

Another best practice is including questions that are a balance between convenience and security. Asking a question that is too complex can create insurmountable obstacles for customers to access their data and thus negatively affect the customer journey. Yet a question that is too simple can open the floodgates to fraudsters. Hence, it is important to explain the security features to the customer and include reasonable and unique questions.

Conclusion

Knowledge-Based Authentication provides an additional level of security for websites that need to know their customers are who they say they are. However, the actual level of security it provides can vary greatly based on implementation. The most successful business will find a way to strike a balance between security and customer experience, lest they lose the very customers they seek to protect.

Confirming Customers’ ID to Prevent Child Identity Theft

When the issue of identity theft occurs, banking inconsistencies and credit scores are what most frequently come to mind. While these are concerns that are universally associated with adults, children may also be victims of identity theft.

FREE TRIAL

Learn More

Synthetic Identity Fraud (SIF)

Most children don’t have bank accounts or credit cards or any real financial footprint to speak of – and that’s exactly the point. A child’s identity provides a fraudster with a real identity with nothing on the books to cross-reference.

This allows the fraudsters to craft a new synthetic identity out of the nuggets of truth from the child’s identity (name, social security number, etc.) and fabricate additional and useful information to run their scam.

Fraudsters can use the child’s Social Security number to apply for government benefits, credit cards and take out loans, only to burn the identity when it stops being profitable for them. This usually leaves the child and his/her parents holding the bag until they can prove that fraud has been committed.

Friends and Family Fraud

Sometimes the fraudster is close to home- a friend or family member. While we don’t want to suspect someone close potentially committing identity theft against someone we love, it does happen.

A 2018 Javelin Research and Strategy study revealed that the number of victims who knew the perpetrator in the case of identity theft spiked to 15 percent in 2018 from seven percent in 2017.

In fact, identity theft expert Axton Betz-Hamilton experienced child identity theft herself by her own mother. It took Betz-Hamilton eight years to remove fraudulent entries on her credit report, and now regularly monitors her credit.

Child Identity Theft – The Impact

While it usually isn’t too difficult to prove that a toddler didn’t open a bunch of credit cards, the ordeal can still be a stressful one for everyone involved.

Moreover, a significant problem is that this activity can go undetected for much longer than it would for an adult as children typically have no reason to check their credit score until at least mid to late adolescence when they apply for college loans or an apartment.

It’s not just that children can be targets, but that child identity theft has been on the rise for years. When combined with the fact that the fraud can continue for much longer than it would for adults, it creates a very expensive problem.

FREE TRIAL

According to Javelin Strategy and Research, fraud committed against children amounted to $2.6 billion in 2017 alone. Not only is child identity theft financially expensive, it is emotionally expensive wreaking havoc on those affected.

For example, an Experian survey found that 35% of those who were affected by child identity theft needed professional help to deal with the emotional trauma.

Combatting Child Identity Theft

Fortunately, measures are being taken to attempt to stem the tide of this growing problem.

The Protecting Children from Identity Theft Act is designed to curtail synthetic identity fraud by requiring the Social Security Administration to create a database allowing financial institutions to verify a potential customer’s identity by referencing and verifying their name, Social Security number, and date of birth all match.

Unfortunately, this solution introduced in 2018 may take time to implement. As no online company wants to allow fraudsters into their business, methods of helping to keep them out are currently available. Some of these options specifically target fraudsters employing synthetic identities.

Businesses need to cross-reference potential user data and look for discrepancies themselves. This may seem like a daunting prospect, and if done manually and on a large scale, it certainly would be.

Learn More

However, employing a multi-layered approach to customer identification is an organization’s best option, especially one that uses video and photo selfies with IDs.

While there are many security options to assist companies — such as Knowledge-Based Authentication, Two-Factor Authentication, and Single Sign On — using a combination of these plus requiring a government issued photo ID limits how far a fraudster can take the scam.

How many toddlers take selfies while holding a government ID? And when comparing this photo to a database of legitimate IDs, the fraudster is stopped in their tracks.

Conclusion

Fraudsters will never stop trying to come up with ways to scam individuals and organizations. Whether that takes the shape of stealing the identities of children or hacking your personal information, online organizations must be prepared to protect themselves and their customers from the constant onslaught.

For their part, the US Government is working on a potential solution, but in the meantime and following, there are solid options available now that combine the tried and true methodologies of the past with technological advancement of the present.

Companies can neither afford to take customer verification lightly, nor do parents want to worry about their seven-year-olds getting into credit card or loan debt. The stronger the verification systems become, the more this crime becomes a thing of the past.

Avoiding “Catphishing” and Similar Online Scams With Layered Identification

The relative anonymity of the internet has given rise to a slew of new types of fraud by consumers including the deceptive practice of “catphishing”.

Catphishing (or catfishing) is the act of pretending online to be someone different from who you really are. Catphishing goes beyond simply giving a false name. It entails creating a completely fake or borrowed identity, often with a backstory, fake friends, stolen pictures, and anything else that might better help sell the lie.

FREE TRIAL

Learn More

Those who catphish do so to play cruel jokes or to carry on romantic relationships, the latter of which being the premise of the MTV program Catfish: The TV Show and is seen in several story lines of TLC’s hit series 90 Day Fiancé.

Yet catphishing is not only used for social deception. It is often incorporated into financial scams for the purposes of protecting the scammer’s true identity and making the scam appear believable. As the purpose of catphishing is to avoid cursory investigation, this can make it a nightmare for online companies that rely on customer verification.

One of the most frustrating aspects of cybersecurity is the fact that given how connected the internet makes most facets of our everyday lives there are so many ways for creative hackers to get what they need.

When a company must know that their customers are who they say they are, various options can be employed with varying levels of success. Examining the pros and cons of each option will help you decide which methods would best serve your online business and customers.

Even better, businesses should consider combining or “layering” several different verification methods together. This can be done easily, and without comprising too much usability in the customer experience.

Two-Factor Authentication

Two-Factor Authentication, or 2FA, is a popular method of customer verification that requires two methods of authentication usually consisting of the standard username and password, as well as something that ostensibly only the customer would have access to.

If you’ve ever tried to access banking information from a different computer than you normally use, you’ve probably been prompted to enter a numeric sequence sent via the phone, email, or by text, that’s 2FA. The extra level of security comes from the fact that the secondary piece of authentication is sent to a device that only the customer is expected to have access to.

The problem is that more adept hackers can simply intercept the codes as has been the case of malware developed by a hacking group nicknamed Rampant Kitten. They can also make use of account-recovery systems to effectively bypass the issue altogether.

Some industrious hackers have even been known to adjust their target’s phone carrier plans to transfer or port the number to a new account and thus gaining access to the customers’ authentication codes.

Knowledge-Based Authentication

If you’ve ever been asked a security question, you’re familiar with Knowledge-Based Authentication, or KBA. The idea behind KBA is that if you choose an answer to a question that only you would know, it would theoretically mean you are indeed you. Examples of KBA questions include “What was your elementary school?” and “Where did you spend your honeymoon?”.

Unfortunately, on its own, this method is far from foolproof. For one thing, this method may be a reasonable deterrent for strangers, but perhaps not for those who know your customer such as a friend or family member.

Additionally, data breaches beyond a customer’s control have disseminated a deluge of private information ripe for fraudsters. Twenty years ago, Social Security numbers were closely guarded secrets, yet with numerous banking and lending institutions becoming the victims of cyberattacks, millions of Social Security numbers, credit card numbers, birthdays, addresses, etc. are on conveniently cataloged lists available for purchase in the seedier sections of the web.

Moreover, questions about your customers’ pets’ names or hometowns that may have been more secure before the advent of social media lose all security value when you can type a person’s name into Facebook and get what effectively amounts to an outline of someone’s life.

Credit Bureau-Based Options

The big three credit bureaus (TransUnion, Experian, and Equifax) maintain sensitive information on nearly everyone in America.

FREE TRIAL

This makes them a prime point of reference for customer identity verification. If the information supplied by the customer matches the consumer credit data on file with the credit bureau, it serves as authentication.

The problem with this method of authentication is that, as previously discussed, just because someone has personal information about the customer, it doesn’t mean that they are in fact the customer. It also has the major downfall of not being useful for your customers who don’t have any credit history.

Additionally, these credit bureaus are targets of attacks themselves with the notable 2017 Equifax data breach affecting nearly 147 million people.

These significant drawbacks make credit bureau-based solutions better as a supplemental verification method and only for certain customer bases.

Data/Social Media Authentication

Data and social media authentication will ask customers to authenticate themselves by signing into another account (an account to which only the customer supposedly has access) as proof that the customer is who they say they are.

It works by attaching one’s online ID to find a match on a website like Facebook or Twitter, or a database of offline information, or even behavioral patterns.

Where this method falls short is that it is much more adept at detecting bots than it is at detecting fraudsters. It is not difficult for fraudsters to fake a social media background, which only adds to the fact that it also doesn’t have a reliable way to verify the fact that the person inputting the information is the person the information belongs to.

Additionally, customers without social media access (think Facebook in China) are cut off from this form of authorization, resulting in your potentially abandoning a large segment of customers.

Digital Image and ID Verification

All of these methods have pieces of strong cybersecurity but are bogged down by exploitable flaws that can render them almost useless against dedicated hackers.

Learn More

Online businesses need something more. They need ways to verify the person inputting the information is legitimately the customer to whom the information belongs.

This can be done using video ID selfies and selfie ID photos. There are verification protocols that require a potential customer to take a photo of themselves holding their government-issued ID to prove it is them trying to access their information.

As most people are unlikely to have a photo of themselves holding their ID on a social media platform, it becomes that much harder for a fraudster to fake. These pictures can also be cross-referenced with photos in trusted databases to provide even further verification.

Combining or “Layering” Verification Methods

One the best methods to account for all the pros and cons of various verification methods is to combine or “layer” one or more verification methods together.

For example, you could combine “Knowledge Based Authentication” (KBA) with “Two Factor Authentication” (2FA).

With this combination, your business would be able to check multiple commercial data providers, each with well over a billion unique customer records, to verify information about almost anyone — including in various countries around the world. If the information provided by the customer matches the commercial database information, the customer would pass your KBA check.

As part of the KBA check, you would also verify the customer’s cell phone number or email address. Then, you would send a code by text/SMS or email to the same verified number or email address.

FREE TRIAL

If the customer is able to provide the code sent to their verified cell phone number or email address, the customer would pass your 2FA check.

You could also add photo ID verification — or even video ID verification — to make it even harder for a fraudster to achieve their goal.

Combining or “layering” verification methods would be easy and familiar for your customers to use, but very hard for fraudsters to spoof. Konfirmi provides exactly such a solution to quickly and easily add multiple “layered” verification methods to any website or app.

Conclusion

There will always be a balancing act between vigilant protection of your services against identity theft and fraud, and the ease of use for legitimate customers. Falling too far in either direction can be disastrous for a business.

You must choose the right customer verification methodology to maximize security and minimize obstacles in the onboarding process.

Making use of the latest technology is one of the best ways to provide customers with an experience they can feel secure about. These solutions exist right now.

Customer Verification: Why Online Businesses Should Know Their Customers

The internet is rapidly changing how businesses interact with their customers and vice-versa. Businesses have been quick to realize the potential that the interconnectivity of the digital space provides, especially in industries such as e-commerce, finance, and social media. Customers are also quick to take advantage of the newfound convenience of online shopping from the comfort of their living rooms.

FREE TRIAL

Learn More

Until recently however, many consumers, businesses, and governments have been slow to realize the importance of customer verification. Proper customer verification can help prevent young people from accessing age-sensitive products and services, as well as prevent fraudulent transactions from taking place online.

Businesses and online merchants have various options in addressing this issue in order to help reduce risk, liability, and costs due to fraud and under-age purchases.

What is Customer Verification?

Customer verification is a process that is used by businesses with online products, services, or content to ensure that the information provided by their customers is correct and that the customers are who they say they are.

One of the most important benefits of customer verification is that it allows businesses to comply with government laws and regulations and adhere to guidelines set by regulatory bodies. Additionally, customer verification helps reduce risks of fraud or identity theft, as well as costs and expenses arising from incorrect or erroneous information provided by customers.

At the same time, customer verification helps protect users from fraudulent activities committed by other users, and helps keep the business’s customer base secure from bad actors.

For example, customer verification allows businesses to make sure that the customer is not a crook, but also to make sure that the delivery address for products or services was properly provided by the customer. In addition, customer verification allows businesses with age-restricted products or services to make sure their customers are old enough before the products or services are purchased or delivered.

This not only saves against fraud losses, but it also eliminates the cost of delivering products or services to the wrong address.

Customer verification also helps businesses comply with “Know Your Customer” (KYC) guidelines and anti-money laundering (AML) regulations in order to avoid fines and penalties from law enforcement, regulatory, and other governmental organizations.

What Companies Use Customer Verification?

Customer verification is vital for transactional businesses that operate online.

If a company doesn’t know with whom they are dealing, they could inadvertently sell products or services or divulge sensitive information to the wrong person, an underage person, or even a malicious party, along with a whole host of additional potential calamities.

In addition to the monetary losses and expenses, as well as potential liability to customers and even regulatory fines, the reputational injury could be crippling.

Finance and Accounting Businesses

Companies in finance and banking have quickly adapted to the internet. Today, users can create a bank account, get loans, and transfers funds through the internet. Because of this, governments require banks to comply with strict regulations to prevent criminals from taking advantage of the system by perpetrating acts of fraud.

Banks and other financial institutions are required to adhere to the strict KYC guidelines that require them to collect critical information from their customers and verify the information is correct, thereby preventing bad actors from engaging in money laundering or terrorist financing, creating fake accounts, and conducting fraudulent transactions.

Online Retail and E-commerce

Businesses and merchants who use the internet as a platform to sell and distribute products and services are often required by regulatory agencies and governments to comply with several customer verification processes as well.

FREE TRIAL

This helps safeguard customers while reducing the risk and potential liability of fraudulent transactions.

In addition, online retail merchants selling age-restricted products like alcohol, tobacco, vaping products, gambling, and marijuana, are required to verify the age of their customers before they can legally sell the products. Businesses that provide online services like adult or pornographic websites are equally required to screen their users to protect children from accessing the sensitive content of the website.

Businesses that fail to adhere to the guidelines set by regulatory agencies can face stiff fines and loss of licensure, not to mention reputational injury.

Social Media Platforms

Likewise, social media and social sharing platforms are increasingly using customer verification to stop fake accounts.

Social media platforms have been co-opted by everyone from scammers to national adversaries to political campaigns as a means of relatively cheap and easy mass communications. Governments and global communities are urging – and may soon require — social media platforms to set-up security safeguards to prevent fake news.

For their part, some social media platforms have taken steps to disallow obviously fake users or “bots.” Customer verification is one of the critical solutions to overcome this challenge.

Types of Customer Verification

Many governmental bodies – such as the United States, and the European Union — encourage or even require the use of “Multi-Factor Authentication”.

Multi-Factor Authentication (or “MFA”) identifies a person by using two or more pieces of evidence — or “factors” — regarding who the person is. These factors are: knowledge (something the user knows), possession (something the user has), and inherence (something the user is).

Learn More

Usually, a business with higher risks would want to use at least two factors to identify their customers.

For example, the business could ask the user to provide their email or mailing address and age (“knowledge” based factors), and also provide a code texted to the customer’s cell phone (the “possession” factor).

However, a business with lower risks might want to use only one verification method to provide ease of use by the customer, and prevent abandonment by the customer.

Most customer verification applications only allow one method to verify customers. However, Konfirmi offers several powerful verification methods that can be used alone or in combination with other methods, and can be easily implemented in websites and other online assets.

This allows a low-risk business to easily verify their customers with only one verification method, while also allowing a higher-risk business to layer various verification methods together and achieve greater certainty.

Age Verification

Age verification helps businesses to automatically verify the customer’s age before a shipment is made or a delivery is attempted. Konfirmi checks multiple third-party databases with billions of unique records, providing world-wide coverage.

At the same time, with Konfirmi, this verification method ensures privacy by not sharing the customer’s information with any third parties.

Cell Phone or Email Authentication

Cell phone or email authentication is a secure method that uses a code sent to the customer’s cell phone, email address, or both in to verify the identity of the customer. Because this verification method requires a unique and time-limited code that is sent to a mobile phone or email address before customers are allowed to complete a purchase, a hacker would have to know or have access to multiple aspects of the real user’s life.

Verifying that the person making a purchase has access to the actual customer’s cell phone makes text authentication a strong method to meet the “possession” factor for Multi-Factor Authentication. It is also a familiar and easy to use verification method.

Knowledge Based Authentication

Knowledge Based Authentication requires customers and users to submit critical information like full name, mailing address, home address, phone number, age, or email.

FREE TRIAL

Konfirmi allows you to choose which items of information you want to get from your customers.

This information is then submitted and verified through the use of third-party data providers that maintain billions of unique records and support world-wide coverage.

This verification method helps prevent identity fraud by requiring “knowledge” factors to identify the person making the purchase. In addition, this method also allows companies to verify the information provided by their customers, in order to prevent customer mistakes and erroneous deliveries of products or services.

Selfie ID Photo Verification

Photo verification helps companies prevent identity fraud by verifying the documents and information submitted against a live captured photo of the user.

Konfirmi has automated features that check the authenticity of the customer’s photo such as the time the photo was taken and the originality of the photo.

Other customer verification applications that compare a user’s photo or ID with online databases, or just compare the photo and ID with each other, often run afoul of facial recognition laws. For example, the Six Flags amusement park was sued for its use of facial recognition. In fact, Facebook recently paid $550 Million to settle a massive facial recognition lawsuit against the company.

In addition, a recent federal study confirmed that many facial recognition applications suffer from racial bias and inaccuracies. This can cause potential problems with false positives or false negatives in the customer verification process. More importantly, this can invite devastating lawsuits, regulatory problems, and reputational injuries.

However, with Konfirmi, the “selfie ID photo” verification method does not use facial recognition. Instead, it allows an easy way to automate ID verification, while also keeping your business free and clear of the lawsuits, regulatory problems, and reputational injuries associated with facial recognition.

Video ID Selfies

Video ID Selfies are a step up above the selfie ID photo verification. It allows businesses to set up their identity fraud prevention measures by using the built-in cameras in cellphones or webcams in computers to verify the identity of a customer.

Just like with selfie-photo verifications, Konfirmi has automated features that check the authenticity of the customer’s video such as the time the video was made and the originality of the video.

With Konfirmi, this process also does not use facial recognition. Therefore, Konfirmi prevents erroneous verifications as well as the many liabilities and other problems relating to facial recognition.

Conclusion

Identity fraud is a major problem facing our increasingly digital world. That is why customer verification applications like Konfirmi play an important role in protecting online commerce. You can start a free trial of Konfirmi today with no credit card required, and see the difference for yourself.

Identity Verification Tools Can Help Build Trust and Safety for Your Brand

Businesses in general cannot function without the trust of their customers. Customers will not trust a company that doesn’t keep them safe in the capacity in which they interact.

This is especially true for many “digital economy” and similar online businesses.

FREE TRIAL

Learn More

Whether the online business matches buyers and vendors (such as ridesharing, home sharing, contractor finders, freelancer finders, or the like), or matches like-minded people together (such as dating apps, travel buddy apps, or the like), establishing trust between parties is a major issue.

Online businesses that have risks of fraud, identity theft, or impersonation among their customer base need to be able to protect their customers from those with nefarious intentions.

Keep a Positive User Experience

Identifying users is certainly not something that every online business needs to do.

Some new users don’t want to be bothered with the text or other code transmission mechanisms necessary for two-factor authentication or “2FA”. Other users may not want to share the information necessary for knowledge based authentication or “KBA”. Still other users will not want to provide their driver’s license or passport to prove their identity.

Potential customers often have a lot of choices when it comes to online businesses. Something as simple as an unnecessary step in the onboarding process can be enough to drive them into the arms of a competitor.

Nevertheless, the business models of some types of online businesses involve significant potential for fraud, impersonation, or identity theft that could interfere with legitimate and intended users.

In addition, each “bad actor” creates reputational harm that could prove damaging to the company. Unchecked fraud that becomes frequent could even overwhelm the viability of the business model itself.

Establish Trust When it is a Necessary Part of The Business Model

Potential threats to an online business or customer-base can take many different forms depending on the industry.

Online businesses should review their business model for potential fraud, impersonation, and identity theft risks. If such risks exist, the business would be well served to make sure that all relevant users are who they say they are.

For example, the entire model of ridesharing is predicated on the fact that anyone with a suitable vehicle can make money giving rides to strangers. Because of the danger inherent in the fact that drivers with horrible driving records or even criminal intentions might falsely claim they are suitable, it is especially important that the app itself check the identity of its drivers and obtain background checks.

For this reason, the major ridesharing app companies – Uber and Lyft – both obtain background checks for all of their drivers.

However, many other types of businesses have issues similar to Uber and Lyft, but are not verifying identification or conducting background checks.

For example, according to a recent investigation, the larger dating apps do not conduct background checks on their customers, and most do not even have any identity verification method in place. According to the results of the investigation, even those that do are simply using Facebook or LinkedIn to verify identity.

FREE TRIAL

But Facebook and LinkedIn focus on eliminating bots and other fraudulent means of creating an account – they do not claim to actually ID their users.

Similarly, job seekers are constantly at risk of identity attacks. Fake job postings will ask for personal information knowing job seekers are in a somewhat vulnerable position and may be more accommodating as they are trying to put their best foot forward.

Moreover, most resumes contain a fair amount of a job seeker’s personal information. That is why sites designed to help connect job seekers with hiring employers should work hard to keep fake postings off of their sites.

Nevertheless, most job sites do not check the identity of supposed employers, or to make sure that they are legitimate companies.

The same is true in reverse.

Legitimate employers routinely use job sites to help with their recruiting and staffing efforts. However, many popular job sites only require a functional email address in order for a purported employee to post “their” resume, and do not do anything more to verify who the purported employee actually is.

In addition to job sites, many online businesses offer to connect people with contractors or freelancers for various purposes.

A simple internet search of these contractor or freelancer companies often reveals dozens of horror stories involving contractors or freelancers claiming to be someone who they are not (i.e., identity fraud), or instances of the actual contactor freelancer “subcontracting” the work to a different and cheaper person who does not have the advertised skill set or qualifications (i.e., impersonation).

Learn More

The same is true of food delivery services. Every time a customer has food delivered to their home, that’s another stranger that knows where they live. Delivery services should also ensure that their contractors can be trusted.

Leveraging Technology

For certain business models, the only way to maintain a trusted and safe platform is to sufficiently vet users as they are onboarded.

But the level of vetting should be tailored to the needs of the business. Heightened verification for onboarding new users may be overkill, and too frustrating for users in light of the level of risk involved.

In other words, even if an online business has significant potential fraud and identity theft risks, and verification of users is therefore priority, the user’s experience must also still be a concern.

Security is a major part of maintaining trust, but having a system that customers feel comfortable using can be as important for acquisition and retention. You don’t want to drive customers away right out of the gate.

The question becomes, how can businesses build trust from their customer base, while maintaining appropriate levels of verification, and still providing a smooth and efficient user experience?

The answer is by using a customer verification system that is versatile, and can easily accommodate different use cases, even within the same online business, and even within the same website or app.

One such customer verification system is Konfirmi.

Konfirmi allows businesses to easily verify their customer’s or user’s information, including:

– Name

– Mailing address

– Home address

– Phone number

– Email

– Photo IDs, such as driver’s licenses or passports

FREE TRIAL

in any app, user sign up or registration page, e-commerce store, contact form or survey, or other web-facing system.

The app does this by allowing businesses to choose from a number of different types of verification methods, such as:

Two-factor authentication or “2FA”
Knowledge-based authentication or “KBA”
Photo selfies, including photos of the customer holding up their ID
Video selfies, including videos of the customer holding up their ID

With Konfirmi, a business could use any one of these verification methods by itself. Selecting only a single verification method makes for an easy and quick user experience in onboarding.

Alternatively, various verifications methods can be combined together for greater assurance, when heightened risk factors are present.

Or, a business could use one type of verification method in one part of its app or website, but also use other combined verification methods in other parts of the same app or website.

The Konfirmi app is available “out of the box”, and can be set up in under five minutes. For more tailored needs, the app is also available in custom, white-label, and on-prem implementations.

Conclusion

In an age where users are becoming wearier of data breaches, impersonation, and identity theft, and are acutely aware of the reputation of a business, trust is a valuable resource.

At the same time, businesses must be careful not to drive away new users in their pursuit of security.

Finding the right balance is the only successful way forward. This entails making appropriate use of technologies available to streamline the user experience, while also protecting other users and the business’ reputation.

Age Gates Are Becoming a Thing of The Past

Websites that ask customers to enter their birth date or check a box to verify their age – also known as “age gates” — have been around for decades now.

With an age gate, a visitor to such a site is asked to put in their date of birth or otherwise represent their age before entering an age-restricted site or purchasing a product.

FREE TRIAL

Learn More

Nothing is done to check the information provided by the website visitor. They often serve as the only barrier to content and purchases that have legal age limitations.

The use of age gates has gained additional popularity with the rise of vaping, age-rated video gaming, online sports betting, pornography, firearms, and cannabis websites.

The problem (depending on your perspective) is that age gates are easy to fool. All an underage customer has to do is lie. It begs the question: Why use them at all? The short answer: It’s better than nothing.

For many websites, it’s more about the message having an age gate sends than the actual strength of the protection. What’s more, it is an inexpensive and easy to implement method of trying to cover a business’s bases. With the many types of age gate apps available, it’s not even something businesses need to create themselves.

Unfortunately, however, age gates are becoming a thing of the past.

Legal Compliance

In the past, age gating allowed the website owner to show governing bodies that the business took steps to avoid exposing minors to content or products they are not of legal age to consume. It puts the onus back on the consumer by requiring either verification or deception from the potential customer.

But age gates are no longer good enough in many places, and for many types of products. For example:

An age gate is not enough for tobacco and nicotine vaping sales in California.

More specifically, in order to sell tobacco and nicotine vaping products in California, the seller has to “match the name, address, and date of birth provided by the customer to information contained in records in a database of individuals whose age has been verified to be 21 years or older.” In addition, under California law, the seller has to “also verify that the billing address on the check or credit card offered for payment by the purchaser matches the address listed in the database.”

Likewise, for online sales of wine or liquor, age gates are not enough in many states. Most states require that the buyer present valid government issued identification to prove they are of age, which definitely precludes the use of an age gate. Some states — like Michigan, Georgia, and Ohio – require online sellers to use an identification verification service at the time of ordering, in lieu of requiring valid government issued identification, but an age gate would not suffice.

In addition, throughout the United States, it is now illegal “to sell any tobacco product — including cigarettes, cigars and e-cigarettes — to anyone under 21.” The retailer is responsible for any sales of such products to underage customers, and the penalties can be quite costly. Effectively, this means that relying on an age gate alone is a big risk.

In this vein, with regard to flavored e-cigarettes in particular, the United States Food and Drug Administration (FDA) stated it would prioritize enforcement against sellers that do not use an “independent, third-party, age- and identity-verification services that compare customer information against third-party data sources.”

Likewise, in Canada, the national government regulator opined that “simple self-attestation of age” – meaning an age gate – is not enough to comply with the country’s laws against cannabis sales and marketing to minors.

FREE TRIAL

Similarly, Great Britain, Holland, and Germany, and other countries prohibit online gambling and sports betting by persons under 18 years of age, and age gates are not enough to confirm age.

Moreover, many countries require age verification to view online pornography. In most cases, merely self-certifying age is not enough.

The above examples are indicative of a worldwide trend, not to mention in various states just within the United States, that is decreasing the continued viability of age gates.

Problems Even When Age Gates Are Still Allowed

Even when selling age-restricted products to people in places that still allow age gates, the fact remains — most people lie on age gates.

In fact, people who don’t strictly “need” to lie on age gates still do so. Customers have neither an obligation nor a tangible incentive to tell the truth. So, most of them don’t.

It’s often easier to fill out the age gate form with random information. For example, if a company’s age verification system uses dropdown boxes, it is often simply faster to select a birthdate of 1/1/1900 or the like as opposed to searching for and entering the accurate information.

In addition, some people are hesitant about sharing that sensitive piece of birth date information so early in their relationship with a new company. Incidentally, people don’t need to be that concerned. Because companies know that everyone lies on age gates, they almost always don’t actually use the birthdates provided as viable information. And consequently the sites that use age gates are not going to be valuable targets for serious cybercriminals.

All of this is a long way of saying that, if a business is required to verify age, but is only using an age gate, the business is not reliably verifying anything.

Viable Options For Age Verification

The primary drivers for using age gates are: (1) low cost; (2) ease of setup and configuration; and (3) ease of customer use.

All of these factors are met with applications like Konfirmi.

Learn More

First, Konfirmi has a very low cost. The app does not have any monthly fees or usage minimums. Instead, Konfirmi charges only $0.019 – only about 2 cents – per use.

In addition, for age verifications with third-party data sources, Konfirmi encourages its customers to buy direct from several different data providers, which further reduces costs. Konfirmi also provides a way to combine multiple third-party data sources together, but the cost of this feature is not high either.

Second, Konfirmi is very easy to set up. The apps website contains a video showing Konfirmi being set up in only about 4 minutes.

Third, Konfirmi is no more intrusive to your customers than an age gate! The app pulls information directly from your website’s purchase or age verification form, and then gets the consents required under various countries’ laws. That’s it!

Konfirmi allows you to easily verify your customer’s age over the internet by cross-referencing the information with billions of records maintained by multiple reputable third-party data providers.

Products like Konfirmi provide low-cost and low-overhead age verification. And they are also easy for website visitors to use.

Conclusion

By any reasonable standard, age gates are something of a paper fortress. The fact that it’s effectively just “for show” means that your customer’s age is really not being verified at all.

For this reason, websites can no longer use age gates for many different types of products and services and in many states in the United States, or in the United States as a whole, or in various other countries. Even when age gates are still allowed, it is just as easy and inexpensive to implement and operate an application like Konfirmi as it is to use an age gate.

As the reasons for retailers of age-restricted products or content to stay with age gates start to melt away, age gates are quickly becoming a thing of the past.