Somebody

About Somebody

Posts by Joe Somebody:

How to Comply with the GDPR’s Identity Verification Requirements Requirement

How To Comply With GDPR Personal Data & ID Verification Requirements

The General Data Protection Regulation (GDPR) is designed to protect the information of natural persons who are in the European Union (EU) or European Economic Area (EEA), including citizens and residents of those countries and even visitors in those countries. The GDPR went into effect on May 25, 2018.

FREE TRIAL

Learn More

Although there are many facets of the GDPR, this article focuses on the “Right to Be Forgotten”, the “Right to Access” one’s own personal information, and the “Right to Correct” that information, as well as the obligations of businesses to verify that persons exercising these rights are who they claim to be.

The GDPR’s “Right to Be Forgotten” or “Right of Erasure”

The GDPR refers to identifiable natural persons who are in the EU or EEA as “data subjects”. Under Article 17 of the GDPR, “the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.”

This means that customers who are in the EU or EEA have the right to compel businesses to delete personal information collected about them upon request. This deletion must be completed within one month of the date of the request, absent extenuating circumstances.

Under Article 17 and its “right to be forgotten,” personal data held by a company must be deleted if:

The data is no longer needed for its intended purpose
The data subject withdraws consent
The data subject raises a legitimate objection about how the data was processed
The data is determined to have been collected or processed illegally The laws of an EU Member State require the data to be erased
The data is subject to GDPR Article 8’s rules about personal data of children

The consequences of failing to comply with such a request can amount to serious fines and penalties under the GDPR.

Why the Cannabis Industry Needs to Be Better About Age Verification

Why Was This Needed?

For decades, businesses with an online presence were able to do almost anything with regard to the collection, storage, and sharing of their customers’ information.

For example, a BBC story about a man whose personal financial information from a less fortunate time in his life kept appearing in web searches about him, even though he had long since recovered from his financial difficulties, serves to highlight how maintaining out of date and irrelevant information can be potentially damaging.

Yet, prior to GDPR, there was no mechanism in place to avoid these unfortunate circumstances. GDPR is an attempt to limit what businesses can do with customer information, and to shift the power of information back towards the customer.

If there were any question as to whether or not there was a call for such a law, the fact that Google received removal requests from almost 2.5 million URLs since the time that the GDPR went into effect in May of 2018 should sufficiently answer it.

What Data Needs to be Removed?

Proper compliance with a customers’ right to be forgotten requires understanding where and how you may have used the information, as well as any third-party vendors with whom you might have shared it.

The nature of a business relationship with the information is crucial. Are you a data controller or a data processor? The controller collects the data and decides how the information is used. The data processor is tasked by the data controller to process the information in whatever form that may take. Although these can be separate entities, the data controller is generally responsible for any actions undertaken on its behalf by the data processor.

FREE TRIAL

That said, should noncompliance result from both the data controller and the data processor, both the controller and the processor could be fined.

The best way to avoid noncompliance is to have meticulous data management practices and procedures – i.e., organization and tracking of what customer data your business collects and stores, where it is, the purposes for which it is used, and where and when it may have been sold or otherwise shared.

Additionally, businesses should have a method in place for its easy and systematic deletion. Regular audits are advised to make sure the company is always aware of exactly what information it possesses. The deletion of information can be a deceptively involved process, especially in a timeframe as relatively short as one month.

The GDPR’s “Right to Access” and “Right to Correct”

Under Article 15 of the GDPR, consumers have “the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data.”

Stated differently, persons on the EU or EEA must be allowed access to personal data that has been collected pertaining to them.

Moreover, it entitles such persons to information not just on what was collected, but also the purpose for which it was collected, the categories of data being processed, the recipients, including information if these are in third countries, how long the data is expected to be stored, and whether the data has been used in automatic decision-making such as for profiling.

Similarly, customers in the EU or EEA also have the right to correct or “rectify” their information. More specifically, Article 16 of the GDPR allows customers to require a company to correct any mistakes or incompleteness in the information a company has about them.

Why is this needed?

You may be questioning the necessity of a separate provision for accessing information when it can be deleted upon request. As it turns out, there are a few scenarios where merely obtaining the information is preferable to deleting it outright.

The biggest reason is that deletion may just be an unnecessary step. A customer might just be curious about what information a business has retained about them over a period of time.

Learn More

As another example, a customer might want to know what the company knows about their personal life.

On the other end of the spectrum, customers may want to make sure the data that the company has about them is accurate and complete.

The point is, it’s the customer’s data and GDPR empowers them to regain a large degree of agency over it.

How does it work?

Too often, companies have made it difficult for customers to retrieve information that the company has regarding them, especially once the company already has their money. GDPR is designed to rewrite that narrative.

To get the process started, a customer need only send a subject access request (SAR) to the entity that collected the data. This can be done using pretty much any modern form of communication, so long as it leaves a paper trail.

The GDPR provides companies with only one month to respond to the request barring extenuating circumstances.

Just as with requests to delete or erase information, companies should develop action plans in order that they are not scrambling should a request to correct or for access come along.

The Problem of Fake and Fraudulent Requests

Another important aspect of complying with these obligations under the GDPR is the verification that the request is actually coming from the true person.

There is a very real concern of fraudulent requests from bad actors, who might use a customer’s data for nefarious purposes. Equally troubling are nuisance requests from impostors that would harass companies with fake requests, wasting valuable time and resources. These fake claims could not only damage the customer and the company, but in the cases of requests to delete or correct information, the quality and accuracy of the company’s data could be compromised.

FREE TRIAL

Taking a GDPR request at face value, with no steps taken to verify the identity of the requester, could lead to serious problems. The need to verify whether the requests are authentic is paramount.

Under the GDPR, the company “should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.” In addition, the GDPR also specifically provides that a company may “request the provision of additional information necessary to confirm the identity of the data subject.”

Applications like Konfirmi provide solutions to verify the identity of the person claiming to exercise their rights under the GDPR. For example, these apps allow both small businesses and large companies to use multi-factor authentication to make sure the person making the request is who they claim to be.

In this way, these applications can both stop fraudsters and discourage harassers.

Conclusion

For businesses that have customers who may be in the EU or EAA, noncompliance is not a viable option. The GDPR sets clear guidelines with clear punishments.

However, with the proper planning and operational foresight, companies can bring themselves into compliance quickly and easily.

How to Comply With the CCPA’s “Reasonable Verification” Requirement

CCPA Compliance: About "Right To Know" & "Right To Be Forgotten" | Blog

If you have customers in California, you are probably familiar with the California Consumer Privacy Act (CCPA) that went into effect on January 1, 2020. Because the state is a market comprised of nearly 40 million people, many businesses are choosing to comply even if they do not yet have customers in California.

FREE TRIAL

Learn More

The CCPA is designed to help better protect the digital collection, storage, and dispersal of personal consumer information. This article provides a quick overview, and focuses on the “reasonable verification” requirement when a California consumer exercises their new “Right to Know” or “Right to Be Forgotten”.

Compliance with CCPA Consumer Information Requests

Let’s take a look at some of the facets of what CCPA compliance looks like.

When businesses subject to the CCPA receive information requests from California residents, those businesses are required to map out how certain personal information was collected, where and how it was stored, how it was processed, for what it was used, and with whom it was shared.

The California consumer is entitled to receive this information for anything collected within the 12 months that preceded the date of the request. This is often referred to as the consumer’s “Right to Know” about how the business is using the consumer’s data. Requests like these are often called “Requests for Information” or “Information Requests”.

Furthermore, the CCPA specifies what constitutes personal information. It defines it as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

Compliance with a properly submitted Information Request requires the inclusion of the nature of the personal information collected; whether or not the information was collected directly or from a third party (and if so, where); whether or not the information was offered freely by the consumer, or via some other method; where the information is stored by the business, as well as when it is set to be deleted; the reason and/or intended use for which the information was procured; and what information has been sold to a third party. Additional information may be required in certain circumstances.

Liability for Failure to Properly Respond to Information Requests Under the CCPA

Under the CCPA, businesses have 45 days to respond to Information Requests. Failure to do so can result in serious penalties and liability.

This relatively short window highlights the importance of having consumer information adequately organized and readily accessible. As companies may also need to track consumer information beyond their own business, implementing a form of data mapping is highly advised.

This will allow businesses to chart not only what the personal information was collected for their consumers, but also what it was used for and where it may have been sold or shared. This makes having a system in place that can automatically organize your consumer information an invaluable resource.

Request to Delete

In many cases, the CCPA takes things a little bit further – granting consumers the limited right to request the deletion of their personal information from a business’ records. This is often called the consumer’s “Right to Be Forgotten”. Requests like these are often called “Requests to Delete” or “Deletion Requests”.

Under Section 1798.105 of the CCPA, when a business receives a consumer request, it is obligated to delete that consumer’s information from its records and make sure any of their service providers who may also have the information delete it as well. Additionally, companies must make consumers aware of this right and how to exercise it.

This may appear cut and dry on the surface. However, there are several exceptions in which a business will not be obligated to delete a consumer’s personal information upon request. These exemptions allow businesses to keep personal consumer information when it has to do with the business:

(1) providing goods or services to the consumer;

(2) detecting and resolving issues related to security or functionality;

(3) complying with legal obligations;

(4) conducting research in the public interest;

(5) exercising free speech or ensuring another’s exercise of free speech; or

(6) using the information for internal purposes that the consumer might expect.

FREE TRIAL

This means for example, if a customer requests the deletion of their information before the item they purchased has shipped, the company doesn’t have to delete any information need to accomplish the delivery.

As another example, a customer may be the victim of identity theft and hold a business subject to the CCPA responsible. Were they to submit a request for the deletion of their personal information, it may be rejected on the basis of “detecting and resolving issues related to security or functionality”, or “complying with legal obligations”, as the information may be needed to discover whether or not the company is, in fact, responsible for the data leak. Moreover, if you do discover a data breach, you’re legally obligated to inform your customers. You can’t notify people without their contact information.

In addition, businesses have an exception that allows them to continue to use the information “for internal purposes that the consumer might expect”. Put simply, if the company is using the information internally, in a manner that a customer would reasonably expect at the time the consumer provided the information, the business will likely be under no obligation to delete it.

However, the potential vagueness of the phrases “internal” purposes” and “that the consumer might expect” should not be read too broadly. For example, it is not likely that a business selling specialty products would be able to keep a California customer on their mailing or email list after the California customer submitted a Deletion Request.

If a business decides not to comply with a Deletion Request, the business must notify the California consumer that the business will not comply with the request to delete, state the basis for denying the Deletion Request, including the statutory and regulatory exception the business is relying on, delete the any information about the consumer that does not meet any exception raised by the business; and stop using the consumer’s information for any other purpose.

Reasonable Verification

In both the instances of Information Requests and Deletion Requests, the business is required to verify that the request is legitimately coming from the person to whom the data belongs.

Failing to take this step will not only leave you in noncompliance, but it will also open you up to wasted time, money, and other resources. Worse than that, you may give sensitive information to a fraudster, exponentially exacerbating the issue.

Learn More

Applications like Konfirmi offer exactly such a solution, and can easily be integrated into most websites, apps, and other online systems.

For example, these apps allow both small businesses and large companies to use a variety of verification methods such as multi-factor or knowledge-based authentication to make sure the person you’re dealing with is who they claim to be.

Processing fraudulent requests would likely lead to far bigger headaches than finding or deleting the data. It is an aspect of the regulation that cannot be ignored.

Conclusion

While the impact of a California consumer’s new Rights to Know and to Be Forgotten are both significant by themselves, the requirement that the identity of the consumer must be “reasonably verified” cannot be overlooked.

Businesses should have a mechanism in place to comply with the verification requirement. Ignoring the CCPA altogether is not an option, especially as other states are starting to follow suit. Businesses will have to find tools that will allow them to quickly and easily maintain compliance with this complex and fluctuating landscape.

Konfirmi is one of those tools. This new agency over personal information is of no use — and is actually a detriment — if there is no verification of who is trying to exercise control over it. With heightened access must also come heightened vigilance.

Understanding Multi-Factor Authentication: 3 Ways It Can Benefit Your Business

Understanding Multi Factor Authentication (MFA) And Its Benefits | Blog

Most applications require a username and password to be able to login and use the app. This is called “Single Factor Authentication” or “SFA” because it only requires a person to have the username and password in order to sign in.

FREE TRIAL

Learn More

However, “Multi-Factor Authentication” or “MFA” requires more than just a username or password to unlock. This adds an additional layer of security compared to usernames and passwords, which can more easily be breached and hacked.

What Are “Authentication Factors”?

At its core, authentication is a process that allows a person to prove they are who they say they are. When thinking about how to identify your customers, it is integral to know the types of authentication factors available to you.

Authentication Factors are independent credentials that are used to verify a person’s identity. There are three general categories for authentication factors:

Knowledge Factors

A knowledge factor is sometimes referred to as “Something You Know.” These are commonly the things that a user knows and is typical for Single Factor Authentication like Username, Passwords, PIN, and security questions.

Possession Factors

A possession factor consists of “Something You Have”, and is most analogous to a traditional key.

For example, some apps send codes to a smartphone number that you previously said was yours. When you enter the code sent to your smartphone, this proves you are in possession of the smartphone belonging to you.

Other examples include special cryptographic keys that can stored in a USB stick. This key is matched with information you previously provided to the app provider. When you want to prove you are who you say you are, you can use the key stored in the USB stick to prove you have possession of the key.

Similarly, the key could be stored on your smartphone. In order to prove who you are, the app might ask you to do something on your smartphone. This proves that you are in possession of the key on your smartphone.

Inherence Factors

An inherence factor or “Something You Are” is increasingly becoming a popular authentication factor for everyday use. Examples include fingerprints, facial scans, voice prints, retinal or iris scans, or similar biometric identification systems.

Smartphones often use inherence factors to keep unauthorized users from being able to unlock the smartphone.

Single-Factor Authentication (SFA)

Single-Factor Authentication is the most common security process used by websites or networks for identifying users.

FREE TRIAL

As the name suggests, SFA only uses one factor or credential to authenticate the identity of the user – most commonly a username and corresponding password.

Due to the massive improvements to the computing and memory power of computers and processors, it has become increasingly easier for hackers to attack and penetrate password databases, or use sheer brute computing power to guess your password. This is evident from the series of data leaks from even the most reputable websites and companies.

Passwords are no longer enough, and single-factor authentication is rapidly becoming obsolete. The biggest risk for single-factor authentication is that it heavily relies on the diligence of users to take actions to protect their data by creating strong passwords.

Unfortunately, more often than not, most users employ only one easily remembered password for multiple websites. This ensures that if a hacker gets access to one of their accounts, the hacker will have an easier time accessing all other accounts using the same password.

For example, a recent study showed that a whopping 83% of Americans still use weak passwords. Similarly, a statement from Verizon’s Data Breach Investigation report stated that “81% of hacking-related breaches leveraged either stolen and/or weak passwords.”

It is no secret that websites get hacked and even the biggest companies who employ a team of IT security professionals are not impervious to hacking. When sites get hacked or get their data breached, hackers can make off with important user information like emails, usernames, and even passwords.

Learn More

Multi-factor authentication helps mitigate these risks because even if hackers have your password, they will still not be able to access your data or account, or otherwise claim to be you.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication uses multiple factors like Knowledge Factors, Possession Factors, and Inherence Factors to verify the identity people. This is significantly more secure compared the single-factor authentication.

Multi-factor authentication adds another layer of security for businesses and its user. Multi-Factor Authentication, like 2-factor authentication (2FA), uses two authentication factors to verify the identity of the users.

Most 2-factor authenticate uses Knowledge Factors like passwords and usernames together with Possession Factors like codes being sent to the phone of the user that the user will then enter to verify their identity.

Multi-Factor Authentication mitigates the risks of weak passwords and provides an extra layer of security and keeps data much safer. MFA was previously a “nice feature to have” for websites, but now the increased risk posed by stolen and hacked passwords has made MFA a must-have for websites.

Three Significant Benefits of Using Multi-Factor Authentication

Improved Reliability

Multi-Factor Authentication is a cost-effective way for businesses to improve the reliability of their fraud prevention efforts, and add another layer of defense against hacking, impersonation, and ID theft.

Compliance with Regulation and Industry Best Practices

Multi-Factor Authentication helps businesses comply with regulations due to increased security for various customer identification and data-protection requirements. Businesses should look for multi factor authentication apps that allow you to choose between two or even more authentication factors that help add an extra layer of security.

Simplifying the Customer Identification Process

Multi-Factor Authentication helps businesses simplify their customer identification process and helps improve user experience. MFA adds an additional layer of security at the same time, while decreasing the burden for users and customers in terms of verifying that they are who they say they are.

Conclusion

As cyberattacks increase in sophistication, and governments implement more and more regulations to prevent fraud, businesses will find they can no longer afford to avoid using customer verification.

However, it’s important to note that the implementation of MFA must be done with user experience concerns in mind. Making your customer identification and verification process too strenuous will increase your abandonment rate, and no one will want to buy your products or use your services.

Top 5 Ways to Improve Your Customer Verification Process

Top 5 Verification Methods to Improve Customer Verification - Insights

Companies have to verify their customer’s identities for various reasons. For example, in order to prevent fraud, e-commerce companies often want to verify their customers before processing orders, and in some cases this is required.

FREE TRIAL

Learn More

Many businesses will soon have to “reasonably verify” California customers before complying with a request for a copy of their personal information held by the business, or to delete their information. There are similar requirements for customers who are residents of the European Union.

The most obvious issue for insufficient customer identity verification is fraud. However, it is not the only issue.

Poor user experience and trouble with onboarding can frustrate both potential customers and staff. As more and more transactions are completed online, customer verification becomes more and more prevalent. To meet growing demands and legal requirements, many current customer verification processes will need to be improved.

With some very important exceptions noted at the end of this article, here are 5 ways you can immediately improve your customer verification process.

Eliminate the tedious

Customer verification is crucial where instances of money or sensitive information is involved. It stands to reason that companies would want their customer verification to be as accurate and effective as possible.

Unfortunately, this can often translate to an experience that is tedious and uncomfortable for users. Companies can’t afford to have poor user experience driving those users away.

The key is to find methods of authentication and verification that are effective, accurate, and easy to complete. The last thing you want to do is inconvenience users any more than necessary.

One example here is “Two-Factor” or “Multi-Factor” Authentication (2FA or MFA). This verification method requires your customer to enter a code that is sent to their email, or to their mobile phone.

Because the verification method is very common, the process is very recognizable and easy for your customers to use and understand.

In fact, online retailers doing business with European Union (EU) residents must comply with the EU’s new Payment Services Directive 2 (PSD2) law. The new EU directive requires customer authentication – such as by email or text/SMS code sent to the customer’s cell phone – for most transactions over 30 Euros.

Using 2FA or MFA, you can easily verify your customer’s email address and phone number. This can be important if you need to make sure your customer did not type in their information incorrectly. You can also use 2FA/MFA to stop bots and other fraudsters in their tracks.

Speed it up

Customers don’t want to wait – the longer you make them do so, the less they will want to be your customer.

One example to consider here is “Single Sign On (SSO)” authentication. This verification method allows your customers to confirm who they are by logging into their accounts with popular apps, like Microsoft, Google, and Facebook. Your customer’s user name and password are not shared or accessible by anyone.

FREE TRIAL

Apps like Facebook, Twitter, Google, and Microsoft are very well known and widely used. This makes the process feel more recognizable for your customers. Like 2FA/MFA, you can use SSO to stop bots and other fraudsters in their tracks. In addition, the SSO verification method is very fast and easy.

Don’t over-rely on humans

If the verification process isn’t automated, that means someone has to do the verification themselves.

If you receive an influx in customers, it can become difficult for your staff to keep up. As the volume of new customers increases, it can become too much handle and create onboarding bottlenecks that only slow the process down further. The further behind they get, the slower the onboarding process becomes. It’s a problem that can cascade very quickly.

Ostensibly, you could hire more employees to try to keep up with an already slow process. Conversely, seeking customer verification solutions that support automating the process is a far more viable solution.

A manual processing of customer verification often relies upon cumbersome and tedious methods to get ID information from the customer. The manual authentication of that information can often take too much time to complete.

Additionally, remember that human error is a part of all manual processes. And when people are asked to do monotonous tasks like ID checking, mistakes become more common. This recipe for disaster is the main reason that more automated solutions are suggested. The over-reliance on manual processing only exacerbates existing issues.

Here, consider checking your customer’s information automatically using “Knowledge Based Authentication” (KBA). This verification method allows you to verify your customer’s information against credit reporting agency or other repositories of consumer data.

Learn More

For example, you can use this feature to ask your customers to answer questions about their address, contact information, age, or other information to verify who they are.

It is very important that the KBA provider has a very wide coverage area of unique records that it checks.

Because this method usually works in the background, you only need to get your customer’s explicit and informed consent to do the checking. The rest is usually very fast and easy.

Choose an adaptive platform

The principle of escalation suggests that when you build stronger walls, potential invaders will eventually produce more effective means of knocking those walls down – so you have to build even stronger walls, and so on. As verification features get stronger, fraudsters get more and more clever at getting around them.

Customer verification systems are under constant threat of attack and subversion from fraudsters by their very nature. The best systems offer different methods of customer verification, all at speeds that manual processing simply cannot achieve.

For example, consider using systems that don’t just rely on one verification method that can be spoofed or thwarted. Ideally, your chosen customer verification system would use verifications from various different providers, or allow you to implement multiple verification methods in different ways.

Make sure you’re not violating any laws

Many people are not aware that automated ID checking can violate privacy and other laws, if not done correctly. Even just one lawsuit could wipe out all of your profits, and put your company in severe financial jeopardy.

Many jurisdictions require advance notification and consent in order to process an individual’s information, including for facial recognition and other biometrics, and mandate certain retention limits.

In some cases, you even need a written release from your customer to use facial recognition or other biometrics, and written disclosure of the specific purpose and duration of time for which the facial recognition is being collected, stored, and used.

FREE TRIAL

In addition, many online businesses have no choice, and must use manual customer verification. In some industries, checking of ID is a requirement. The penalties for selling to underage customers can mean loss of business license, substantial fines, and even criminal prosecution and prison.

For example, in many states, sellers of age restricted products like marijuana and alcoholic beverages must check the buyer’s government-issued photo ID to ensure that the buyer is old enough. Often, the checking of ID must be done by a human who is responsible for the verification.

If these restrictions apply to your business, consider using a system that obtains verified photos or videos of our customers holding their IDs, along with close ups of the IDs themselves.

Before choosing a customer verification system, make sure its fits with the legal requirements for your customer base. In any event, be very careful to make sure you are not violating any laws that apply to ID checking, privacy, or other aspects of customer verification.

Conclusion

Your goal should be to provide a smooth user experience, that still accurately verifies the identity of your customers, and complies with your legal obligations.

Fortunately, there are automated solutions that can address all of these issues. They provide improved user experience, cut down on the burden to your staff – all while eliminating human error, and keep up with the escalation of fraudsters. All you have to do is make use of them.

What is My Mother’s Maiden Name? “Meatball”

We are often asked by online companies for some piece of personal information with which to later identify us. “Mother’s maiden name” is one of those questions often asked.

FREE TRIAL

Learn More

Most people hardly hesitate to give out this information in an expectation that no one could do anything with that piece of data. Additional questions may include: favorite musician, high school mascot, favorite food, where you met your spouse, the name of the street where you grew up, or the like.

I have news for you however: these are not secrets.

People talk on social media about their interests and hobbies and have links to their family members. Although your social media profile may not reveal your mother’s maiden name, there are also genealogy sites like Ancestry.com and others where hackers can get that information.

What makes it worse is that often times we can’t even remember what we said was our favorite food one year ago, but hackers can guess it twenty percent of the time – for example, “pizza” is number one.

Protecting Your Questions From Hackers

So what can you do?

Well, who says the answers to these questions need to be true? They just need to be easily remembered and match what you gave originally.

Use a word that is not part of your life, something you wouldn’t say on your Facebook page or LinkedIn account.

For example, let’s say you are a vegetarian. You could use “meatball” for the answer to all your questions. It will be easy to remember and almost impossible for hackers to guess — don’t actually use “meatball” now that it is in this article!

You may think it is unsafe to use the same answer for all your questions, but you won’t easily forget it and if you choose a word that is not a part of your world, hackers will not easily guess it.

FREE TRIAL

Lately, many websites are using tools like Konfirmi that take your basic information and check it against public databases, or use other verification methods such as two factor authentication to prove you are who you say you are.

Although these might add an additional step to a checkout process or online application, it is worth it to know that the site you are on is secure.

Recaptcha Security – Is It Dependable?

Of note, ReCaptcha or “Are you a Human” have been hacked and do not provide a sufficient layer of security to a website anymore. For example, a security researcher named East-Ee Security claims to have discovered a “logic vulnerability” that allowed for an easy bypass of Google’s ReCaptcha v2. University of Maryland researchers announced they have created “UnCaptcha”, an automated system to defeat ReCaptcha’s auditory challenges with a success rate of about 85%.

It is important to stay abreast of these changes in this age of data breaches and hackers trying to impersonate you.

Happy online travels and be safe!

Insufficient Age Verification Could Derail the Cannabis Industry

The march towards nationwide legalization of cannabis has ramped up considerably in the past few years. In the U.S. currently, 33 states and the District of Columbia have legalized pot in some form. In fact, 11 states along with Washington D.C. have legalized marijuana even for non-medicinal purposes.

Although many celebrate this shift in dynamic, it has shed light on some problems that must be addressed to keep the legal sale of cannabis safe and regulated.

FREE TRIAL

Learn More

The minimum age of cannabis consumption most often is 21 years old. As with other age-restricted products, when a customer comes into to purchase the product, they must show physical proof of their age. However, as commerce has evolved to keep up with the demands of the digital age, much more shopping is done online, this includes cannabis products.

The question is: are the age verification steps used by online distributors sufficient for such a sensitive product?

Cannabis has been coded as a societal ill for the majority of most people’s lives. Combine this with the fact that there are still vocal opponents to the legalization of the product, and you get a lot of people waiting to see if this experiment crashes and burns. It is also important to note that the federal government still considers the product illegal, putting its state-level legalization in somewhat trepidatious waters.

The industry can’t afford to allow cannabis and related products to wind up in the hands of underage customers. The sellers of these products need to know they are and are not selling to minors, and a lot of the traditional methods of identification are falling short in the age of e-commerce.

It would be naïve to assume that minors won’t try to exploit currently existing gaps in online age verification. Over half of self-reported cannabis users admitted to starting this use between the ages of 12 and 17.

Fortunately, however, age verification software is ready to stem the tide.

It’s Time for Better Age Verification Methods

Unfortunately, traditional methods of age verification are not up to that task.

If a minor wanted to purchase marijuana by visiting their local store or dispensary, they would have to bring at least one valid form of official identification – such as a state I.D., Driver’s License, or similar.

FREE TRIAL

This ID is usually checked for authenticity, scanned and kept on file, and cross-referenced on subsequent visits to ensure the customer is who they say they are. It’s not a perfect system, as fake identification is far from unheard of, but it does serve as a reasonable deterrent for minors who might otherwise try to buy the product, especially when compared to its online delivery counterpart.

If a minor wants to order age-restricted products online, to be delivered to them online or directly to their door, in some cases all they have to do is lie when asked when their birthday is. This reliance on self-reporting, often used as a bare minimum to take the onus of maintaining protected content off of the website and put it on the person self-reporting, is not enough.

The Problem May Be Bigger Than It Seems

The problem of poorly handled age verification would likely be much farther reaching than instances of children buying marijuana or even the closure of a few dispensaries here and there. There is a strong possibility it could halt legalization going forward.

We’ve already seen something similar with vaping and e-cigarettes. Throughout early 2019, there were reports of several deaths or severe health incidents linked to e-cigarettes, some of them being underage. In response to this, talks of a full-on ban of certain types of vaping materials came into play, some flavors were flat out banned, and all of this was done ostensibly to protect children.

All of these efforts ignore the relatively low number of fatalities, as well as the fact that almost all of the deaths occurred in connection with black market products that had been tampered with. But the experience of the vaping industry shows a reactionary, and arguably over-reactionary response when it comes to perceived threats to children.

Learn More

If the cannabis industry can’t sufficiently keep its product out of the hands of children then the government will almost certainly attempt to do it for them, in ways that are likely to negatively affect its of-age user base.

ID Verification Software

Modern problems require modern solutions. Self-reporting is a thing of the past.

In the present, we have technologies like knowledge-based authentication (where a customer is identified based on something the user knows), age verification (where a customer is verified with public records), and ID verification.

These fully online systems can also take the form of facial recognition verification, where artificial intelligence-based image analysis software can be used to cross-reference your face with official photographs on licenses or passports to verify your identity. In fact, Australia is considering implementing this technology to better age-gate pornography.

The technology is so advanced that it processes a feature known as certified liveness detection. This feature can see through advanced image manipulation attempts such as Deep Fakes (a face-tracking technology that can all but seamlessly apply one person’s face to another person’s body). These technologies would render fake IDs or the misuse of a parent’s ID effectively useless.

However, as this technology is in its early stages of implementation, there has been some pushback from those who feel it encroaches too far into their privacy. Facebook, for example, must face a class-action lawsuit for obtaining and using their customer’s biometric data without their express consent. At the same time, challenges to the use of facial recognition software by the police were dismissed by the High Court of England and Wales.

FREE TRIAL

Facial recognition offers a potential solution to a problem that may rise above the current legal challenges. The cannabis industry is not the only one that could benefit from the wider implementation of facial recognition. Any online industry that relies on customer verification can fortify their methodology, as the technology is already being used for online gaming, online banking, and pornography.

Conclusion

One thing is for sure. The sooner the cannabis industry realizes that self-reported age verification is not up to snuff, and potentially dangerous to the industry as a whole, the better. The various forms of online ID verification could be a huge boon to the industry.

Concurrently, the legal actions being taken in the name of protecting privacy are important as well. The usefulness of this technology also makes it easy to abuse. That said, in its proper application, it benefits all parties involved.

The cannabis industry is already closely associated with vaping. It should take all the steps it can to avoid the arguably undue scrutiny now facing e-cigarettes. That begins with beefed-up age verification methods, making use of the latest in online ID verification software.

WordPress Single Sign On and WooCommerce SSO Tutorial

PART A. What is SSO? an Intro to SSO and the Konfirmi Widget

An Intro to Single Sign On Login and SSO Providers

Konfirmi offers easy customer authentication using many verification methods such as Single Sign On, Multi-Factor Authentication (text/SMS/email verification), age verification (KBA), address verification, facial and ID images and videos, and more.

For this particular tutorial, we show how to set up Single Sign On (SSO) for a WordPress WooCommerce website.

Konfirmi integrates easily into your WordPress site. The plugin is quick to accomplish the task and simple to setup.

The app blocks spam bots, and allows you to quickly and easily confirm that your customers are who they say they are. Your customers can register for your blog, fill out forms, and buy products — all without having to create a username and password stored on your site.

In addition, the Konfirmi Single Sign On — or “SSO” — option allows your customers to identify themselves by logging in to their favorite email or social media app. Konfirmi lets you choose which SSO provider you wish to offer your customers.

These SSO providers include:
– Facebook
– Twitter
– Google
– Microsoft

Your website users then select one of these SSO providers. If they are not logged in, they will then be prompted to do so. And that’s it!

At this point, they can verify themselves using their login credentials from one of the SSO providers — without you needing to write a single line of code!

…

But how to do this?

How do you add Konfirmi’s SSO plugin for your WordPress website? This is what we’ll be teaching you in this tutorial!

PART B. How to Create an SSO Widget for Your WordPress Website

How to Create a Single Sign On Login Widget with WooCommerce Using Konfirmi

Step 1:
Log in to you Konfirmi account, or create a new account (free trial available) if you don’t have one already. Here’s a video on how to set up Konfirmi in less than 5 minutes.

Once logged into Konfirmi, select “+ CREATE NEW WIDGET” located at the bottom right of the dashboard.

Step 2:
Select how you would like the Konfirmi Widget to appear on your WordPress website.

Step 3:
Scroll down and select the Single Sign On (SSO) verification option.

Step 4:
A popup window will come up. Use the checkboxes to select the Single Sign On (SSO) providers you wish to offer your users, and then click on ‘Apply’.

Step 5:
Click “+ ADD NEW” and enter your full domain URL or IP address. Don’t forget to add the “https://”.

Step 6:
If you are setting up a Contact Form, then under the ‘WordPress Contact Form’ section, make sure the default setting is set to ‘Yes’. This will integrate your SSO widget with the contact form on your WordPress site.

If you are setting up WooCommerce, in the next section under ‘Woocommerce’, click on ‘Yes’ to integrate your SSO widget with Woocommerce on your WordPress site.

Step 7:
At this point, all that’s left to do is to save your progress by clicking ‘Save’ towards the bottom of the page.

When you return to the Konfirmi dashboard, you can now see the widget you created appear.

…

Now that you’ve created the SSO widget in Konfirmi, it is time to connect the SSO widget with WordPress so you can begin authenticating your customers!

PART C. How to Finalize and Test your SSO Widget with WordPress

How to configure WordPress to connect with your new single sign on SSO widget for WooCommerce

NOTE: You can also use Konfirmi to authenticate customer ID or info with WordPress forms like Contact Form 7, Gravity Forms, Ninja Forms, and Caldera, among others. But for the sake of simplicity, we integrate WooCommerce SSO for this particular tutorial.

Step 1:
After you log into your WordPress website, in your WordPress website dashboard, select the ‘Konfirmi’ plugin from the left-side menu.

NOTE: Make sure you are signed in to your Konfirmi account. If you are asked to signed in, press the ‘SIGN IN’ button on the top right, and sign in to your Konfirmi account.

Step 2:
Select the dropdown arrow under ‘Widget Integrations’ and then select ‘WooCommerce’.

NOTE: A message will appear notifying you that your container was successfully attached to the form

NOTE:
At this point, your Konfirmi widget should be ready to use.

Testing Step 1:
Now, let’s check out our WooCommerce form to make sure it’s working. To do this, go to your WordPress page that hosts your WooCommerce checkout form. Complete the form fields and click ‘Place order’

Testing Step 2:
At this point, the Konfirmi authentication popup will appear with your personal information pre-filled by default from the checkout form. Click the ‘Next’ button.

Testing Step 3:
Choose which SSO provider you’d like to use. Then check the consent box that pops up assuming you agree. Lastly, click next to continue.

Testing Step 4:
At this point, the SSO provider’s account login page should pop up. Enter your login credentials, and then click ‘Next’ to authenticate (username and password pages may be separate).

Testing Step 5:
If the credentials are correct, you will be authenticated! You’d then be sent to the order confirmation page, or whichever page your site is configured for users to redirect after purchase.