App Features

Addressing Inconsistencies in Online Age-Verification

Online Age Verification Inconsisitencies

Internet shopping is booming! US American ecommerce grew 50.5% from 2019 to 2020, and 14.2% in 2021 according to DigitalCommerce360. Ecommerce isn’t just for giants like Amazon and Walmart. Smaller online retailers have taken notice of the rising tide, especially in attempt to keep their businesses afloat during pandemic lockdowns.

These smaller enterprises are making use of advancing logistic technologies making selling and shipping much more efficient.

FREE TRIAL

Learn More

With most US Americans carrying internet-accessible smartphones nearly 24/7, the prospects of consumers being able to buy whatever they want at the push of a button is clearly an extremely lucrative one for ecommerce sites. The speed at which all of this has happened has led to frightening gaps in the effectiveness of age and customer verification scattered about the vastness of ecommerce.

The need for accurate and easy to use customer verification is reaching a fevered pitch, and it’s applications like Konfirmi that are leading the way in answering that call.

Mini Case Study – Vaping

The vaping craze has hit the country like a ton of bricks. Unfortunately, it has been minors who seem to be the most affected by this surge. There are various reasons for this. Firstly, vapes are exponentially easier to conceal than cigarettes. Secondly, there has been a lot of misinformation about what tobacco and nicotine vapes are actually made of. Thirdly, until relatively recently, despite still being illegal to sell to minors, e-cigarettes or more specifically, the “vape juice” that is inhaled, has been much easier for children to get their hands on than repeatedly trying to buy cigarettes.

Facial Recognition Failures: Ethical Issues & Racial Profiling

It doesn’t help that the vape marketing is everywhere. Nearly seven out of ten teenagers naturally come across vaping advertisements, which only serve to exacerbate the issue. One out of five 12th graders is vaping. Until recently the minimum age requirement for purchasing tobacco was 18 (which many 12th graders are). This has allowed vaping to spread through high schools at near epidemic rates. The US government raising the legal age to 21 was designed to curtail this influx, however, it is too early into its implementation to notice any effects one way or the other.

As for the actual purchase, it’s one thing to turn away a minor looking to buy vaping products at a convenience store where they can be seen and their identification can be verified. It is a very different thing to achieve the same discernibility on the internet. Some websites will provide cursory age verification methods like “age gates” while others simply flout the law entirely. Because of the nebulousness of the digital space, these vendors can often get away with it. Moreover, many of these sellers are not offering a product that is on the up and up, to begin with. Still, they are more than happy to take a customer’s money and ship them their product, seemingly unconcerned with the particulars of the situation beyond that point.

The problem with underage access to vaping products isn’t a lack of legislation. The problem is a lack of effectively enforcing that legislation. In 2019 several vape related deaths brought vaping into the forefront of US American consciousness. It was those deaths that have spurred on the recent spike in legislative action. It would follow that enforcement measures are due to ramp up soon as well.

As a result, many vape retailers and other purveyors of age-restricted products are getting more serious about their age verification processes and software. While still in use, age gates are really the most useless thing on the internet, offering little protection against minors accessing and purchasing age-restricted products. Now applications like alcohol delivery service Drizly, food delivery service DoorDash, and those that use UPS for alcohol shipping require their delivery drivers to check IDs. This approach has varying levels of effectiveness.

But are these measures strong enough? The unverified sale of alcohol and vape products is one thing, but deadly firearms are also sold online. The internet is in desperate need for accurate and reliable customer verification.

FREE TRIAL

Standardizing the customer verification process would benefit the ecommerce space considerably. Ecommerce needs to find the most viable solution and make it the general best practice within the industry. Applications like Konfirmi are primed to offer that service.

The Importance of an Elevated Standard

The importance of age and customer verification is only going to increase going forward. Strong enforcement of legislation along with new age restricted products makes for increased importance. For instance, ss more and more states legalize cannabis, an entirely new age-restricted market is making its way onto the stage.

At brick-and-mortar establishments, age verification can be done in real life, face-to-face. If someone wants to buy an age-restricted product, they simply show their ID and if it appears valid, they receive their product.

Undeniably, fake IDs have been around for decades. But it’s much more difficult to get a fake ID passed a seasoned convenience store clerk than it is to get passed a shady website that doesn’t particularly care how old you are so long as you have money.

To combat underage consumers from accessing illegal content or products, the ecommerce arena needs to improve its efforts from “age gates” to processes and procedures that actually work. One such solution is Konfirmi which offers state of the art customer verification software. Moreover, it is low cost and easy to implement. Additionally, it provides customers with an easy-to-use system, thus not adversely affecting the customer experience.

Because Konfirmi cross-references information with billions of online records maintained by reputable third-party data providers it is nearly impossible to fool with something as ubiquitous as a fake ID. This means that any online retailer that aims to comply with the law will have a fortified verification apparatus that can seamlessly integrate into their existing platforms.

Conclusion

Age-verification wasn’t a major concern years ago when Amazon was a simple online retailer only selling books. Yet, because just about everyone uses the internet these days, gaps in its effectiveness often present themselves relatively naturally. Such is the case with age verification. The old way is no longer working with regard to age-restricted products. Applications like Konfirmi offer a new and better way.

Teen vaping is a problem that was caught late. It will likely take years to undo the damage of unchecked marketing and unregulated ecommerce. Implementing stronger and standardized age verification is a step in the right direction. Konfirmi offers a cost-effective and easy to use tool to make that step a lot easier for ecommerce to take.

Online Age Verification in Europe

Know Your Customer (KYC) has become increasingly important in Europe over the past few years. European governments have proposed and are enforcing previously passed legislation requiring online enterprises to more assuredly verify customers’ identity.

One key area of customer verification is age. For example, online gambling has age restrictions in the United Kingdom, the Netherlands, and Germany.

FREE TRIAL

Learn More

However, commonly used age gates typically do not meet the requirements for confirming a user’s age. Another example is that of pornography. Age verification is essential for internet viewing in European nations where pornography is permitted; however, ineffective age gates often do not suffice as appropriate verification.

Additionally, new stringent European regulations and public concern call for strengthening identity verification processes in order to avoid severe penalties or public backlash. Recent actions include:

European Union

The Digital Services Act, (DSA), has been introduced which includes rules for online enterprises to protect EU citizens with higher standards of safeguards. The DSA aims to block illegal online content, goods, and services. As it stands, online entities subject to this act would need to comply with strict “Know Your Business Customer” requirements. Those who do not comply risk hefty fines. The European Council and European Parliament look to decide on this act mid-2022.

Germany

In Germany, internet gaming is facing increased limitations as a result of new legislation that took effect in 2021. Failure to provide robust age and identity verification will result in the rejection of new online gaming licenses or the imposition of fines of up to 500,000 euros and license revocation for existing operators.

United Kingdom

In the United Kingdom, the Online Harms Bill calls for a “new era of accountability” for social media companies in order to protect children, among other things. Companies that fail to provide a safe environment would face fines of up to $24 million or 10% of global revenue, whichever is greater, as well as criminal sanctions against senior management.

France

In mid-2020, the French Parliament passed legislation requiring age verification for watching online pornographic. To protect those underaged from viewing this mature material, this legislation will penalize corporations who fail to comply with the law by applying fines and restrictions that may include their websites being blocked in France. Just recently, the French government threatened to block porn websites such as Pornhub and xHamster for failing to enforce more strict age verification measures.

Spain

While age verification is not a national legislative issue, other watchdog agencies have expressed concern about how easy it is for those underaged to access mature online content. While the Data Protection Law of 2018 states that content providers are responsible for ensuring proper age verification, this is not widely enforced. The National Agency for Data Protection issued a report in February 2020 expressing concern over the lack of “effective methods to verify the users are at least 18 years old.” While not recent legislation, awareness of the ease to access age-sensitive content is on the rise.

FREE TRIAL

Italy

In mid-2021, Italy’s Data Protection Authority (DPA) required TikTok to confirm the age of its users. As a result, TikTok removed over 500,000 users either suspected of or actually being under the required age of 13. This investigation and subsequent removals were prompted by a ten-year-old girl dying after participating in a deadly challenge she saw on TikTok. The DPA continues its investigation and work with TikTok to ensure age restrictions are upheld.

Out of Date

In Europe and beyond, “age gates” have been used as a method of online age verification. Age gates often employ a text field that requires the prospective consumer to input their birth date or a simple checkbox that by simply ticking, affirms the customer is of legal age. Using an age gate is one way for websites to demonstrate that they are taking steps to keep their products and services out of the hands of those deemed too young. Additionally, as a benefit to the online enterprise, age gates are frequently regarded as a “low-cost, low-effort method of…protecting one’s assets.”

However, age gates are not the solid and indestructible barriers that their name implies. In fact, many find age gates pointless. Age gates function on the honor system. Due to the lack of penalty for lying or reward for honesty, the majority of people lie on age gates whether they need to or not.

While age gates are intended to act as a digital barrier to dissuade and keep underage individuals from accessing age-restricted goods and services, their efficacy has always been hazy at best.

The Solution

Without a doubt, having an effective and solid age verification system has grown even more important for online businesses in Europe. Additionally, due to the complexity of global identification, which includes an array of personal naming practices, different types of government-issued identification, and access to third-party data, European online businesses require robust methods for verifying age and identification in general.

This begs the question: what can online companies in Europe do to better know their business customers? The answer lies in employing tech solutions to ensure compliance with legislation while also providing a secure and pleasant online experience for customers.

While businesses who are legally compelled to verify their customers’ identity and ages may not have an option about whether or not to comply, they most likely have a choice about the type of software they use. Companies such as Konfirmi provide simple-to-use and cost-effective methods for verifying a customer’s age and identity.

Businesses typically choose their products based on their cost, ease of installation, and consumer user experience. Applications such as Konfirmi take all of these aspects into account. Konfirmi can be quickly added to any website or app. Furthermore, Konfirmi complies with GDPR.

Final Thoughts

While age verification has been a concern in the European online space for many years, it is garnering increased attention in the wake of the explosion of online shops offering products and services that are intended for a more mature audience: e-cigarettes, online betting, mature video games, and pornography. With new European government legislations, online platforms in Europe need to enhance their age verification solutions now.

The Need for Robust Age Verification in Vaping E-Commerce

The United States is currently ablaze with the vaping craze. In the United States, vaping is now a $29 billion industry. Many exalt vaping’s benefits such as a reduced reliance on traditional cigarettes chock-full of chemicals, elimination of deadly second-hand smoke, and assistance in quitting smoking altogether with the tapering of nicotine strengths in vaping liquid.

FREE TRIAL

Learn More

Yet unfortunately, one glaring drawback of vaping is its attraction to those under age. Minors has been drawn to vaping for a variety of reasons. First, vaping is much easier to conceal than smoking traditional cigarettes. Second, many minors are not aware of the dangers of vaping due to the spread of misinformation about the contents of vaping liquid. Third, despite the fact that it is still illegal to sell to minors, e-cigarettes, or more specifically, the “vape juice” that is inhaled, has been much easier for children to obtain than traditional cigarettes.

What makes this situation challenging to control is that purchasing vaping supplies online can be extremely easy with few obstacles to those who are underage. This begs the question: how can minors be kept from purchasing vaping products online?

Teens and Vaping

The 2019 Monitoring the Future report stated that nearly half of all 12^th graders surveyed tried vaping at least once, and 25% had vaped within the previous month. Until recently, the minimum age for purchasing tobacco was 18, which many 12th graders are. This allowed vaping to spread at near epidemic rates through high schools.

The teen vaping issue isn’t helped by pervasive vape marketing. In 2015, over 80% of teens were exposed to e-cigarette advertisements, which has only served to exacerbate the problem. A study in the Journal for American Academy of Pediatrics, reported that youths exposed to e-cigarette marketing were more likely to try vaping within the following year.

Unfortunately, many vaping companies directly target teenagers. “E-cigarettes make frequent appearances on social media newsfeeds and timelines,” according to the Truth Initiative. “E-cigarette companies capitalize on this regulatory gap by offering kid-friendly flavors, such as cotton candy and gummi bear, and packaging e-liquids to look like common food items,” the Truth Initiative continues. Some vaping companies have even offered college scholarships, several even without a minimum age equal to the legal smoking age.

Challenges of Online Vape Sales

It’s one thing to turn away a minor who attempts to purchase vaping products in a brick-and-mortar convenience store where the customer can be seen and their ID can be checked. However, it is much more difficult to achieve that same discernibility on the internet. And while fake IDs have been around for a long time, getting that fake ID past a seasoned convenience store clerk is much more difficult than getting past a questionable website that doesn’t care how old the customer is as long as they can pay.

Many age-restricted websites provide cursory age verification methods such as age gates as an attempt to limit minors. Age gates are fields or questions on an e-commerce website that simply ask if the potential customer is legally of age to purchase products. Age gates can be in the form of a yes/no question or entering in one’s birthdate. As imagined, it is very easy to lie on an age gate without consequence. Due to their being weak hurdles, age gates are quickly becoming a thing of the past.

Other less scrupulous online vaping retailers will simply flout the law altogether. These online retailers can often get away without checking age because of the ambiguity of the digital space in and of itself.

FREE TRIAL

Furthermore, many of these sellers are not offering a legitimate product to begin with. Nonetheless, they are more than willing to accept a customer’s money and ship them their product, seemingly unconcerned about the details beyond that point.

More Robust Online Safeguards

In 2019, vaping-related illness and deaths took over news headlines. Of the 2,291 people who became ill, 15% were under the age of 18. These illnesses and their impact on minors sent a shockwave through the United States. In response, many cities and states began debating prohibiting vape products or at the very least, a way to limit its access to minors.

This public pressure has been encouraging vaping retailers to get more serious about their age verification systems and software. As currently used age gates lack reliability and dependability, a more robust safeguard is needed in the online vaping retail space.

For online vaping retailers, Konfirmi is the solution. Konfirmi provides cutting-edge customer verification software at a low-cost with simple implementation. Konfirmi cross-references customer information with billions of online records maintained by reputable third-party data providers, making it nearly impossible to deceive with something as common as a fake ID.

LEARN MORE

This allows any online retailer who is serious about meeting legal requirements and maintaining a good public reputation to be able to do so all while providing customers with a user-friendly entry point.

Conclusion

Under-aged vaping is a problem that has only recently been identified but will continue to snowball if not addressed. It will almost certainly take years to repair the damage caused by unchecked marketing and unregulated e-commerce. Implementing a robust form of age verification is a positive step to resolve this. Providers such as Konfirmi provide low-cost and simple-to-use solutions to make that step much easier to take.

Failures in Facial Recognition

“Yeah, the computer got it wrong,” Robert Williams said to 60 Minutes’ Anderson Cooper about his arrest. Williams was wrongly arrested in 2020 due to the Detroit Police Department’s facial recognition software inaccurately identifying him as having stolen $3,800 worth of watches. Williams has since sued the City of Detroit.

FREE TRIAL

Learn More

Recently when Facebook users viewed a video featuring Black men, its AI prompted a message to viewers asking if they would like to “keep seeing videos about Primates.”

In 2015, Google Photos AI facial-recognition program mistakenly tagged Black people as “Gorillas.”

Over the last fifteen years, facial recognition technology has exploded in popularity with governments and businesses alike, but with significant failures.

Racial Bias in Facial Recognition

A 2019 US federal study reported widespread racial bias in nearly 200 facial recognition algorithms. The study discovered that minorities were misidentified at a significantly higher rate signifying a lack of impartiality. One of the study’s researchers, Patrick Grother, noted that racial biases were found in “the majority of the face recognition algorithms we studied.” In fact, some of the algorithms tested were up to 100 times more likely to mix up minorities as compared to white Americans.

The research study published by the National Institute for Standards and Technology (NIST) discovered that those of Asian, African, and Native American descent were the most prone to misidentification.

The facial recognition technology was tested for practical application. One such test was identification through a large database of mugshots, in this case an FBI-curated database. In this test, Black women were found to be the most likely to be falsely identified.

Furthermore, how the technology is used can be amiss. Dr. Timnit Gebru, prominent computer scientist and former co-leader of Google’s ethical AI team, recognizes that even a perfect AI facial recognition has issues when used inappropriately. She noted that during the 2015 Freddie Grey protests in Baltimore, police were using facial recognition technology to identify protesters by matching images to social media profiles. Gebru states “the combination of overreliance, misuse and lack of transparency…is dangerous.”

When it comes to crime and punishment, the use of inaccurate technology has the potential to be devastating on both an individual and civil levels. The fact that many businesses and government institutions continue to advocate for widespread adoption of the demonstrably flawed technology is alarming.

The Legal Quagmire of Facial Recognition

The United States lacks an overarching federal law and consolidated best practices directing the use of facial recognition. As such, state and local governments have been left on their own in determining what to allow and not allow for facial recognition. Some choose to remain uninvolved while others choose to embrace facial recognition wholeheartedly including its use for surveillance and law enforcement purposes.

For instance, the Ninth Circuit United States Court of Appeals ruled in 2019 that Illinois Facebook users have the right to sue the business over its use of face recognition technology. This decision is in accordance with the Illinois Biometric Information Privacy Act (BIPA). BIPA requires businesses to obtain expressed consent from their customers before collecting biometric data. This includes fingerprints and facial recognition information.

Both Texas and Washington have similar biometric laws. Under Texas Business and Commercial Code, Section 503.001, the state strictly prohibits facial recognition for identification purposes with certain exceptions. Under this rule, Texas allows civil penalties up to $25,000 per violation. In Washington, State Bill 6280 outlines significant provisions in using facial recognition technology such as tests to prevent discriminatory effects and human review of decisions based on the technology.

Portland, Oregon is considering a strict ban on the technology’s use not only by private businesses but also by the government. California, New Hampshire, and Oregon all restrict police body cameras from using facial recognition. On the other side of the coin, some police forces in northern Texas do use facial recognition.

Federally, the Department of Homeland Security had considered requiring facial recognition checkpoints for US citizens and Green Card holders entering and exiting the country. Due to public outcry, the plan was eventually abandoned. Yet, a recent US Government Accountability Office report asserts that the federal government does plan to expand their use of facial recognition.

FREE TRIAL

While the current trend can be considered a victory for local democracy (as those directly affected by the regulations are the ones who make the rules), it is a huge headache for big business. At the moment, companies such as Facebook and Google have the option of either skirting more stringent facial recognition regulations (at a significant financial cost) or maintaining blanket policies and addressing legal issues as they arise (also at great financial cost).

Social Media’s Facial Recognition Troubles

For some time now, major technology companies like Facebook and Google, which employ facial recognition to sort and categorize images, have been defending themselves against litigation made possible by the passage of BIPA. Facebook, for its part, has sought to amend the law (and other comparable measures) at the legislative level. They have been unsuccessful thus far.

The ACLU’s Speech, Privacy, and Technology Project’s Nathan Freed Wessler lauded the Facebook-BIPA ruling as “a strong recognition of the dangers of unfettered use of face surveillance technology[.]”” Wessler continued with “The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale.”

In the case of Facebook, the issue stems from the company’s “tag suggestions” tool. Tag recommendations analyze photographs and classifies facial traits, producing and storing facial templates that enable Facebook to recognize persons in other users’ photos. Because photo uploads to Facebook are frequently geo-tagged, this generates a record of when a certain person was in a particular location.

LEARN MORE

Facebook argued that its customers did not suffer any concrete harm as a result of the company’s use of face recognition. However, the 9th Circuit Panel considered that injury can be concrete even when it is not visible. Additionally, the 9^th Circuit Panel underlined the heightened risk of personal privacy breaches brought about by evolving technology, reflecting similar worries raised by the Supreme Court.

Their judgement makes it abundantly clear that Facebook’s use of face recognition technologies “invades an individual’s private affairs and concrete interests.”

In Conclusion

There is considerable uncertainty surrounding the implementation of facial recognition software. If you’re a business considering using it innocuously for customer verification, you’re putting yourself and your company into a potentially dangerous situation.

Given the recent federal study confirming that many facial recognition applications suffer from racial bias and inaccuracies, as well as the potential for damaging lawsuits, regulatory issues, and reputational harm, the potential for devastating lawsuits, regulatory issues, and reputational harm is immense.

However, the “selfie ID photo” verification method used by Konfirmi does not rely on facial recognition. Rather it enables a simple method of automating ID verification while also protecting your business from lawsuits, regulatory issues, and reputational damage associated with facial recognition.

As senior policy analyst at the ACLU, Jay Stanley warned about facial recognition “One false match can lead to missed flights, lengthy interrogations, watchlist placements, tense police encounters, false arrests, or worse.”

Reputable Companies Rejecting Facial Recognition Due to Racial Bias

A Guide To Customer Verification Ans ID Authentication in 2020 | Insights

Facial recognition is the cutting-edge science that allows programs to recognize and match a scan of a person’s face to a databased photo of that same person’s face for the purposes of identification. Although the practical applications for such technology are vast, unfortunately, the technology still has significant problems, at least not as far as many large companies are concerned.

FREE TRIAL

Learn More

As it exists at present, facial recognition technology has a racial bias problem. According to a facial recognition race test by MIT, three facial recognition programs produced identification errors at a rate of 0.8% for men with light skin. However, the error rate increased to 20% to 34% for women with dark skin.

Additionally, Amazon’s facial recognition program reportedly misidentified 28 members of Congress as people arrested for committing crimes. While only 20% of the congressional members were people of color, the group was still misidentified at a rate of 39%.

Founder of facial recognition tech company Kairos, Brian Brackeen offers some potential explanations for the disproportionate errors and bias of facial recognition race tests in identifying people of color. He notes that the algorithms used by American facial recognition programs operate using programmed datasets of images. These imagines often reflect the creators of the programs, which in this case happen to be overwhelmingly white and predominately men. Brackeen points out that similar software created in Asian countries tend to have lower error rates when identifying Asian people.

While there may be fixes to the technology down the road, many of the top tech companies are either extensively retooling or abandoning plans to provide facial recognition altogether.

Most specifically, companies like Amazon, IBM, and Microsoft are withdrawing their programs from government and law enforcement clients for fear of the consequences of such racially-biased technology.

Why the Cannabis Industry Needs to Be Better About Age Verification

Facial Recognition Bias and Law Enforcement

It is no coincidence that these companies are withdrawing facial recognition programs especially in the context of law enforcement at this current moment in time. The United States is in the midst of a pivotal moment in terms of police relations, particularly with minority citizens. Although it is still uncertain what American policing will look like when all the chips have fallen, utilizing technology designed to identify criminals, that is known to possess racial biases would do nothing more than exacerbate an already precarious situation.

The evidence of facial recognition bias is far from incidental. In a government-funded facial recognition race test, federal researchers found racial bias in nearly 200 facial recognition algorithms. What’s worse, several of these programs were intended for use by law enforcement.

The National Institute for Standards and Technology (NIST) pointed out that people of Asian, African, and Native American descent were the most likely to be misidentified.

It is difficult to nail down the exact number of law enforcement agencies still making use of facial recognition despite its glaring flaw and in what ways they incorporate it into their investigatory activities. According to a 2016 study by the Georgetown Law Center on Privacy and Technology, there is no notable regulation on the use of facial recognition by law enforcement bodies. This is an alarming reality, considering the existence of a bug as substantial as racial bias.

FREE TRIAL

Clare Garvie, who worked on the aforementioned study noted, “We ourselves were surprised by some of the findings we had, mostly in terms of the sheer scope of use of facial recognition at the state and local level across the country.”

She continued, “Also, [we were surprised] at the complete absence of any legal imposed regulations or even policies implemented by law enforcement to constrain its use.”

Facial Recognition Bias and Customer Identification

Some companies have tried to make use of facial recognition software as a means of customer identification. Customer identification has become extremely important in this age of highly sophisticated hackers. However, using technology with clear racial biases is almost certainly a misstep.

“We do not use facial recognition” has become a mantra for various automated customer identification providers. One such company noted that: “[r]eports of racial bias in facial recognition technologies have been percolating for years. We saw this coming, and avoided these technologies altogether”. The same company added that “[t]here are much better and more reliable ways of achieving automated customer verification.”

One of these methods includes “selfie ID” photo and video verification. Instead of using facial recognition, selfie ID photos and videos are checked for recency and authenticity. This provides an easy way to automate ID verification that is not dissimilar to providing ID in-person to purchase age-restricted products.

Conclusion

Creators of facial recognition software are understandably pulling their products from use by law enforcement agencies, and other contexts. When taking into account the racial biases present in the current versions of the technology, not doing so could have disastrous consequences.

These tech giants have acknowledged that a problem exists. If law enforcement or any other businesses try to make use of facial recognition in its current form, they are taking on the unnecessary risks of their own accord.

When it comes to customer verification, there are better choices available that don’t have a downside as incendiary as racial bias. Moreover, racial bias is only one of the problems inherent in facial recognition. In fact, Facebook had to pay upwards of $550 Million in a settlement having to do with the privacy concerns presented by the use of the technology.

Of course, beyond the ethical concerns — if facial recognition simply doesn’t work the way it is supposed to, what real use is it to anyone? Federal studies have shown that more often than not, the software just doesn’t work properly. False positives and false negatives could lead to injury on the side of the customer and a damaged reputation for the company in a time when race relations are under a bright spotlight.

The Benefits and Types of Knowledge-Based Authentication for Your Business

The Benefits And Types Of Knowledge Based Authentication | Insights

Delivering a satisfying online customer experience is critical for any organization with a web presence. A big part of this is trust. Most customers will shy away from a website or app that does not appear trustworthy.

FREE TRIAL

Learn More

This is why every organization should be taking the right steps to protect its customers’ personal information during online transactions. Getting a customer to trust you today means they will do business with you tomorrow.

Global consumer review website Trustpilot notes that “brands have to be accurate, dependable, and provide the service they guaranteed.” And with this, identity verification is a huge part of how customers perceive their accurate and dependable experience with your brand leading to loyalty and retention.

Companies that don’t take the necessary security precautions see the consequences. In 2020 alone, many organizations such as Marriott, T-Mobile and GE have faced security breaches. To combat these security vulnerabilities, organizations need to implement new and innovative ways to protect their customers’ identities and convey trust. The best way to ensure this is by implementing a multi-level security strategy including Knowledge-Based Authentication.

Knowledge Based Authentication

Knowledge-Based Authentication, commonly known as KBA, is a simple process that requires customers to answer secret questions before they can utilize secure sections of your website or services. It allows an organization to verify a customer’s identity, using information like mailing address, phone number, age, email address, or any other piece of information expected to be unique to the customer.

KBA can work with commercial data providers such as credit bureaus that possess extensive customer records to verify information about nearly anyone. This level of authentication brings peace of mind to not only the organization but also the customer. In Q1 of 2020 alone, over 8.4 billion records have been exposed. Having Knowledge-Based Authentication (KBA) as part of your security strategy will help keep your customers’ private information secure against these breaches.

Knowledge-Based Authentication also helps businesses comply with security regulations, especially for companies in the finance sector. Systems like these help reduce fraud and in turn, reduce the cost of fraud prevention and recovery. At the same time methods such as KBA provide increased security for customers boosting confidence in the business. Yet finance-related businesses are not the only ones employing the security power of Knowledge-Based Authentication.

At least 21% of businesses in the e-commerce sector are currently using and implementing Knowledge-Based Authentication on their websites. And about 20% of businesses in the healthcare sector use Knowledge-Based Authentication to secure patient records in their database. Some businesses also use KBA to verify access to digital services like a service portal or transaction portal, age and identity verification, user enrollment, and password retrieval.

Types of Knowledge Based Authentication

There are two types of Knowledge-Based Authentication; 1) Static KBA and 2) Dynamic KBA. Both types of KBA differ on their degrees of security, how they are implemented, and how they are used.

FREE TRIAL

Static Knowledge-Based Authentication, or SKBA, is the more commonly used of the two KBA types. In Static KBA, the customer inputs his/her answers to security questions.

Should the customer need to reset a password or retrieve his/her username, the customer would need to accurately answer the security questions with the previously supplied answers. Thus, Static KBA is sometimes referred to as a “shared secrets” or “shared secret questions.”

Questions range from “What is the name of your elementary school?” to “What is your favorite food?”. Static KBA is typically employed by banks, financial institutions, and services like email providers to authenticate the identity of the customer before allowing access to secure data or an account.

Behind the scenes, Static Knowledged-Based Authentication is rather simple to set-up on a website. It is also straightforward and friendly in terms of the customer experience as the customers are the ones choosing the pre-determined questions and providing their specific answers.

Dynamic Knowledge-Based Authentication, or DKBA, provides a higher degree of security because Dynamic KBA uses “out-of-wallet” questions that are not predetermined but are generated in real-time using information from different data sources. These data sources include credit bureaus, marketing databases and customer surveys. An example of a Dynamic Knowledge-Based Authentication would be “Which of the following addresses did you live at in the past?”. From there, the customer would need to select the correct option from a provided answer list.

Because Dynamic KBA does not use a set of pre-determined questions and answers but rather accesses external databases, it is more difficult to implement compared to Static KBA. However, Dynamic KBA does provide a higher degree of security because it uses data from several different sources and questions customers on information not easily found online.

Unfortunately, this higher level security can come at the expense of ease of use for the customer. Yet, the customer experience can actually be enhanced by adding these additional security features through thoughtful design and educating users on how the security features work and add value to their experience.

Best Practices

With Dynamic KBA specifically, the security benefits associated with the use of out-of-wallet questions are dependent on the data used during authentication. That is why it is important to follow industry best practices including using trustworthy data sources and using meaningful questions.

Learn More

The first best practice is using reliable data sources. The reliability of the source of the data is directly related to the level of security the authentication provides.

These sources, such as existing account information or trusted third-party sources such as credit bureaus, should utilize non-traditional data to generate unique questions including a diversionary question designed to throw a fraudster off.

Another best practice is including questions that are a balance between convenience and security. Asking a question that is too complex can create insurmountable obstacles for customers to access their data and thus negatively affect the customer journey. Yet a question that is too simple can open the floodgates to fraudsters. Hence, it is important to explain the security features to the customer and include reasonable and unique questions.

Conclusion

Knowledge-Based Authentication provides an additional level of security for websites that need to know their customers are who they say they are. However, the actual level of security it provides can vary greatly based on implementation. The most successful business will find a way to strike a balance between security and customer experience, lest they lose the very customers they seek to protect.

Avoiding “Catphishing” and Similar Online Scams With Layered Identification

The relative anonymity of the internet has given rise to a slew of new types of fraud by consumers including the deceptive practice of “catphishing”.

Catphishing (or catfishing) is the act of pretending online to be someone different from who you really are. Catphishing goes beyond simply giving a false name. It entails creating a completely fake or borrowed identity, often with a backstory, fake friends, stolen pictures, and anything else that might better help sell the lie.

FREE TRIAL

Learn More

Those who catphish do so to play cruel jokes or to carry on romantic relationships, the latter of which being the premise of the MTV program Catfish: The TV Show and is seen in several story lines of TLC’s hit series 90 Day Fiancé.

Yet catphishing is not only used for social deception. It is often incorporated into financial scams for the purposes of protecting the scammer’s true identity and making the scam appear believable. As the purpose of catphishing is to avoid cursory investigation, this can make it a nightmare for online companies that rely on customer verification.

One of the most frustrating aspects of cybersecurity is the fact that given how connected the internet makes most facets of our everyday lives there are so many ways for creative hackers to get what they need.

When a company must know that their customers are who they say they are, various options can be employed with varying levels of success. Examining the pros and cons of each option will help you decide which methods would best serve your online business and customers.

Even better, businesses should consider combining or “layering” several different verification methods together. This can be done easily, and without comprising too much usability in the customer experience.

Two-Factor Authentication

Two-Factor Authentication, or 2FA, is a popular method of customer verification that requires two methods of authentication usually consisting of the standard username and password, as well as something that ostensibly only the customer would have access to.

If you’ve ever tried to access banking information from a different computer than you normally use, you’ve probably been prompted to enter a numeric sequence sent via the phone, email, or by text, that’s 2FA. The extra level of security comes from the fact that the secondary piece of authentication is sent to a device that only the customer is expected to have access to.

The problem is that more adept hackers can simply intercept the codes as has been the case of malware developed by a hacking group nicknamed Rampant Kitten. They can also make use of account-recovery systems to effectively bypass the issue altogether.

Some industrious hackers have even been known to adjust their target’s phone carrier plans to transfer or port the number to a new account and thus gaining access to the customers’ authentication codes.

Knowledge-Based Authentication

If you’ve ever been asked a security question, you’re familiar with Knowledge-Based Authentication, or KBA. The idea behind KBA is that if you choose an answer to a question that only you would know, it would theoretically mean you are indeed you. Examples of KBA questions include “What was your elementary school?” and “Where did you spend your honeymoon?”.

Unfortunately, on its own, this method is far from foolproof. For one thing, this method may be a reasonable deterrent for strangers, but perhaps not for those who know your customer such as a friend or family member.

Additionally, data breaches beyond a customer’s control have disseminated a deluge of private information ripe for fraudsters. Twenty years ago, Social Security numbers were closely guarded secrets, yet with numerous banking and lending institutions becoming the victims of cyberattacks, millions of Social Security numbers, credit card numbers, birthdays, addresses, etc. are on conveniently cataloged lists available for purchase in the seedier sections of the web.

Moreover, questions about your customers’ pets’ names or hometowns that may have been more secure before the advent of social media lose all security value when you can type a person’s name into Facebook and get what effectively amounts to an outline of someone’s life.

Credit Bureau-Based Options

The big three credit bureaus (TransUnion, Experian, and Equifax) maintain sensitive information on nearly everyone in America.

FREE TRIAL

This makes them a prime point of reference for customer identity verification. If the information supplied by the customer matches the consumer credit data on file with the credit bureau, it serves as authentication.

The problem with this method of authentication is that, as previously discussed, just because someone has personal information about the customer, it doesn’t mean that they are in fact the customer. It also has the major downfall of not being useful for your customers who don’t have any credit history.

Additionally, these credit bureaus are targets of attacks themselves with the notable 2017 Equifax data breach affecting nearly 147 million people.

These significant drawbacks make credit bureau-based solutions better as a supplemental verification method and only for certain customer bases.

Data/Social Media Authentication

Data and social media authentication will ask customers to authenticate themselves by signing into another account (an account to which only the customer supposedly has access) as proof that the customer is who they say they are.

It works by attaching one’s online ID to find a match on a website like Facebook or Twitter, or a database of offline information, or even behavioral patterns.

Where this method falls short is that it is much more adept at detecting bots than it is at detecting fraudsters. It is not difficult for fraudsters to fake a social media background, which only adds to the fact that it also doesn’t have a reliable way to verify the fact that the person inputting the information is the person the information belongs to.

Additionally, customers without social media access (think Facebook in China) are cut off from this form of authorization, resulting in your potentially abandoning a large segment of customers.

Digital Image and ID Verification

All of these methods have pieces of strong cybersecurity but are bogged down by exploitable flaws that can render them almost useless against dedicated hackers.

Learn More

Online businesses need something more. They need ways to verify the person inputting the information is legitimately the customer to whom the information belongs.

This can be done using video ID selfies and selfie ID photos. There are verification protocols that require a potential customer to take a photo of themselves holding their government-issued ID to prove it is them trying to access their information.

As most people are unlikely to have a photo of themselves holding their ID on a social media platform, it becomes that much harder for a fraudster to fake. These pictures can also be cross-referenced with photos in trusted databases to provide even further verification.

Combining or “Layering” Verification Methods

One the best methods to account for all the pros and cons of various verification methods is to combine or “layer” one or more verification methods together.

For example, you could combine “Knowledge Based Authentication” (KBA) with “Two Factor Authentication” (2FA).

With this combination, your business would be able to check multiple commercial data providers, each with well over a billion unique customer records, to verify information about almost anyone — including in various countries around the world. If the information provided by the customer matches the commercial database information, the customer would pass your KBA check.

As part of the KBA check, you would also verify the customer’s cell phone number or email address. Then, you would send a code by text/SMS or email to the same verified number or email address.

FREE TRIAL

If the customer is able to provide the code sent to their verified cell phone number or email address, the customer would pass your 2FA check.

You could also add photo ID verification — or even video ID verification — to make it even harder for a fraudster to achieve their goal.

Combining or “layering” verification methods would be easy and familiar for your customers to use, but very hard for fraudsters to spoof. Konfirmi provides exactly such a solution to quickly and easily add multiple “layered” verification methods to any website or app.

Conclusion

There will always be a balancing act between vigilant protection of your services against identity theft and fraud, and the ease of use for legitimate customers. Falling too far in either direction can be disastrous for a business.

You must choose the right customer verification methodology to maximize security and minimize obstacles in the onboarding process.

Making use of the latest technology is one of the best ways to provide customers with an experience they can feel secure about. These solutions exist right now.

Customer Verification: Why Online Businesses Should Know Their Customers

The internet is rapidly changing how businesses interact with their customers and vice-versa. Businesses have been quick to realize the potential that the interconnectivity of the digital space provides, especially in industries such as e-commerce, finance, and social media. Customers are also quick to take advantage of the newfound convenience of online shopping from the comfort of their living rooms.

FREE TRIAL

Learn More

Until recently however, many consumers, businesses, and governments have been slow to realize the importance of customer verification. Proper customer verification can help prevent young people from accessing age-sensitive products and services, as well as prevent fraudulent transactions from taking place online.

Businesses and online merchants have various options in addressing this issue in order to help reduce risk, liability, and costs due to fraud and under-age purchases.

What is Customer Verification?

Customer verification is a process that is used by businesses with online products, services, or content to ensure that the information provided by their customers is correct and that the customers are who they say they are.

One of the most important benefits of customer verification is that it allows businesses to comply with government laws and regulations and adhere to guidelines set by regulatory bodies. Additionally, customer verification helps reduce risks of fraud or identity theft, as well as costs and expenses arising from incorrect or erroneous information provided by customers.

At the same time, customer verification helps protect users from fraudulent activities committed by other users, and helps keep the business’s customer base secure from bad actors.

For example, customer verification allows businesses to make sure that the customer is not a crook, but also to make sure that the delivery address for products or services was properly provided by the customer. In addition, customer verification allows businesses with age-restricted products or services to make sure their customers are old enough before the products or services are purchased or delivered.

This not only saves against fraud losses, but it also eliminates the cost of delivering products or services to the wrong address.

Customer verification also helps businesses comply with “Know Your Customer” (KYC) guidelines and anti-money laundering (AML) regulations in order to avoid fines and penalties from law enforcement, regulatory, and other governmental organizations.

What Companies Use Customer Verification?

Customer verification is vital for transactional businesses that operate online.

If a company doesn’t know with whom they are dealing, they could inadvertently sell products or services or divulge sensitive information to the wrong person, an underage person, or even a malicious party, along with a whole host of additional potential calamities.

In addition to the monetary losses and expenses, as well as potential liability to customers and even regulatory fines, the reputational injury could be crippling.

Finance and Accounting Businesses

Companies in finance and banking have quickly adapted to the internet. Today, users can create a bank account, get loans, and transfers funds through the internet. Because of this, governments require banks to comply with strict regulations to prevent criminals from taking advantage of the system by perpetrating acts of fraud.

Banks and other financial institutions are required to adhere to the strict KYC guidelines that require them to collect critical information from their customers and verify the information is correct, thereby preventing bad actors from engaging in money laundering or terrorist financing, creating fake accounts, and conducting fraudulent transactions.

Online Retail and E-commerce

Businesses and merchants who use the internet as a platform to sell and distribute products and services are often required by regulatory agencies and governments to comply with several customer verification processes as well.

FREE TRIAL

This helps safeguard customers while reducing the risk and potential liability of fraudulent transactions.

In addition, online retail merchants selling age-restricted products like alcohol, tobacco, vaping products, gambling, and marijuana, are required to verify the age of their customers before they can legally sell the products. Businesses that provide online services like adult or pornographic websites are equally required to screen their users to protect children from accessing the sensitive content of the website.

Businesses that fail to adhere to the guidelines set by regulatory agencies can face stiff fines and loss of licensure, not to mention reputational injury.

Social Media Platforms

Likewise, social media and social sharing platforms are increasingly using customer verification to stop fake accounts.

Social media platforms have been co-opted by everyone from scammers to national adversaries to political campaigns as a means of relatively cheap and easy mass communications. Governments and global communities are urging – and may soon require — social media platforms to set-up security safeguards to prevent fake news.

For their part, some social media platforms have taken steps to disallow obviously fake users or “bots.” Customer verification is one of the critical solutions to overcome this challenge.

Types of Customer Verification

Many governmental bodies – such as the United States, and the European Union — encourage or even require the use of “Multi-Factor Authentication”.

Multi-Factor Authentication (or “MFA”) identifies a person by using two or more pieces of evidence — or “factors” — regarding who the person is. These factors are: knowledge (something the user knows), possession (something the user has), and inherence (something the user is).

Learn More

Usually, a business with higher risks would want to use at least two factors to identify their customers.

For example, the business could ask the user to provide their email or mailing address and age (“knowledge” based factors), and also provide a code texted to the customer’s cell phone (the “possession” factor).

However, a business with lower risks might want to use only one verification method to provide ease of use by the customer, and prevent abandonment by the customer.

Most customer verification applications only allow one method to verify customers. However, Konfirmi offers several powerful verification methods that can be used alone or in combination with other methods, and can be easily implemented in websites and other online assets.

This allows a low-risk business to easily verify their customers with only one verification method, while also allowing a higher-risk business to layer various verification methods together and achieve greater certainty.

Age Verification

Age verification helps businesses to automatically verify the customer’s age before a shipment is made or a delivery is attempted. Konfirmi checks multiple third-party databases with billions of unique records, providing world-wide coverage.

At the same time, with Konfirmi, this verification method ensures privacy by not sharing the customer’s information with any third parties.

Cell Phone or Email Authentication

Cell phone or email authentication is a secure method that uses a code sent to the customer’s cell phone, email address, or both in to verify the identity of the customer. Because this verification method requires a unique and time-limited code that is sent to a mobile phone or email address before customers are allowed to complete a purchase, a hacker would have to know or have access to multiple aspects of the real user’s life.

Verifying that the person making a purchase has access to the actual customer’s cell phone makes text authentication a strong method to meet the “possession” factor for Multi-Factor Authentication. It is also a familiar and easy to use verification method.

Knowledge Based Authentication

Knowledge Based Authentication requires customers and users to submit critical information like full name, mailing address, home address, phone number, age, or email.

FREE TRIAL

Konfirmi allows you to choose which items of information you want to get from your customers.

This information is then submitted and verified through the use of third-party data providers that maintain billions of unique records and support world-wide coverage.

This verification method helps prevent identity fraud by requiring “knowledge” factors to identify the person making the purchase. In addition, this method also allows companies to verify the information provided by their customers, in order to prevent customer mistakes and erroneous deliveries of products or services.

Selfie ID Photo Verification

Photo verification helps companies prevent identity fraud by verifying the documents and information submitted against a live captured photo of the user.

Konfirmi has automated features that check the authenticity of the customer’s photo such as the time the photo was taken and the originality of the photo.

Other customer verification applications that compare a user’s photo or ID with online databases, or just compare the photo and ID with each other, often run afoul of facial recognition laws. For example, the Six Flags amusement park was sued for its use of facial recognition. In fact, Facebook recently paid $550 Million to settle a massive facial recognition lawsuit against the company.

In addition, a recent federal study confirmed that many facial recognition applications suffer from racial bias and inaccuracies. This can cause potential problems with false positives or false negatives in the customer verification process. More importantly, this can invite devastating lawsuits, regulatory problems, and reputational injuries.

However, with Konfirmi, the “selfie ID photo” verification method does not use facial recognition. Instead, it allows an easy way to automate ID verification, while also keeping your business free and clear of the lawsuits, regulatory problems, and reputational injuries associated with facial recognition.

Video ID Selfies

Video ID Selfies are a step up above the selfie ID photo verification. It allows businesses to set up their identity fraud prevention measures by using the built-in cameras in cellphones or webcams in computers to verify the identity of a customer.

Just like with selfie-photo verifications, Konfirmi has automated features that check the authenticity of the customer’s video such as the time the video was made and the originality of the video.

With Konfirmi, this process also does not use facial recognition. Therefore, Konfirmi prevents erroneous verifications as well as the many liabilities and other problems relating to facial recognition.

Conclusion

Identity fraud is a major problem facing our increasingly digital world. That is why customer verification applications like Konfirmi play an important role in protecting online commerce. You can start a free trial of Konfirmi today with no credit card required, and see the difference for yourself.

Identity Verification Tools Can Help Build Trust and Safety for Your Brand

Businesses in general cannot function without the trust of their customers. Customers will not trust a company that doesn’t keep them safe in the capacity in which they interact.

This is especially true for many “digital economy” and similar online businesses.

FREE TRIAL

Learn More

Whether the online business matches buyers and vendors (such as ridesharing, home sharing, contractor finders, freelancer finders, or the like), or matches like-minded people together (such as dating apps, travel buddy apps, or the like), establishing trust between parties is a major issue.

Online businesses that have risks of fraud, identity theft, or impersonation among their customer base need to be able to protect their customers from those with nefarious intentions.

Keep a Positive User Experience

Identifying users is certainly not something that every online business needs to do.

Some new users don’t want to be bothered with the text or other code transmission mechanisms necessary for two-factor authentication or “2FA”. Other users may not want to share the information necessary for knowledge based authentication or “KBA”. Still other users will not want to provide their driver’s license or passport to prove their identity.

Potential customers often have a lot of choices when it comes to online businesses. Something as simple as an unnecessary step in the onboarding process can be enough to drive them into the arms of a competitor.

Nevertheless, the business models of some types of online businesses involve significant potential for fraud, impersonation, or identity theft that could interfere with legitimate and intended users.

In addition, each “bad actor” creates reputational harm that could prove damaging to the company. Unchecked fraud that becomes frequent could even overwhelm the viability of the business model itself.

Establish Trust When it is a Necessary Part of The Business Model

Potential threats to an online business or customer-base can take many different forms depending on the industry.

Online businesses should review their business model for potential fraud, impersonation, and identity theft risks. If such risks exist, the business would be well served to make sure that all relevant users are who they say they are.

For example, the entire model of ridesharing is predicated on the fact that anyone with a suitable vehicle can make money giving rides to strangers. Because of the danger inherent in the fact that drivers with horrible driving records or even criminal intentions might falsely claim they are suitable, it is especially important that the app itself check the identity of its drivers and obtain background checks.

For this reason, the major ridesharing app companies – Uber and Lyft – both obtain background checks for all of their drivers.

However, many other types of businesses have issues similar to Uber and Lyft, but are not verifying identification or conducting background checks.

For example, according to a recent investigation, the larger dating apps do not conduct background checks on their customers, and most do not even have any identity verification method in place. According to the results of the investigation, even those that do are simply using Facebook or LinkedIn to verify identity.

FREE TRIAL

But Facebook and LinkedIn focus on eliminating bots and other fraudulent means of creating an account – they do not claim to actually ID their users.

Similarly, job seekers are constantly at risk of identity attacks. Fake job postings will ask for personal information knowing job seekers are in a somewhat vulnerable position and may be more accommodating as they are trying to put their best foot forward.

Moreover, most resumes contain a fair amount of a job seeker’s personal information. That is why sites designed to help connect job seekers with hiring employers should work hard to keep fake postings off of their sites.

Nevertheless, most job sites do not check the identity of supposed employers, or to make sure that they are legitimate companies.

The same is true in reverse.

Legitimate employers routinely use job sites to help with their recruiting and staffing efforts. However, many popular job sites only require a functional email address in order for a purported employee to post “their” resume, and do not do anything more to verify who the purported employee actually is.

In addition to job sites, many online businesses offer to connect people with contractors or freelancers for various purposes.

A simple internet search of these contractor or freelancer companies often reveals dozens of horror stories involving contractors or freelancers claiming to be someone who they are not (i.e., identity fraud), or instances of the actual contactor freelancer “subcontracting” the work to a different and cheaper person who does not have the advertised skill set or qualifications (i.e., impersonation).

Learn More

The same is true of food delivery services. Every time a customer has food delivered to their home, that’s another stranger that knows where they live. Delivery services should also ensure that their contractors can be trusted.

Leveraging Technology

For certain business models, the only way to maintain a trusted and safe platform is to sufficiently vet users as they are onboarded.

But the level of vetting should be tailored to the needs of the business. Heightened verification for onboarding new users may be overkill, and too frustrating for users in light of the level of risk involved.

In other words, even if an online business has significant potential fraud and identity theft risks, and verification of users is therefore priority, the user’s experience must also still be a concern.

Security is a major part of maintaining trust, but having a system that customers feel comfortable using can be as important for acquisition and retention. You don’t want to drive customers away right out of the gate.

The question becomes, how can businesses build trust from their customer base, while maintaining appropriate levels of verification, and still providing a smooth and efficient user experience?

The answer is by using a customer verification system that is versatile, and can easily accommodate different use cases, even within the same online business, and even within the same website or app.

One such customer verification system is Konfirmi.

Konfirmi allows businesses to easily verify their customer’s or user’s information, including:

– Name

– Mailing address

– Home address

– Phone number

– Email

– Photo IDs, such as driver’s licenses or passports

FREE TRIAL

in any app, user sign up or registration page, e-commerce store, contact form or survey, or other web-facing system.

The app does this by allowing businesses to choose from a number of different types of verification methods, such as:

Two-factor authentication or “2FA”
Knowledge-based authentication or “KBA”
Photo selfies, including photos of the customer holding up their ID
Video selfies, including videos of the customer holding up their ID

With Konfirmi, a business could use any one of these verification methods by itself. Selecting only a single verification method makes for an easy and quick user experience in onboarding.

Alternatively, various verifications methods can be combined together for greater assurance, when heightened risk factors are present.

Or, a business could use one type of verification method in one part of its app or website, but also use other combined verification methods in other parts of the same app or website.

The Konfirmi app is available “out of the box”, and can be set up in under five minutes. For more tailored needs, the app is also available in custom, white-label, and on-prem implementations.

Conclusion

In an age where users are becoming wearier of data breaches, impersonation, and identity theft, and are acutely aware of the reputation of a business, trust is a valuable resource.

At the same time, businesses must be careful not to drive away new users in their pursuit of security.

Finding the right balance is the only successful way forward. This entails making appropriate use of technologies available to streamline the user experience, while also protecting other users and the business’ reputation.

Age Gates Are Becoming a Thing of The Past

Websites that ask customers to enter their birth date or check a box to verify their age – also known as “age gates” — have been around for decades now.

With an age gate, a visitor to such a site is asked to put in their date of birth or otherwise represent their age before entering an age-restricted site or purchasing a product.

FREE TRIAL

Learn More

Nothing is done to check the information provided by the website visitor. They often serve as the only barrier to content and purchases that have legal age limitations.

The use of age gates has gained additional popularity with the rise of vaping, age-rated video gaming, online sports betting, pornography, firearms, and cannabis websites.

The problem (depending on your perspective) is that age gates are easy to fool. All an underage customer has to do is lie. It begs the question: Why use them at all? The short answer: It’s better than nothing.

For many websites, it’s more about the message having an age gate sends than the actual strength of the protection. What’s more, it is an inexpensive and easy to implement method of trying to cover a business’s bases. With the many types of age gate apps available, it’s not even something businesses need to create themselves.

Unfortunately, however, age gates are becoming a thing of the past.

Legal Compliance

In the past, age gating allowed the website owner to show governing bodies that the business took steps to avoid exposing minors to content or products they are not of legal age to consume. It puts the onus back on the consumer by requiring either verification or deception from the potential customer.

But age gates are no longer good enough in many places, and for many types of products. For example:

An age gate is not enough for tobacco and nicotine vaping sales in California.

More specifically, in order to sell tobacco and nicotine vaping products in California, the seller has to “match the name, address, and date of birth provided by the customer to information contained in records in a database of individuals whose age has been verified to be 21 years or older.” In addition, under California law, the seller has to “also verify that the billing address on the check or credit card offered for payment by the purchaser matches the address listed in the database.”

Likewise, for online sales of wine or liquor, age gates are not enough in many states. Most states require that the buyer present valid government issued identification to prove they are of age, which definitely precludes the use of an age gate. Some states — like Michigan, Georgia, and Ohio – require online sellers to use an identification verification service at the time of ordering, in lieu of requiring valid government issued identification, but an age gate would not suffice.

In addition, throughout the United States, it is now illegal “to sell any tobacco product — including cigarettes, cigars and e-cigarettes — to anyone under 21.” The retailer is responsible for any sales of such products to underage customers, and the penalties can be quite costly. Effectively, this means that relying on an age gate alone is a big risk.

In this vein, with regard to flavored e-cigarettes in particular, the United States Food and Drug Administration (FDA) stated it would prioritize enforcement against sellers that do not use an “independent, third-party, age- and identity-verification services that compare customer information against third-party data sources.”

Likewise, in Canada, the national government regulator opined that “simple self-attestation of age” – meaning an age gate – is not enough to comply with the country’s laws against cannabis sales and marketing to minors.

FREE TRIAL

Similarly, Great Britain, Holland, and Germany, and other countries prohibit online gambling and sports betting by persons under 18 years of age, and age gates are not enough to confirm age.

Moreover, many countries require age verification to view online pornography. In most cases, merely self-certifying age is not enough.

The above examples are indicative of a worldwide trend, not to mention in various states just within the United States, that is decreasing the continued viability of age gates.

Problems Even When Age Gates Are Still Allowed

Even when selling age-restricted products to people in places that still allow age gates, the fact remains — most people lie on age gates.

In fact, people who don’t strictly “need” to lie on age gates still do so. Customers have neither an obligation nor a tangible incentive to tell the truth. So, most of them don’t.

It’s often easier to fill out the age gate form with random information. For example, if a company’s age verification system uses dropdown boxes, it is often simply faster to select a birthdate of 1/1/1900 or the like as opposed to searching for and entering the accurate information.

In addition, some people are hesitant about sharing that sensitive piece of birth date information so early in their relationship with a new company. Incidentally, people don’t need to be that concerned. Because companies know that everyone lies on age gates, they almost always don’t actually use the birthdates provided as viable information. And consequently the sites that use age gates are not going to be valuable targets for serious cybercriminals.

All of this is a long way of saying that, if a business is required to verify age, but is only using an age gate, the business is not reliably verifying anything.

Viable Options For Age Verification

The primary drivers for using age gates are: (1) low cost; (2) ease of setup and configuration; and (3) ease of customer use.

All of these factors are met with applications like Konfirmi.

Learn More

First, Konfirmi has a very low cost. The app does not have any monthly fees or usage minimums. Instead, Konfirmi charges only $0.019 – only about 2 cents – per use.

In addition, for age verifications with third-party data sources, Konfirmi encourages its customers to buy direct from several different data providers, which further reduces costs. Konfirmi also provides a way to combine multiple third-party data sources together, but the cost of this feature is not high either.

Second, Konfirmi is very easy to set up. The apps website contains a video showing Konfirmi being set up in only about 4 minutes.

Third, Konfirmi is no more intrusive to your customers than an age gate! The app pulls information directly from your website’s purchase or age verification form, and then gets the consents required under various countries’ laws. That’s it!

Konfirmi allows you to easily verify your customer’s age over the internet by cross-referencing the information with billions of records maintained by multiple reputable third-party data providers.

Products like Konfirmi provide low-cost and low-overhead age verification. And they are also easy for website visitors to use.

Conclusion

By any reasonable standard, age gates are something of a paper fortress. The fact that it’s effectively just “for show” means that your customer’s age is really not being verified at all.

For this reason, websites can no longer use age gates for many different types of products and services and in many states in the United States, or in the United States as a whole, or in various other countries. Even when age gates are still allowed, it is just as easy and inexpensive to implement and operate an application like Konfirmi as it is to use an age gate.

As the reasons for retailers of age-restricted products or content to stay with age gates start to melt away, age gates are quickly becoming a thing of the past.