 shows that 81% of customers view biometrics as the more secure form of identity verification compared to passwords. So why, then, have some businesses been reluctant to implement passwordless logins? 

As biometric technologies become increasingly commonplace in online authentication and identity management, it's important that businesses properly evaluate solutions to ensure that personally identifiable information is protected against mounting privacy and security threats. 

Over the course of this article, we will highlight some of the privacy risks associated with biometric data, and look at how companies can use privacy-enhancing technologies (PETs) to make it safer to store biometric data while complying with cross-jurisdictional data protection laws.

What are the privacy risks of storing biometric data?

As mentioned above, data breaches are a very real threat and have the capacity to affect 

While much of the focus on data breaches tends to be on “written down” customer information (passwords, email addresses, telephone numbers, etc.), skilled hackers also 

Biometric data such as fingerprints are immutable and cannot be altered. As such, biometric data theft is far more dangerous than a standard password leak, as its could have wide ramifications for the person who has been hacked. 

Biometric data theft can pose a legitimate security concern, as a well-equipped and highly funded group of hackers could create a 

 to unlock any device or account that is linked to the hacked user. 

Due to the sensitive nature of biometrics, there are a number of policies around the world that govern how biometric data is collected, stored, and used. 

What are the regional differences in biometric legislation?

, the European Union leads the way when it comes to data protection regulation, and biometric data is no exception.

“special categories of personal data”

, the General Data Protection Regulation (GDPR) establishes that it is forbidden for any company to share the biometric data of EU citizens and long-term residents with third parties without their consent. 

Legislation for the protection of biometric data also exists outside of the EU, with India and China, in particular, having 

 on what can and can’t be done with biometric data.

In the United States, meanwhile, there is no single unified law that regulates biometric data (or any type of personal data for that matter), with individual states deciding on their own policies. However, the state of Illinois does have the 

, which is the most expansive policy in the country.

In light of the current security challenges facing every online business, organizations are beginning to adopt an approach known as 

 to help keep customer data safe. This approach has seen businesses implement one of five emerging PETs to ensure that any personal data processed has been safeguarded to prevent it from falling into the wrong hands. 

As highlighted above, there are five emerging PETs that are vital for safely using personal data online. Large organizations that handle sensitive customer data - such as banks - use PETs to ensure that their customers' data remain safe.

As highlighted above, by using secure multi-party computation, Keyless removes the need to store or process biometric data. This greatly enhances the security of Keyless, making it a no-brainer when it comes to safeguarding the identity of your customers.

 enables organizations to safely implement Keyless into their business without breaching regulations and exposing themselves to compliance risk.

So what are you waiting for? Give your customers the joy of a smooth, frictionless, 

Biometrics: Solving data protection challenges

Physical SIM cards have been present in mobile technology since the beginning of the smartphone revolution. However, unlike phones of the past, Apple’s latest release, the iPhone 14 series, comes without a physical SIM slot. Instead, these handsets exclusively use embedded SIMs (eSIMs), which can’t be removed. This design change makes it easier for users to change providers, enables users to connect to more than one network, and allows for extra physical space on the phone to enhance the design.

However, as the SIM has traditionally been the gateway to any connected device, what does its removal mean for security? Account takeover, a form of identity theft involving hijacking a user's account, is an ongoing problem that 

 in 2021. Could eSIMs be the answer to preventing threats posed by malicious actors?

In this article, we’ll examine the benefits and drawbacks of eSIMs from a security perspective and discuss why financial institutions must remain vigilant to the threats posed by eSIMs and data security.

In recent years SIM swapping has become an increasingly prevalent fraud technique. SIM swapping involves cybercriminals tricking mobile phone carriers into porting a genuine user’s phone number into the criminal’s device. They will pretend to be the genuine user and say that their device has been lost or damaged. When asked to provide identification, the criminal will provide real information on the user - often either stolen beforehand or bought on the dark web.

Once the cybercriminal has convinced the carrier to transfer the number, they will then be able to conduct account takeovers across any accounts linked to the compromised phone number. 

With an eSIM, however, as there is no physical SIM card, a cybercriminal cannot fraudulently claim that the SIM card got lost or damaged - which negates the ability of criminals to carry out a SIM swap. 

Apple’s iPhone 14 series has been seen as a key driver for eSIMs, which follows the US government’s 

. However, while enhanced data security is one of the key driving factors for this switch, iPhones sold outside of the US still feature a physical SIM card slot.

One of the most significant changes with the eSIM-enabled iPhones is that users must sign into their Apple iCloud ID to activate the device. The logic behind this is that Apple iCloud passwords are more complex than standard Apple ID passwords, thus making them more resistant to brute-force attacks.

However, despite the increased security of Apple iCloud passwords, any system that relies on a password (including those that use temporary one-time passwords - OTPs) are still vulnerable. For example, Apple ID passwords can be leaked, breached, or phished from users through various email and keylogging scams.

As with all new technologies, it will take some time to understand the full scale of security vulnerabilities. This is because cybercriminals generally follow the path of least resistance, meaning it might only make economic sense to focus their attention on compromising eSIMs once they are more broadly adopted. In the UK, for example, the adoption of eSIMs has been somewhat slow, with only three major networks offering eSIMs without any caveats. 

However, with Apple being the largest mobile phone manufacturer in the US, with 

, the likelihood is that eSIM security will be heavily tested in the coming months and years. 

Why biometrics are more reliably secure than eSIMs

While eSIMs help negate SIM-swap attacks, embedded SIMs such as those found on the iPhone 14 still rely on typed Apple ID passwords and OTPs. For the ultimate level of security, organizations should be utilizing biometric security, which replaces access via typed passwords with access via biological features. By using behavioral or biological characteristics for access control, data is at far less risk of being compromised.

Passwords are the biggest driver behind account takeovers, yet 

 say that changing their password was the only action they took after experiencing an attack. By sticking with a typed password authentication method, users are keeping themselves vulnerable to further data breaches.

Here at Keyless, we don’t rely on SIMs to authenticate users and we don’t send OTPs anywhere because we know that one-time passwords can and will be compromised, no matter the method by which they’re delivered to the customer.

By combining our patented privacy-preserving facial biometrics with device verification software, we provide a multi-factor authentication solution that is resilient against SIM-swapping malicious actors who try to capture OTPs sent to the user’s device or accounts. 

Our passwordless verification method also offers straightforward yet effective biometric-based authentication solutions for all users, allowing them to simply look into the camera for access – no passwords, PINs, or OTPs required.

To chat with a member of our team and see our technology in action, 

Will e-SIMs help to eliminate threats or make account takeovers easier?

Over the past five years, a raft of global jurisdiction changes has forced multinational corporations to rethink their business practices regarding data handling. 

Following the implementation of the European Union’s GDPR in 2018, a wide range of countries across the globe began to implement variants of data protection rules. The challenge for any global organization is to be aware of and remain compliant across multiple jurisdictions.

Throughout this article, we will provide a snapshot of data laws, analyzing how data protection rights are handled in different regions of the world and how these laws are driving the adoption of privacy-enhancing technologies. We will also be taking a look at what happens when companies fail to comply with changes to data protection laws.

Understanding data sovereignty, residency, and privacy

There are three main terms that are important when understanding how data protection works and the nuances associated with the topic. These are as follows:

A common example of data residency is when a company chooses a particular location to base itself in - typically, this is done in order to take advantage of a better tax regime. 

Businesses will then often be required to prove that they are predominately doing business and storing data within the borders of their chosen data residency in order to enjoy the benefits of their chosen location.

Every region has a different approach to how data is governed; for example, in Europe, data is governed and protected by the European Union under the General Data Protection Regulation (GDPR), which serves as a framework for how personal data is collected and processed from individuals who live both inside and outside of the EU.

What does data regulation look like around the world?

Outside of Europe, several differences exist in how each region (and sometimes even individual countries within the same region) handle data.

60% of countries in Africa have data protection and privacy legislation, with 20% reporting no legislation whatsoever. 

Meanwhile, in the Middle East, most nations have at least a draft form of legislation (Saudi Arabia & UAE, for example, have draft privacy and data protection legislation in place). However, as with some parts of Africa, Islamic countries operate under Sharia Law which has multiple principles regarding the divulging of personal secrets. Under the realm of privacy, Islam considers the safeguarding of people’s privacy as not only an individual duty of all people but also as the Islamic state and government’s obligation. Any violation of privacy is illegal.

Like in Africa, around 60% of countries in APAC have some form of data protection and privacy legislation. Of these, only Japan, New Zealand, and South Korea have adopted laws similar to Europe’s GDPR. 

Meanwhile, Australia has a system known as the Australian Privacy Principles (APP) that covers collecting, using, and disclosing personal information. A breach of an APP is considered to interfere with an individual's privacy and can lead to a number of penalties. 

Canada is the only North American nation with GDPR-like data protection legislation, while the US has legislation on a state level only.

In South America, only three countries have successfully passed GDPR-like legislation (Argentina, Brazil & Uruguay), with Paraguay also in the draft stages of creating said legislation.

Central America meanwhile has data protection and privacy legislation across most of the region, however, unlike GDPR, Central American nations’ laws are independent laws that aren't recognized outside of their respective countries borders. 

Across the Americas, 75% of countries have some form of legislation in place with a further 10% implementing draft legislation.

How are regulations driving the adoption of privacy-enhancing technologies?

Due to the rise in data protection laws around the world, the need for privacy-enhancing technologies (PETs) has never been greater.

As outlined by the ICO, the UK government’s independent regulatory office that deals with data protection, PETs can help organizations operate under the concept of 

, which is a system, product, or business practice designed to protect personal data automatically.

In addition to data and privacy laws, the adoption of PETs throughout a product's research and development stage can help an organization minimize the cost and risk associated with a major data breach. For example, suppose data is stored incorrectly in a manner that isn’t fully compliant with GDPR or a similar regulation, in that case, a data breach could have wide ramifications for both the organization's customers and business as well. All customer personal data (including name and address) could be leaked onto the internet, whilst the company could face fines of up to 17 million euros or 4% of their annual turnover, whichever is greater. However, adhering to well-established privacy techniques such as encryption methods for passwords and other such information can make it harder (and sometimes virtually impossible) for data breaches to leak personal information in their entirety.

 of supporting the adoption of PETs, highlighting their potential to unlock innovation by enabling valuable data sharing and analysis whilst protecting the privacy and confidentiality of sensitive data.

What are the consequences of non-compliance?

While most countries have their own rules and regulations regarding noncompliance, the common theme that unites them all is that failing to comply with data protection laws will result in substantial fines and penalties for infringing individuals and companies.

For example, in Uruguay, failing to comply with the country’s data protection supervisory authority carries several punishments, which include warnings, fines, and even forced closure of a company’s database.

Meanwhile, in Japan, the maximum penalty for not complying with the Act on the Protection of Personal Information (APPI) can carry up to a year in prison. 

Ever-changing global data regulations are both driving innovation and the adoption of PETs as businesses seek to protect their organization from facing fines or being unable to operate in certain markets. 

 following the implementation of China's Personal Information Protection Law, companies are also wary of new legislation and the impact it might have on their business.

Rather than face fines or allow new legislation to potentially alter, threaten, or even 

, many firms will choose to cease operating in non-essential markets until a solution has been implemented or a suitable PET can be utilized to adhere to regulatory changes.

The regulations driving the adoption of PETs

The use of Buy Now, Pay Later (BNPL) platforms has skyrocketed in the past two years.

 have become household names in their own right, as consumers embrace the idea of being able to purchase expensive items without needing to pay upfront. 

In addition to the obvious benefits of being able to afford items that are normally beyond a person's purchasing power, BNPL platforms have gained significant popularity due to their relatively frictionless approach to providing short-term consumer credit lines. 

BNPL websites rely on scant few details from applicants and, in many countries, don’t require a hard credit check. And despite economical constraints from the ongoing cost of living crisis in the UK and Europe, the BNPL market shows little to no signs of slowing down – with some of the world's most recognized fintechs 

, recently introducing their own BNPL payment schemes.

Unfortunately, as with virtually everything online, the popularity of BNPL has also attracted the attention of nefarious groups. Fraudsters and hackers are exploiting the lack of oversight on these payment platforms. 

BNPL is expected to be a major contributor to global fraud losses, which are forecast to surpass 

. Over the course of this article, we will highlight how BNPL platforms can enhance security and prevent fraud from occurring on their platforms. 

When discussing BNPL fraud, it’s important to understand the 

Generally, onboarding processes for opening BNPL accounts tend to be less rigorous in terms of identity verification when compared to traditional financial institutions which are regulated. 

As such, it's easier for fraudsters to commit identity theft and fraudulently open a BNPL account using stolen personal information. It’s also lucrative for fraudsters to launch account takeover campaigns, aimed at compromising the login credentials and OTPs to hack into existing BNPL accounts. 

According to a recent report from Sift, the leaders in Digital Trust & Safety, account takeover (ATO) 

attacks on BNPL platforms have gone up 54% in the last year

 – with most stemming from compromised passwords and one time passwords (OTPs).

There are several tell-tale signs of BNPL fraud that BNPL platforms should look out for:

Due to most passwords and billing information being saved on a device or web browser that they’ve previously signed into, the majority of end users tend to stick to the same device when making purchases online. If an existing account has login attempts from a number of different devices, there is a greater chance that this account has been compromised. 

When compromising a BNPL account, fraudsters may attempt to order goods to a new address. If purchases are suddenly being sent to a new address, this is a strong sign that a customer’s account may have been hacked.

BNPL platforms should pay close attention to their customers' account order history, while also encouraging end users to review their order history if their personal data has been compromised. 

BNPL platforms should also look to re-authenticate a customer when an unfamiliar transaction occurs. Typically, a radical change in the type and price of the items purchased will indicate that an account has been breached.

There are four types of BNPL fraud that customers and BNPL companies should pay close attention to.

Account takeover (ATO) fraud is where a fraudster uses stolen credentials and personal information to hack into a genuine user's BNPL account. ATO attempts on a BNPL account may be secondary to email ATO and SIM Swapping attacks – which enable fraudsters to capture OTPs sent by the BNPL account during authentication. To make matters worse, many customers typically use similar, easily guessable, or 

Similar to an account takeover, identity theft will involve a criminal using stolen personal information (emails, passwords, identity documents, addresses) obtained from another data breach) to open an account with a BNPL platform like Klarna. Identity theft can go further, in some instances fraudsters use stolen passports, driver’s licenses, bank cards, and mobile phones to set up new BNPL accounts and make purchases using the stolen identification.

This type of fraud is not too dissimilar to identity theft, whereby a fraudster will set up a new account to make illegitimate purchases. However, synthetic fraud differs from identity theft because the information used to set up the account is typically fake.

Friendly fraud refers to BNPL purchases often made by friends, family members, and young children that have accessed a customer’s device and made a purchase without the owner of the account being made aware.

What is Keyless & how can it help prevent BNPL fraud?

While BNPL fraud is alarming, it is possible for BNPL platforms to enhance their fraud prevention strategies by eliminating credentials, which are easily compromised, from the authentication journey. 

One of the best ways to prevent BNPL fraud is 

, the world’s most advanced passwordless authentication solution. Keyless enables BNPL platforms to enhance security by replacing credentials with biometric authentication. 

Biometrics have been proven to be safer and more secure than passwords and OTPs, both of which can be easily compromised with the right technology. With Keyless, customers are authenticated using a combination of 

and background device verification checks that help to ensure that login attempts are coming from a known device.

In this way, Keyless offers frictionless strong authentication during authentication, or 

whenever a high-risk purchase or action is made

Keyless also integrates with major eIDV/KYC vendors, helping to close the assurance gap between identity verification and customer authentication. Thanks to these integrations, Keyless is able to offer high assurance that the real person is logging in or attempting to make a purchase – making it difficult for fraudsters to use stolen personal information to open or hack into an account. 

, now is perhaps the best time to consider enhancing your authentication strategy by switching to a passwordless solution. 

How to protect against Buy Now, Pay Later Fraud with Keyless

In recent years, account takeover attacks have become more prevalent than ever, with fraudsters closing in on the financial services sector with new ways to defeat multi-factor authentication challenges.

In this blog, we’ll look at three emerging methods fraudsters are using to bypass multi-factor authentication and execute account takeover fraud, as well as how businesses can effectively mitigate these emerging threats. 

Despite the roll out of strong customer authentication, in 2021, 8

4% of financial services firms experienced account takeover attacks

. According to studies from Juniper, that number is only set to rise, 

with losses forecast to surpass $206 billion by 2025

Rather than being deterred by the improvements to authentication security, attackers are simply inventing new ways to capture multi-factor authentication (MFA) credentials, such as OTPs, to execute attacks. 

We’ll now look at the techniques listed below that fraudsters are frequently using to bypass MFA security:

SIM swapping is a major concern for financial firms and cryptocurrency exchanges, with attacks becoming more frequent and pervasive, increasing by over 400% the last five years in the United Kingdom. 

To carry out a SIM swapping attack, fraudsters exploit compromised and leaked personal information to impersonate legitimate customers and transfer legitimate phone numbers onto new, fraudulent SIMs.

Once a new SIM is activated on a fraudster's device, they will receive OTPs meant for the customer. They will then often use these to bypass and disable MFA, make fraudulent payments, and launch further attacks on the victim’s accounts and contacts.

According to the European Union Agency for Cybersecurity, 

there are specific circumstances that open the opportunity for SIM swapping. These include

It goes without saying that these attacks can have serious financial repercussions for victims. Last year, 

Canadian police arrested a teenager for stealing a staggering $36 million from a single victim through a SIM-swapping attack

, and in Europe, criminals leveraged SIM swapping methods to 

steal over $100 million from US celebrities.

Another advanced method being used to capture OTPs are reverse proxy scams. Reverse proxy scams are a type of man-in-the-middle phishing attack that enable fraudsters to steal (MFA) credentials and session cookies from victims without the victim’s knowledge. 

To execute a reverse proxy scam, attackers intercept a victim’s credentials using a proxy web server that essentially acts as a layer between the victim and the website they’re attempting to login to. 

Microsoft announced this year that approximately 

10,000 organizations had been targeted with fake Microsoft Office login pages

. The campaign led the user to an attacker-controlled proxy site that sat between them and the server they were attempting to log into.

Reverse proxy scams like these use a number of advanced steps to capture genuine MFA credentials:

Unfortunately, these attacks can be especially insidious, as targets are often completely unaware that they’re being hacked, until it’s too late. Exacerbating the problem, b

ad actors can now purchase “phishing kits” online to execute such attacks 

– meaning you do not necessarily have to have the technical skills to launch attacks. 

The popularity of BNPL platforms, like Klarna and Clearpay, has recently exploded, 

with BNPL customers now exceeding 360 million globally

The adoption of BNPL payments has created an unprecedented opportunity for fraudsters, who are taking advantage of weaker security standards adopted by BNPL services and their retail partners.

Bad actors are attracted to BNPL accounts because there’s more opportunity to execute an account takeover attack. 

ATO attacks on BNPL accounts can be executed either by:

The latter method generally requires less effort as online retailers have weaker authentication standards compared to financial platforms and apps – meaning 2FA is often not required. 

Fraudsters can compromise a genuine customer's account either by purchasing compromised credentials online or by running automated credential stuffing or credential cracking attacks. 

According to recent research from Imperva, 

64.1% of account takeover (ATO) attacks make use of bad bots (software applications that run automated tasks such as credential stuffing)

, meaning they can execute these kinds of attacks en masse. 

Luckily, there’s a simple way for financial firms to protect their customers against these emerging threats, and that’s by eliminating passwords entirely – whether temporary or saved – from login and payment authentication flows altogether.

By eliminating all credentials, whether a password, PIN, or one-time code, businesses can effectively reduce account takeover threats caused by compromised credentials, phishing, and man-in-the-middle attacks to zero. 

By replacing passwords and OTPs with our advanced passwordless solutions, Keyless provides the ultimate protection against ATO attacks. Since there’s nothing to steal or phish, we help financial firms protect their bottom line and brand reputation, while simultaneously protecting their customers from the financial repercussions of fraud and cybercrime. 

3 ways hackers are bypassing MFA to commit ATO fraud

Between October 2020 and May 2021, nearly 

7,000 US consumers reported financial losses from cryptocurrency scams that totaled over $80 million

, a 1,000% rise from the previous six months.

Attackers are also becoming bolder, carrying out larger and more complex heists. In December 2021, BitMart – marketed as ‘the most trusted cryptocurrency trading platform’ – experienced a hack where approximately 

$190 million in assets was stolen from user accounts

In this blog, we’ll look at how Keyless can help exchanges stop account takeovers caused by compromised and weak credentials and SIM swapping.

Compared to traditional financial institutions, fraudsters are attracted to crypto exchanges because there’s a greater opportunity to steal funds without being caught, due to a lack of industry and regulatory oversight. 

Despite this oversight, a major attack can still have serious reputational and financial repercussions for an exchange. While not obliged to pay users back, in a bid to restore its reputation, 

BitMart promised to reimburse victims, costing it upwards of US $150 million

As well as this, the hack had operational consequences, with the exchange being forced to halt withdrawals until it identified the source of the attack, disgruntling customers even further. 

Often, the reputational and financial repercussions extend beyond the targeted exchange and its victims, causing a ripple effect that takes a toll on the entire crypto market. 

In 2016, the price of bitcoin fell 20% overnight after hackers stole 120,000 BTC

 (worth approximately US $2.3 billion) from Bitfinex, a Hong Kong-based exchange. 

,  attacks on Binance – the largest exchange in terms of trading volume – caused the price of BTC to fall once again, followed by an SEC probe. 

Likewise, the more recent BitMart attack has led to a probe by the FTC, 

. If the FTC discovers that BitMart misled its users over its security protections or didn’t comply with the law, this will have a major impact on consumer and regulator trust. 

Why authenticator apps and OTPs are failing the cryptocurrency industry

For years, cryptocurrency exchanges have enforced multi-factor authentication to protect users from attacks, mandating the use of authenticator apps, like Google Authenticator, or SMS 2FA. But with the evolving sophistication of cyber fraud and scams, hackers are finding ways around these security layers. 

In a display of this type of 2FA’s fallibility, in January 2022, 

 and stole $36.4 million in user funds, with over 483 accounts being affected.

To execute 2FA attacks, threat actors leverage stolen personal data and credentials to hack into an email account or steal a victim’s phone number, which enables them to fraudulently capture OTPs. Hacks like these are skyrocketing, with the 

FBI reporting over 1,600 SIM swap complaints in 2021, resulting in losses totaling over $68 million. 

In theory, third-party authenticator apps, like Google Authenticator, put a stop to threats from SIM swapping and email account takeovers, as they require the attacker to have access to the user’s mobile phone. However, bad actors have adapted methods to capture OTPs generated by apps.

One approach is to use reverse proxy websites that trick users into imputing genuine OTPs into a scam website, enabling fraudsters to gain access to private accounts by using them in real time. It’s also becoming easier for hackers to implement OTP bots and malware scripts designed for mobiles, which enable hackers to mimic mobile push notifications and applications, and combine them with email or automated phone calls to gain OTPs from unwitting users. 

, in the 2019 attack, hackers were able to bypass its 2FA systems by “

accumulating user account credentials over a long period of time

using Unicode domains, looking very much like binance.com

” that enabled hackers to capture the user’s OTP. 

After acquiring these user accounts, the hacker then simply created a trading API key for each account but took no further actions, until yesterday. Yesterday, within the aforementioned 2-minute period, the hackers used the API keys, and placed a large number of market buys

Passwordless authentication as a solution for crypto exchange security

When done properly, passwordless offers superior protection against account takeover attacks because bad actors have nothing to steal – no passwords, PINs, OTPs, or recovery seeds – that would enable them to otherwise fraudulently bypass authentication. 

Instead, passwordless solutions enable exchanges to:

However, not all passwordless solutions offer the same level of security, privacy, or consistency in terms of user experience. For example, magic links and social login have the same security risks associated with 2FA; and, due to multi-device limitations, passwordless solutions like FaceID don’t stop attackers from using stolen personal data and credentials to enroll for biometric authentication on other devices.  

As mainstream adoption of cryptocurrency increases, account takeovers targeting exchanges will continue to rise. To combat these risks, exchanges need to move away from legacy multi-factor authentication solutions that rely on weak authentication methods.

With our advanced passwordless solutions, Keyless addresses the issues of OTPs, passwords, and magic links by removing them entirely from the authentication journey. 

Instead, we provide strong authentication with a simple look into the camera by combining our patented privacy-preserving facial recognition software with invisible device verification, anti-spoofing, and liveness detection. 

Our privacy-preserving capabilities make it possible for cryptocurrency exchanges to identify genuine users via biometric authentication, without any risk to their biometric data or identity. In doing this, we eliminate the vulnerabilities of knowledge-based authentication and legacy 2FA, helping exchanges to strengthen their compliance posture and protect their brand reputation.

Why 2FA is failing to protect cryptocurrency exchanges from account takeover hacks

 gives decision makers a view of how a technology or application will evolve over time, providing a sound source of insight to manage its deployment within the context of their specific business goals.

This year’s Hype Cycle identifies Keyless as a sample vendor in the field of  Biometric Authentication. You may access a complimentary copy of the report 

According to Gartner, solutions like Keyless will:

Our privacy-preserving biometric authentication solutions enable businesses to seamlessly authenticate users without undermining privacy or security needs. 

Gartner, Hype Cycle for Digital Identity, 2022, 25 July 2022, Felix Gaehtgens. 

GARTNER and Hype Cycle are registered trademarks and service marks of Gartner, Inc. and/or its affiliates in the 

U.S. and internationally and are used herein with permission. All rights reserved. This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from SIFT. 