Welcome back to our Smile for AI series, where we continue to unravel the rapidly evolving world of facial biometrics. In this installment, we explore a pressing question: Why is facial biometrics gaining such significant traction right now? After all, commercial application of the technology has been around for decades. From headline-making litigation like BIPA to the growing sophistication of deepfake technology, the landscape is shifting quickly. Let's dive in.

The public's desire for biometric solutions in everyday life is evident. For instance, 73% of airline passengers are now willing to share their biometric data to streamline airport processes​​, a significant increase from 46% in 2019. Moreover, 56% of U.S. adults trust law enforcement to use facial recognition responsibly​​. These statistics indicate a growing acceptance and trust in facial biometrics.

Deepfakes and related technologies, such as face swaps and generative adversarial networks, are becoming increasingly prevalent. In 2022, attacks involving these technologies surged by 149% from the first to the second half of the year​​. This alarming trend highlights the need for more robust and effective biometric systems. However, the performance analysis of state-of-the-art deepfake detectors shows a worrying variance in efficacy, ranging from 97% down to 30%.

The BIPA Litigation Wave: A Catalyst for Change

Last year saw a huge surge in biometric litigation under the Illinois-based Biometric Information Privacy Act (BIPA). While this is of course a US-based case, the US is often seen as a pioneer in both technology and its regulation, meaning that legal precedents set there often influence global norms and policies.

An astonishing 74 of 182 total lawsuits filed under BIPA sprouted in just two months from December 2022 to February 2023​​. This legal spotlight has not only heightened public awareness but has also pushed companies to reconsider their biometric data practices. With big tech giants like Facebook, Google, and Snapchat settling BIPA cases for a whopping $203.5M​​, the message is clear: the legal implications of biometric technology are vast and critical.

Legislative and Technological Developments

On the legislative front, the EU is poised to enact the Artificial Intelligence Act by spring 2024, which includes provisions against the unauthorized use of biometric data​​. Technologically, we're seeing innovations like the Pan-European Entry/Exit System, set to replace traditional passport stamping with facial biometrics by the end of 2023​​. Companies like Eurostar, the channel tunnel train operator, are also adopting these systems for cross-border travel.

The Path Forward: Navigating Challenges and Opportunities

As the technology advances and becomes more accessible, creating basic facial deepfakes has become easier due to open-source frameworks and tutorials. This presents a dual challenge of ensuring robust security while maintaining ethical standards. The rulings of Illinois' supreme court, affirming individual penalties for each BIPA infringement, underscore the legal seriousness of these concerns.

Facial biometrics is at a crucial juncture. The demand and enthusiasm for its benefits in security and convenience are counterbalanced by concerns over privacy, legal compliance, and the threat of deepfakes. As we continue to navigate these waters, the importance of responsible innovation and rigorous compliance cannot be overstated. The future of facial biometrics hinges not only on technological advancements but also on the industry's ability to align with ethical standards and legal requirements.

In our next blog, “The Many Faces of Innovation” we turn our focus to the expansive use cases of facial biometrics. From national eID systems in countries like India to enhancing security at borders and in law enforcement, we explore how this technology is reshaping identity verification. We'll also delve into its role in customer onboarding and mobile payment security, highlighting the industry's innovative approaches amidst evolving privacy and regulatory landscapes.

Smile for AI Blog Series: Why Now?

To kick off the new year with excitement, we're thrilled to introduce our new blog series, "Smile for AI". Throughout Q1 of 2024, we'll delve into the factors fueling its popularity, draw insightful comparisons with other biometric methods, and highlight the most impactful use cases. Stay tuned for a captivating journey into the fascinating realm of AI and facial biometrics!

Even within the rapidly evolving world of cybersecurity, facial biometrics has truly become a cutting-edge technology rapidly transforming how we approach identification and security. According to leading digital identity strategy firm Liminal, the facial biometrics market is not just growing—it's booming, with a projected value of $42.1 billion by 2028.

Driven by widespread adoption in both the public and private sectors, facial biometrics is at the forefront of technological innovation. However, this journey isn't without its challenges. The evolving global regulatory landscape and the rise of AI-generated deepfakes and spoofing technologies present hurdles that the industry must navigate. 

Nonetheless, the demand for seamless and secure identification processes, especially among younger consumers, continues to propel this market forward. In this blog, we will cover the basics of the facial biometric process - what happens, and when.

The journey begins with the capture of an individual's facial images using devices like cameras, webcams, or smartphones. This step is crucial as it lays the foundation for further processing.

Once captured, these images undergo preprocessing. This involves enhancing image quality by removing noise, cropping, resizing, and filtering, ensuring the data is primed for accurate analysis.

Normalization follows, where images are adjusted to a standard scale. This step prevents certain features from dominating others, maintaining a balanced analysis.

Now comes the detection and alignment phase. Algorithms work tirelessly to identify the position and orientation of the face, aligning it to a standardized format. This consistency is vital for accurate feature extraction.

Here, the system identifies distinct facial landmarks. The distance between the eyes, the shape of the nose, and the curvature of the lips are meticulously analyzed using both 2D and 3D modeling.

The extracted features are then transformed into mathematical templates. This involves several normalization processes like adjusting pixel intensities (gray level normalization), correcting for light impact (illumination normalization), and adjusting for position and scale (geometry normalization).

This final phase is crucial. The biometric system matches the created template against a database of pre-registered templates or a previously stored personal reference. This step is pivotal in determining identity or verifying a user's authenticity. The system uses sophisticated algorithms to calculate a similarity score. If this score surpasses a predetermined threshold, a match is declared; otherwise, it results in an inconclusive outcome. It's a delicate balance of precision and accuracy, ensuring reliable results while maintaining privacy and security.

The facial biometrics field is rapidly evolving, facing both technological advancements and challenges. Deepfake technology, which creates highly realistic and deceptive images, poses a significant threat to the integrity of facial biometrics systems. However, the industry is responding with advanced countermeasures, constantly improving the technology to stay ahead of such threats.

In the final stage, these templates are compared against a database of pre-registered templates or a stored personal reference sample. The decision hinges on whether the similarity score surpasses a predetermined threshold. If it does, a match is declared; if not, the result is deemed inconclusive.

As facial biometrics technology advances, so does its application spectrum. It's no longer confined to traditional security realms; it's making waves in areas like mobile payment authorization and digital onboarding, providing a frictionless user experience. This expansion, however, brings to light the critical issue of regulatory compliance. With legislation like BIPA influencing the industry, facial biometric vendors are compelled to adapt and innovate, ensuring their solutions are not only technologically advanced but also legally compliant.

Despite these challenges, the demand for facial biometrics remains robust, especially in public-facing industries that prioritize secure and seamless identity verification. The technology's ability to provide enhanced security while offering a user-friendly experience is a key factor driving its adoption. It is a testament to the technology's potential and its critical role in shaping the future of digital identity verification.

In our next blog, we will discuss "Why Now?" — an insightful look at the current landscape of facial biometrics. We'll delve into the reasons behind its rising prominence, fueled by headline-grabbing BIPA litigation, the growing challenge of deepfake spoofing, and the adoption of facial biometrics in public-facing industries for cross-border solutions.

Smile for AI Blog Series: What Really Happens When You Take That Selfie?

In today's digital world, verifying a user's real identity is crucial, not just when they first sign up but throughout their entire interaction with a service. With the rise of more complex threats using advanced technologies like automation and AI, businesses are finding it increasingly difficult to continuously confirm the authenticity of user identities. This situation highlights the need for more advanced methods to ensure identity security at all times, not just at the start.

KYC (Know Your Customer) is a process businesses use to identify their clients and prevent financial crimes. It involves verifying personal identification documents when a customer first registers. Though crucial, KYC is just the beginning of a comprehensive approach to maintaining identity security.

Why Continuous Identity Verification Matters

After the KYC process, identity fraud and account takeovers do not simply disappear. It's essential to keep verifying a user's identity as they use a service, to protect against sophisticated cyber threats that might not be caught by initial KYC checks. Ongoing identity verification is vital for security and trust, making sure users are who they say they are at every stage of their journey.

Key Strategies for Continuous Identity Verification

We’ve identified five key considerations we believe all businesses should keep top of mind when implementing ongoing identity verification checks.

Seamless Integration with Initial Onboarding

The process should smoothly transition from the initial identity verification done during onboarding. Using the biometric data captured at the onboarding step for continuous authentication is the most seamless and user friendly way to continually verify someone’s identity.

Dynamic Verification Across User Interactions

The system should be able to dynamically verify users at key interaction points — such as logging in, making high-value transactions, recovering accounts, or changing account details.

Combining multiple security layers, such as facial recognition that respects privacy, device verification, and liveness detection, can greatly enhance protection against unauthorized access.

Regularly comparing biometric templates ensures that the person interacting is the same as the one registered initially. But this must be done in a way that protects their privacy by not putting their PII at risk.

The system should help businesses adhere to the latest regulatory requirements related to data privacy and security. Within Europe, the GDPR puts several restrictions on biometric data - any data that leaves the device should not contain PII. The upcoming PSD3 will put further requirements on implementing Strong Customer Authentication (SCA) for digital payments.

As digital threats become more advanced, businesses must enhance their identity verification methods beyond just the first KYC steps. This involves implementing innovative strategies to reinforce identity security throughout the customer's entire relationship with the business. By doing so, companies can better defend against cyber threats, meet regulatory requirements, and provide a secure and smooth experience for users.

Continuous Identity Verification: Navigating the Digital Landscape Beyond KYC

Keyless Emerges as an Independent Entity: Brings Total Funding to US $26m to Stop Identity Fraud

The London-headquartered scaleup announces a mutually beneficial departure from Sift as it secures funds to accelerate adoption of its biometric authentication solutions beyond Europe

Keyless, the leader in privacy-preserving biometric authentication, secures an additional $6 million in funding from prominent European venture capitalists, led by Rialto Ventures. This funding injection elevates Keyless' total funding to $26 million, with previous backing from distinguished investors such as P101, Primo Ventures, gumi Cryptos Capital, and Ripple's Xpring.

Stefano Quintarelli, General Partner at Rialto VC, underscores Keyless' potential, noting, 

Keyless unifies the entire end-to-end identity lifecycle with privacy-preserving biometric authentication, helping to continuously assure the genuine identity of the user from the initial onboarding and account creation, through to step-up actions, transaction signing (including PSD2 SCA compliance), and account recovery. Its patented technology not only fortifies protection against account takeover attacks and identity theft but also ensures compliance with global data protection and privacy regulations, such as the GDPR.

Andrea Carmignani, co-founder and CEO of Keyless, emphasizes the shifting authentication landscape in Europe, stating, 

Thanks to its privacy-preserving cryptographic capabilities, Keyless can create universal biometric profiles that can be used to assure the identity of the genuine user at any point in the identity lifecycle without needing to store biometric data anywhere, delivering superior security while preserving user privacy. This addresses the challenge faced by vendors relying on device-bound biometric capabilities such as FaceID, which do not authenticate the genuine person behind the device, but rather authenticate the device itself, making it difficult to prove that it is the authorized account holder.

Carmignani highlights the need for a transition in authentication, stating, 

Server-side biometric solutions, which solve the identity portability issues with device-based authentication, come with the challenge of storing sensitive biometric data in centralized databases. Even if the data is encrypted at rest, it still represents personal identifiable information (PII) and poses a massive risk to the business. Emerging private-by-design solutions, such as Keyless, are solving this trade off and for the first time, enabling businesses to balance seamless user experiences with compliance needs and strong security.

This latest round is also the startup’s first as a newly independent company. In a strategic move, Keyless mutually agreed to separate from parent company Sift earlier this year. The separation comes after the two companies found that their respective products were best suited to servicing differing markets. 

Thanks to increasing adoption of its flagship Zero-Knowledge Biometrics™ technology, Keyless continues to lead the charge in privacy-preserving biometric authentication, with this latest funding serving as a testament to its commitment to reshaping the authentication landscape in a rapidly evolving digital era.

Keyless Brings Total Funding to US $26m to Stop Identity Fraud; Emerges as an Independent Entity

In the ever-evolving landscape of financial services, staying up to date with regulatory changes is crucial, especially when it comes to payment services. The Payment Services Directive (PSD2) has been a game-changer, introducing Strong Customer Authentication (SCA) and promoting open banking. 

Now, as the European Commission proposes to replace PSD2 with PSD3 and introduce the Payment Services Regulation (PSR1), it's essential to understand the implications for financial institutions, particularly banks, and how innovative solutions like passwordless authentication can help.

The most significant change introduced by PSD3 is the transition from a directive to a regulation. This means that most of the payment rules from PSD2 will fall under the Payment Services Regulation 1 (PSR1). Unlike directives, which can be interpreted differently by each EU country, regulations apply uniformly across all member states. This shift will lead to a more harmonized payments market with fewer differences and inequalities between countries. 

In addition to PSR1, PSD3 will focus specifically on licensing and authorization for payment and e-money institutions.

The changes aim to address the gaps and shortcomings identified in the previous version, PSD2. By modernizing payment services and opening up financial services data, PSD3 and PSR1 strive to ensure improved consumer protection, foster competition, enhance security, and build trust within the industry. The proposal seeks to streamline and standardize payments across the EU, making transactions more efficient and secure.

One of the significant updates introduced by PSD3 is the merger of e-money institutions and payment institutions, simplifying the licensing process and promoting a more efficient and competitive market. This consolidation aims to streamline operations and provide a more comprehensive regulatory framework for these institutions.

PSD3 proposes an implementation of a risk-based approach to fraud prevention, leveraging technologies such as IBAN and name matching. This measure aims to enhance security and protect consumers from fraudulent activities, ensuring a safer payment ecosystem.

PSD3 seeks to clarify and refine the requirements for Strong Customer Authentication, which aims to strengthen the security of online payments. By setting clear guidelines, PSD3 aims to strike a balance between security measures and user convenience, ensuring smooth and secure transactions.

Transparency is a cornerstone of the proposed changes. PSD3 aims to introduce transparency reforms that empower consumers with greater visibility into their payment transactions, fees, and charges. This transparency fosters trust and enables customers to make informed decisions.

PSD3 aims to enhance access to bank account services for payment institutions, promoting competition and innovation. By facilitating access to account information and payment initiation services, PSD3 aims to create a more dynamic and open financial ecosystem.

The proposed changes from PSD2 to PSD3, accompanied by PSR1, reflect the European Commission's commitment to modernizing payment services, improving consumer protection, and fostering innovation. The introduction of PSD3 will bring about significant advancements in the efficiency, security, and transparency of payments within the European Union. It is an important step towards shaping the future of the financial sector and ensuring a seamless and secure payment experience for all stakeholders involved.

The evaluation of PSD2 revealed that Strong Customer Authentication had a significant impact on reducing fraud, a clear win in bolstering the payment ecosystem's security. However, as fraudsters adapt, regulatory measures must follow suit. 

In our next blog, we’ll be looking closely at the evaluation of Strong Customer Authentication as well as proposed amendments to SCA under PSR1.

What you need to know about PSD3

The landscape of online fraud is undergoing rapid transformation, exposing both consumers and businesses to an array of malicious threats. 

 (ONS) has reported a significant uptick in fraud and computer misuse offenses over the past two years, with a staggering 

 stolen in the UK alone. Furthermore, a 2022 report by 

 highlighted that court-involved monetary fraud cases surpassed the £1 billion mark.

Beyond the immediate financial repercussions, businesses also face the long-term challenge of eroded customer trust, potentially tarnishing their reputation irreversibly. In this article, we delve into the predominant fraud trends of 2023 and offer insights on fortifying customer authentication practices to better protect consumers.

Key fraud trends of 2023: what to watch out for

1. The surge of account takeover fraud (ATO)

In 2023, the digital sphere is grappling with the increasing prevalence of 

 (ATO), posing severe risks for both businesses and consumers. This trend is partly attributed to the ongoing reliance on outdated authentication technologies, such as passwords and 

 (OTPs), which are highly susceptible to various attack vectors.

2. The escalation of automated fraud and AI exploitation

Automation and AI have revolutionized fraud, enabling cybercriminals to scale their operations and target a broader spectrum of potential victims. Tools like botnets have been instrumental in automating large-scale attacks on networks and online services, demonstrating the increasing efficiency of fraudulent activities.

 in an unprecedented credential stuffing campaign. Another r

 highlights how hackers are leveraging AI to adapt malware activity patterns in order to evade fraud detection systems.

These incidents highlight the sophistication and scale of automated fraud attacks in the current landscape. 

3. The evolution of social engineering threats

The past year has seen a notable increase in social engineering attacks, with phishing emails and impersonation scams becoming more prevalent. BrandShield discovered 

 fake websites impersonating UK retail banks in May 2023 alone, and there has been a 

 increase in phishing attacks over the past year.

Furthermore, vishing attacks, which utilize voice and telephone number spoofing technologies, have surged by 

 worldwide between Q3 2022 and Q4 2022. These trends underline the growing threat of social engineering attacks and the necessity for more robust authentication technologies.

4. The threat of deep fakes and digital injection attacks

With the advancement of AI technologies, fraudsters now have the ability to conduct sophisticated attacks such as voice scams and digital injection attacks. Criminals can generate synthetic voices ("deep fakes") to impersonate 

, and inject malicious data into secured systems to bypass biometric authentication measures.

AI and automation further amplify these threats, enabling attackers to conduct large-scale attacks and adapt malware activity patterns to evade detection from behavior-based cybersecurity technologies.

5. The rise of man-in-the-middle (MITM) attacks

MITM attacks are becoming increasingly common, with criminals intercepting communications between victims and authentication servers to 

 increase in MITM attacks between Q1 2022 and Q1 2023, highlighting the growing proficiency of attackers in exploiting vulnerabilities in customer authentication systems.

6. The ongoing issue of SIM swapping and rise of phone thefts

Despite being low-tech, SIM swapping and 

. Criminals exploit knowledge-based authentication systems to execute these attacks, and in some instances, they can even switch off biometric authentication systems to gain unauthorized access to user accounts.

The Telegraph reported that UK consumers have lost over 

 over five years due to SIM-swapping attacks. This alarming statistic underscores the urgency for adopting more secure and resilient authentication methods.

Strengthening defenses with passwordless authentication

As the threat landscape continues to evolve at an unprecedented pace, organizations must adapt and implement more robust authentication methods to ensure the security of their customers. Passwordless authentication emerges as a viable solution, offering a secure and user-friendly alternative to traditional password-based systems.

By utilizing unique physical characteristics for authentication, passwordless solutions eliminate the need for users to remember complex passwords, reducing the risk of account takeover and other fraud-related threats.

To explore how passwordless authentication can enhance your organization's security posture, we invite you to contact us for a 

Navigating the Evolving Fraud Trends Landscape in 2023

We’re excited to announce we’ve been featured in the newly published 

, the report offers invaluable insights into evolutionary trends in biometrics, strategic guidance for vendors, key differentiators for digital identity roadmaps, and an advanced market landscape reference model.

The report categorizes vendors into three distinct groups. Luminary vendors, like Keyless, represent the highest level of proficiency in their respective industry segments and are recognized as trendsetters and guiding lights in the field of biometric digital identity. 

In the report, Keyless is listed as a Biometric ID platform, as its technology enables companies to securely verify a user’s identity with their biometrics across different lifecycle stages – from onboarding to account recovery. 

The Prism report will evolve in tandem with the dynamic biometric digital identity landscape. The evaluations included in this report have been meticulously crafted through independent research, industry surveys, and consultations with vendors, researchers, and analysts.

Keyless Recognized in New Biometric Digital Identity Prism Report

We're thrilled to announce that Keyless has secured the prestigious '

' at this year's UK National Cyber Awards. 

The UK National Cyber Awards are a celebration of excellence and innovation in the cybersecurity field, bringing together leaders from across sectors. The event acknowledges outstanding contributions to the country's cybersecurity landscape.

This year's awards featured five categories, including the Prime Minister's Award for Cyber and The NHS Digital Award. With nominations pouring in, it's clear that cybersecurity's importance is on the rise.

Winning the ‘Innovation in Cyber Award’ reflects our dedication to advancing privacy-enhancing biometric authentication technology. In an age where data security and user privacy are paramount, our innovations have earned well-deserved recognition.

As the cybersecurity landscape evolves, we remain dedicated to providing cutting-edge solutions that empower organizations to protect their digital assets and user data. The recent win is a testament to our pivotal role in shaping the future of biometric security.

Keyless Wins 'Innovation in Cyber Award' at UK National Cyber Awards 2023

As the banking industry has become more digitized, social engineering scams like phishing attacks have become more common. Phishing campaigns see criminals create deceptive websites, emails and SMS messages designed to trick unsuspecting visitors into handing over knowledge-based authentication details. This threat is pervasive, with a study by BrandShield uncovering over 

 fake websites impersonating UK retail banks in May 2023. 

But it's not just user-generated passwords that are vulnerable to this type of attack. Even the security of One-Time Passwords (OTPs) is illusory. Even when OTPs are time-limited or generated from an app or hardware token, cybercriminals can still deploy phishing methods to intercept OTPs. 

In light of these vulnerabilities, this article should serve as a reality check for financial institutions using OTPs for authentication. It will explain how these systems can do more harm than good and highlight the urgent need for banks to explore more reliable and secure solutions.

Why cybercriminals see OTPs as an easy target

Many banks use OTPs for authentication because they offer a straightforward and versatile approach. Users input the information to verify their identity and banks can set them up as part of a 2FA or MFA process. A slightly more secure variant are Time-based One-Time Passwords (TOTPs), which, predictably, expire after a set time.Consumers also favor OTPs as they don’t have to remember their passwords. A 

 survey found that 52% of UK consumers cited OTPs as their preferred authentication method. 

The problem with OTPs is that they are not an overly secure authentication method, with vishing now one of the most popular ways of intercepting OTPs. Working in the same way as phishing, vishing occurs when scam callers pose as a victim’s bank (‘your account may have been compromised - could you confirm these details’). These attacks are very effective because customers are much more likely to trust someone calling them directly. Moreover, vishing is difficult to detect, as criminals can use 

 to make it look like they are calling from a genuine bank. 

In the past year, phishing incidents increased by 

 across all industries, and vishing attacks increased by 

These statistics show that while phishing and vishing may not seem particularly sophisticated or even believable, a growing number of people are falling for the ruse. 

From the criminal's perspective, setting up a fake website or phone number to coax OTP information from unsuspecting victims is relatively easy and affordable. Additionally, customers may be more willing to hand over a one-time authentication code rather than their password because they know it is time-sensitive and only valid for one website visit. They may also use the same password across multiple platforms.

Overall, OTPs are an easy target for social engineering scammers because they are easy for account holders to obtain, easy to relay to other people and easy to exploit without detection. 

Elevating security and trust in digital banking with biometric authentication

In line with the rise of social engineering scams, many online banking customers are becoming savvy about the risks associated with knowledge-based authentication. To illustrate, 

 of UK consumers believed they were targeted by a phishing scam in 2023, and 56% of consumers polled by 

 believe banks should deploy more secure banking authentication protocols. 

One of the best ways banks can eliminate phishing risk is to move away from OTPs and switch to more secure biometric authentication methods. 

Biometric authentication uses physical characteristics, such as fingerprints or faceprints, to confirm user identity, making them much more difficult for cybercriminals to take advantage of – even if they could steal a bank customer's OTP as an additional authentication factor. Moreover, a survey by 

 found that 93% of consumers would be willing to adopt biometrics. 

Most biometric authentication solutions will remove OTPs from the authentication process altogether. This is because it uses proprietary facial biometrics and device verification to confirm user identity, making it one of the most secure biometric solutions on the market. 

In essence, your customers' physical characteristics are the only information that will grant account access, and verification is as simple as taking a selfie on a device with a front-facing camera. 

Transitioning from OTPs to biometric authentication is not just a security recommendation for banks, but a strategic move that enhances the overall customer experience and builds trust in the digital banking industry. By embracing passwordless solutions, banks can adapt their security measures in real-time, striking the perfect balance between convenience and protection. 

With the added layer of biometric security, especially during high-value transactions, customers can confidently engage in online banking, knowing that their financial well-being is safeguarded. This proactive approach not only offers protection against common social engineering attacks but also strengthens the industry's defenses against a wide range of threats, ultimately reinforcing customer trust and ensuring a safer digital banking landscape for all.