In today's digital world, verifying a user's real identity is crucial, not just when they first sign up but throughout their entire interaction with a service. With the rise of more complex threats using advanced technologies like automation and AI, businesses are finding it increasingly difficult to continuously confirm the authenticity of user identities. This situation highlights the need for more advanced methods to ensure identity security at all times, not just at the start.

KYC (Know Your Customer) is a process businesses use to identify their clients and prevent financial crimes. It involves verifying personal identification documents when a customer first registers. Though crucial, KYC is just the beginning of a comprehensive approach to maintaining identity security.

Why Continuous Identity Verification Matters

After the KYC process, identity fraud and account takeovers do not simply disappear. It's essential to keep verifying a user's identity as they use a service, to protect against sophisticated cyber threats that might not be caught by initial KYC checks. Ongoing identity verification is vital for security and trust, making sure users are who they say they are at every stage of their journey.

Key Strategies for Continuous Identity Verification

We’ve identified five key considerations we believe all businesses should keep top of mind when implementing ongoing identity verification checks.

Seamless Integration with Initial Onboarding

The process should smoothly transition from the initial identity verification done during onboarding. Using the biometric data captured at the onboarding step for continuous authentication is the most seamless and user friendly way to continually verify someone’s identity.

Dynamic Verification Across User Interactions

The system should be able to dynamically verify users at key interaction points — such as logging in, making high-value transactions, recovering accounts, or changing account details.

Combining multiple security layers, such as facial recognition that respects privacy, device verification, and liveness detection, can greatly enhance protection against unauthorized access.

Regularly comparing biometric templates ensures that the person interacting is the same as the one registered initially. But this must be done in a way that protects their privacy by not putting their PII at risk.

The system should help businesses adhere to the latest regulatory requirements related to data privacy and security. Within Europe, the GDPR puts several restrictions on biometric data - any data that leaves the device should not contain PII. The upcoming PSD3 will put further requirements on implementing Strong Customer Authentication (SCA) for digital payments.

As digital threats become more advanced, businesses must enhance their identity verification methods beyond just the first KYC steps. This involves implementing innovative strategies to reinforce identity security throughout the customer's entire relationship with the business. By doing so, companies can better defend against cyber threats, meet regulatory requirements, and provide a secure and smooth experience for users.

Continuous Identity Verification: Navigating the Digital Landscape Beyond KYC

Keyless Emerges as an Independent Entity: Brings Total Funding to US $26m to Stop Identity Fraud

The London-headquartered scaleup announces a mutually beneficial departure from Sift as it secures funds to accelerate adoption of its biometric authentication solutions beyond Europe

Keyless, the leader in privacy-preserving biometric authentication, secures an additional $6 million in funding from prominent European venture capitalists, led by Rialto Ventures. This funding injection elevates Keyless' total funding to $26 million, with previous backing from distinguished investors such as P101, Primo Ventures, gumi Cryptos Capital, and Ripple's Xpring.

Stefano Quintarelli, General Partner at Rialto VC, underscores Keyless' potential, noting, 

Keyless unifies the entire end-to-end identity lifecycle with privacy-preserving biometric authentication, helping to continuously assure the genuine identity of the user from the initial onboarding and account creation, through to step-up actions, transaction signing (including PSD2 SCA compliance), and account recovery. Its patented technology not only fortifies protection against account takeover attacks and identity theft but also ensures compliance with global data protection and privacy regulations, such as the GDPR.

Andrea Carmignani, co-founder and CEO of Keyless, emphasizes the shifting authentication landscape in Europe, stating, 

Thanks to its privacy-preserving cryptographic capabilities, Keyless can create universal biometric profiles that can be used to assure the identity of the genuine user at any point in the identity lifecycle without needing to store biometric data anywhere, delivering superior security while preserving user privacy. This addresses the challenge faced by vendors relying on device-bound biometric capabilities such as FaceID, which do not authenticate the genuine person behind the device, but rather authenticate the device itself, making it difficult to prove that it is the authorized account holder.

Carmignani highlights the need for a transition in authentication, stating, 

Server-side biometric solutions, which solve the identity portability issues with device-based authentication, come with the challenge of storing sensitive biometric data in centralized databases. Even if the data is encrypted at rest, it still represents personal identifiable information (PII) and poses a massive risk to the business. Emerging private-by-design solutions, such as Keyless, are solving this trade off and for the first time, enabling businesses to balance seamless user experiences with compliance needs and strong security.

This latest round is also the startup’s first as a newly independent company. In a strategic move, Keyless mutually agreed to separate from parent company Sift earlier this year. The separation comes after the two companies found that their respective products were best suited to servicing differing markets. 

Thanks to increasing adoption of its flagship Zero-Knowledge Biometrics™ technology, Keyless continues to lead the charge in privacy-preserving biometric authentication, with this latest funding serving as a testament to its commitment to reshaping the authentication landscape in a rapidly evolving digital era.

Keyless Brings Total Funding to US $26m to Stop Identity Fraud; Emerges as an Independent Entity

In the ever-evolving landscape of financial services, staying up to date with regulatory changes is crucial, especially when it comes to payment services. The Payment Services Directive (PSD2) has been a game-changer, introducing Strong Customer Authentication (SCA) and promoting open banking. 

Now, as the European Commission proposes to replace PSD2 with PSD3 and introduce the Payment Services Regulation (PSR1), it's essential to understand the implications for financial institutions, particularly banks, and how innovative solutions like passwordless authentication can help.

The most significant change introduced by PSD3 is the transition from a directive to a regulation. This means that most of the payment rules from PSD2 will fall under the Payment Services Regulation 1 (PSR1). Unlike directives, which can be interpreted differently by each EU country, regulations apply uniformly across all member states. This shift will lead to a more harmonized payments market with fewer differences and inequalities between countries. 

In addition to PSR1, PSD3 will focus specifically on licensing and authorization for payment and e-money institutions.

The changes aim to address the gaps and shortcomings identified in the previous version, PSD2. By modernizing payment services and opening up financial services data, PSD3 and PSR1 strive to ensure improved consumer protection, foster competition, enhance security, and build trust within the industry. The proposal seeks to streamline and standardize payments across the EU, making transactions more efficient and secure.

One of the significant updates introduced by PSD3 is the merger of e-money institutions and payment institutions, simplifying the licensing process and promoting a more efficient and competitive market. This consolidation aims to streamline operations and provide a more comprehensive regulatory framework for these institutions.

PSD3 proposes an implementation of a risk-based approach to fraud prevention, leveraging technologies such as IBAN and name matching. This measure aims to enhance security and protect consumers from fraudulent activities, ensuring a safer payment ecosystem.

PSD3 seeks to clarify and refine the requirements for Strong Customer Authentication, which aims to strengthen the security of online payments. By setting clear guidelines, PSD3 aims to strike a balance between security measures and user convenience, ensuring smooth and secure transactions.

Transparency is a cornerstone of the proposed changes. PSD3 aims to introduce transparency reforms that empower consumers with greater visibility into their payment transactions, fees, and charges. This transparency fosters trust and enables customers to make informed decisions.

PSD3 aims to enhance access to bank account services for payment institutions, promoting competition and innovation. By facilitating access to account information and payment initiation services, PSD3 aims to create a more dynamic and open financial ecosystem.

The proposed changes from PSD2 to PSD3, accompanied by PSR1, reflect the European Commission's commitment to modernizing payment services, improving consumer protection, and fostering innovation. The introduction of PSD3 will bring about significant advancements in the efficiency, security, and transparency of payments within the European Union. It is an important step towards shaping the future of the financial sector and ensuring a seamless and secure payment experience for all stakeholders involved.

The evaluation of PSD2 revealed that Strong Customer Authentication had a significant impact on reducing fraud, a clear win in bolstering the payment ecosystem's security. However, as fraudsters adapt, regulatory measures must follow suit. 

In our next blog, we’ll be looking closely at the evaluation of Strong Customer Authentication as well as proposed amendments to SCA under PSR1.

What you need to know about PSD3

The landscape of online fraud is undergoing rapid transformation, exposing both consumers and businesses to an array of malicious threats. 

 (ONS) has reported a significant uptick in fraud and computer misuse offenses over the past two years, with a staggering 

 stolen in the UK alone. Furthermore, a 2022 report by 

 highlighted that court-involved monetary fraud cases surpassed the £1 billion mark.

Beyond the immediate financial repercussions, businesses also face the long-term challenge of eroded customer trust, potentially tarnishing their reputation irreversibly. In this article, we delve into the predominant fraud trends of 2023 and offer insights on fortifying customer authentication practices to better protect consumers.

Key fraud trends of 2023: what to watch out for

1. The surge of account takeover fraud (ATO)

In 2023, the digital sphere is grappling with the increasing prevalence of 

 (ATO), posing severe risks for both businesses and consumers. This trend is partly attributed to the ongoing reliance on outdated authentication technologies, such as passwords and 

 (OTPs), which are highly susceptible to various attack vectors.

2. The escalation of automated fraud and AI exploitation

Automation and AI have revolutionized fraud, enabling cybercriminals to scale their operations and target a broader spectrum of potential victims. Tools like botnets have been instrumental in automating large-scale attacks on networks and online services, demonstrating the increasing efficiency of fraudulent activities.

 in an unprecedented credential stuffing campaign. Another r

 highlights how hackers are leveraging AI to adapt malware activity patterns in order to evade fraud detection systems.

These incidents highlight the sophistication and scale of automated fraud attacks in the current landscape. 

3. The evolution of social engineering threats

The past year has seen a notable increase in social engineering attacks, with phishing emails and impersonation scams becoming more prevalent. BrandShield discovered 

 fake websites impersonating UK retail banks in May 2023 alone, and there has been a 

 increase in phishing attacks over the past year.

Furthermore, vishing attacks, which utilize voice and telephone number spoofing technologies, have surged by 

 worldwide between Q3 2022 and Q4 2022. These trends underline the growing threat of social engineering attacks and the necessity for more robust authentication technologies.

4. The threat of deep fakes and digital injection attacks

With the advancement of AI technologies, fraudsters now have the ability to conduct sophisticated attacks such as voice scams and digital injection attacks. Criminals can generate synthetic voices ("deep fakes") to impersonate 

, and inject malicious data into secured systems to bypass biometric authentication measures.

AI and automation further amplify these threats, enabling attackers to conduct large-scale attacks and adapt malware activity patterns to evade detection from behavior-based cybersecurity technologies.

5. The rise of man-in-the-middle (MITM) attacks

MITM attacks are becoming increasingly common, with criminals intercepting communications between victims and authentication servers to 

 increase in MITM attacks between Q1 2022 and Q1 2023, highlighting the growing proficiency of attackers in exploiting vulnerabilities in customer authentication systems.

6. The ongoing issue of SIM swapping and rise of phone thefts

Despite being low-tech, SIM swapping and 

. Criminals exploit knowledge-based authentication systems to execute these attacks, and in some instances, they can even switch off biometric authentication systems to gain unauthorized access to user accounts.

The Telegraph reported that UK consumers have lost over 

 over five years due to SIM-swapping attacks. This alarming statistic underscores the urgency for adopting more secure and resilient authentication methods.

Strengthening defenses with passwordless authentication

As the threat landscape continues to evolve at an unprecedented pace, organizations must adapt and implement more robust authentication methods to ensure the security of their customers. Passwordless authentication emerges as a viable solution, offering a secure and user-friendly alternative to traditional password-based systems.

By utilizing unique physical characteristics for authentication, passwordless solutions eliminate the need for users to remember complex passwords, reducing the risk of account takeover and other fraud-related threats.

To explore how passwordless authentication can enhance your organization's security posture, we invite you to contact us for a 

Navigating the Evolving Fraud Trends Landscape in 2023

We’re excited to announce we’ve been featured in the newly published 

, the report offers invaluable insights into evolutionary trends in biometrics, strategic guidance for vendors, key differentiators for digital identity roadmaps, and an advanced market landscape reference model.

The report categorizes vendors into three distinct groups. Luminary vendors, like Keyless, represent the highest level of proficiency in their respective industry segments and are recognized as trendsetters and guiding lights in the field of biometric digital identity. 

In the report, Keyless is listed as a Biometric ID platform, as its technology enables companies to securely verify a user’s identity with their biometrics across different lifecycle stages – from onboarding to account recovery. 

The Prism report will evolve in tandem with the dynamic biometric digital identity landscape. The evaluations included in this report have been meticulously crafted through independent research, industry surveys, and consultations with vendors, researchers, and analysts.

Keyless Recognized in New Biometric Digital Identity Prism Report

We're thrilled to announce that Keyless has secured the prestigious '

' at this year's UK National Cyber Awards. 

The UK National Cyber Awards are a celebration of excellence and innovation in the cybersecurity field, bringing together leaders from across sectors. The event acknowledges outstanding contributions to the country's cybersecurity landscape.

This year's awards featured five categories, including the Prime Minister's Award for Cyber and The NHS Digital Award. With nominations pouring in, it's clear that cybersecurity's importance is on the rise.

Winning the ‘Innovation in Cyber Award’ reflects our dedication to advancing privacy-enhancing biometric authentication technology. In an age where data security and user privacy are paramount, our innovations have earned well-deserved recognition.

As the cybersecurity landscape evolves, we remain dedicated to providing cutting-edge solutions that empower organizations to protect their digital assets and user data. The recent win is a testament to our pivotal role in shaping the future of biometric security.

Thank you for your submission

All the resources you need to support you on your journey to zero trust

Get In Touch