Combating fraud with identity-centric payments

While technological advancements in payments create many benefits for consumers, they also provide fraudsters with opportunities to implement sophisticated methods of attack. Identity verification is key to mitigating this risk.

During The 2024 SUMMIT, Matthew Charette, Chief Information Security Officer (interim) and Director, Cyber Security at Payments Canada, sat down with David Birch, Global Ambassador at Consult Hyperion, to discuss the future of identity-enabled payments and the role of identity verification in combating fraud.

What is the connection between digital identity and payments?
The idea of businesses shifting from being "payment businesses" to "identity businesses" has been coming for a long time, but now it’s finally here. Banks especially are starting to see that they’re not really in the money business; they're in the identity business. If you think about it, it isn’t your money that’s valuable, it’s your identity. Imagine you wake up in the morning and all of the money in your bank account had been mysteriously wiped out. There are ways of obtaining money to get you by, like borrowing from a relative or taking out a bank loan. However, if your identity is mysteriously wiped out overnight, you're in trouble. All of your assets are identity. Without identity, you have no evidence that you are who you say you are, which means you can’t prove that anything you own is truly yours, like your house or your pension. The control and management of your identities is such a crucial factor in the evolution of the economy as we move forward. Visa announced some fantastic new products at The SUMMIT, like the digital token, and it’s exciting that we’re starting to see more of these.

What role does digital identity play in preventing fraud?
Because the UK was the first into instant payments, we were the first into instant fraud. A huge portion of this fraud originates from Meta platforms, like Facebook and Instagram. In a recent experiment by Lloyds Bank, it was discovered that one third of the listings on Facebook Marketplace were fraudulent. Right now, I can create a fake account and a fake listing, pocket the instant payment that a buyer sends me, close the account and walk off scot-free. If you actually had to verify your identity before you could list something on Facebook Marketplace, it would be a different story. The point of digital identity is that it’s identity built for the digital infrastructure, for the online world.

When you say digital identity, many people think of digitized identity, like digital versions of driver’s licenses and passports. But they’re two different things. Your driver’s license, digital or not, gives away all the information it has to anyone who reads it. The reader now knows not just your name, but your address, date of birth, height and weight. Your digital identity on the other hand only gives the information that it needs to, based on what is required for the transaction. We have a cryptographic toolkit available to us that can do incredible things to protect our data. For example, zero-knowledge proofs allow the verification of your identity without requiring any personally identifiable information.

Canada is starting from a slightly different place than the UK did. There are already protections in place, such as the pan-Canadian Trust Framework and Interac verification, but there are opportunities to build in even more anti-fraud capabilities. If digital identity is part of the infrastructure, not an add-on around the edge, then it would absolutely help minimize the likelihood of payment fraud.

Where do you think the digital identity space is going to be in five years?
In five years, by far the most important digital credential in your wallet is the one that proves you are a human being. With the rise of AI-generated threats like deepfakes, we’ll need strong identity verification to determine whether we are dealing with a real person or not. Many people already fall victim to payment scammers that use a fake identity to establish trust with their targets. As this technology becomes more sophisticated, the need for digital identity will only grow.

Subscribe to The SUMMIT newsletter to get the latest updates on The SUMMIT, including agenda announcements, exclusive promotions, industry resources and more.