Cracking the Identity Code: The Unbreakable Link Between Identity and Payments

Welcome back to Cracking the Identity Code!

We’ve broken out our next installment, “Fraud, Scams, and Broken Policy,” into a three part series, where we help break down the current state of scams in the U.S. In Part 3, we discuss how technology, policy, and consumer awareness can come together to create a new framework for verifying identity and intent, delivering greater trust and certainty across our online transactions.

The Unbreakable Link Between Identity and Payments 

One of the key vulnerabilities of many of our existing payment rails (card, bank payments, etc.) is that the messaging protocols tied to payments do not exchange verified identity data. By excluding this, existing payment rails make it difficult to determine the true identity of those sending and receiving payments. So, what can we do? Shift from one-off authentication events to a persistent identity model. One powered by portable digital identity credentials that are secure from attacks (especially as AI sophistication advances), backed by robust identity proofing, and designed to make data sharing easier and more robust.

Some of the more forward looking financial institutions have caught on to the vulnerabilities in authentication, and no longer assume that every verified login means all subsequent user actions are kosher. These FIs have introduced additional identity or intent verifications at critical moments. A “trust but verify” pause. But as we discussed in Part 2, many of the existing “step-ups” are often spoofed, and when consumers are under duress, they are easily manipulated to allow fraudsters to skirt a bank’s controls. 

For certain higher-risk transactions, like during a large wire transfer to a new beneficiary, Banks COULD introduce more friction like prompting a user to record a short video or voice note or confirm certain details about the payment. While these approaches could stall scammers, widespread adoption is unrealistic due to diminishing returns on user experience. Compounding the challenge for banks is recognizing that any new controls will need to keep pace with advancements in AI so they’re not obsolete by the time you finish reading this post. 

Again, So What Can We Do?

Most networks and payment companies already have mechanisms to provide users with relevant account details when someone requests money or sends payment instructions. For example, networks have evolved from only showing “Account #12345678, Routing 987654321,” to displaying“Account belongs to Acme Escrow LLC.” While a step in the right direction, this information still allows scammers to obfuscate their identities, providing little evidence of the true identity behind an account. With the right frameworks in place banks could begin to provide more robust profiles, providing users with information like “Acme Escrow LLC has been a verified business in New York since 2010.” Going a step further, when you receive a request in a payment app, systems could show not only verification of the requester’s identity but proof that the identity was verified by a bank, a trusted authority. This kind of transparency could kill many impersonation scams: a criminal pretending to be your utility company would be exposed if the identity credential doesn’t match. It also creates accountability – bad actors would find it much harder to hide behind anonymous throwaway accounts.

Introducing a Trusted Digital Identity Network

To build this framework and move towards securing payment ecosystems, we need a network populated with trusted identities that have been issued using bank-grade identity proofing, and hits the right balance between providing transparency and preserving privacy. Doing this will take banks, fintechs, identity providers and governments, “participating” in a framework for identity verification and supporting protocols to share enough data to allow participants to make risk-based decisions. There are moves in this direction that are already complementary to a trusted identity network: negative list consortiums are already sharing data on known fraud phone numbers, emails, and mule account details to spot scams faster across the banking ecosystem. A “trusted persistent identity” layer would take it further by making identity a core part of the payment message. If every account in the system had a higher-assurance identity attached (along with key attributes) of both the sender and recipient before money moves, participants could fully underwrite their own risk. Additionally, by combining industry consortiums (negative lists) into the identity network it would be much harder for scammers to create fictitious personas or use straw accounts to receive funds.

Finding the Catalyst for Change: Liability Shifts and Updated Regulations

Businesses often respond quickest when liability is on the line. A historical example is the rollout of EMV chip cards in the U.S. – the cards with a microchip that replaced the old magnetic stripes. For years, the financial industry dragged its feet on adopting chips (a model already proven out in Europe) because of the cost, complexity, and theoretical impact to purchase approval rates. Then in 2015, the card networks implemented a liability shift: any merchant that hadn’t upgraded to chip-reading terminals would be on the hook for counterfeit card fraud. The result? A massive push to install chip technology, which led to an 87% drop in counterfeit card fraud at compliant merchants. It was a clear demonstration that who bears the loss directly influences security investments.

We may be nearing a similar conversion point for payments and identity. Take scams as an example. In authorized push payments (think Zelle, RTP, FedNow) where the payor is authorizing the payment, the payor’s bank holds the bag if the payment was due to a scam. While it may be true that the industry is still figuring out if the payor bank should be responsible for reimbursing the consumer, imagine for a moment what would happen if we found the right incentives to encourage banks to do the right thing.  The solution? Again, it’s the trusted identity network. If both senders and recipients are issued a trusted identity and that identity is used for payments across all networks, then we can establish a stronger feedback loop to protect the whole industry. This would be similar to how credit bureaus use information across all types of products to create a uniform view of a person's ability to borrow and repay. If regulators or network rules begin to place more responsibility on the recipients’ (scammers’) banks for losses, banks will have a strong incentive to get creative and aggressive in preventing these scams up front. 

Through hold-harmless laws and liability shifts, the government can play a huge role in providing the incentives for institutions and networks to work together and establish better scam protections. We’ve done this before. After 9/11, elements of the PATRIOT Act provided protections to banks when sharing information about suspected money laundering or terrorist financing. Additionally, the enactment of the SAFETY Act, provided liability protections for sellers and deployers of anti-terrorism technologies to encourage their development and use in preventing another terrorist attack. In the UK, regulators have mandated reimbursement requirements for APP fraud, effectively forcing the industry to solve the problem or eat the cost. Should the U.S. enact a rule that, say, unless a bank can prove a customer confirmed a transaction was legitimate, the bank eats the loss, you can bet banks would rapidly deploy better safeguards for intent verification, customer education, and payee authentication. And if these safeguards were evidence enough to allow for protection against lawsuits, fines, consent orders by the government, there would be incentives enough to create investment in systems (identity networks) to enable a safer ecosystem.

Ultimately, stopping modern scams will require a combination of technology, policy, and consumer awareness. Banks and payment companies need to weave smarter protections into the customer journey – without making normal use unbearably inconvenient. Regulators need to modernize definitions and expectations so that consumers aren’t left unprotected due to technicalities about what “authorized” means, while establishing hold-harmless laws that help institutions manage regulatory risk. Lastly, consumers themselves need to be armed with more tools to verify who they’re dealing with: the ability to easily confirm a caller’s identity, an account’s owner before sending money, and see more information about someone if they’ve never seen them before. A persistent digital identity framework could be the backbone of many of these solutions, bringing more trust and certainty into our online financial interactions.

Fraud will never be fully eradicated, but it can be contained. Our goal should be flipping the current script: instead of scams being easy to pull off and hard to recover from, they should be hard to pull off and easier to stop in progress. By continuously verifying identity and intent – not just at login, but through the entire transaction process – financial institutions can dramatically reduce the success rate of scams. Combine that with industry-wide cooperation and smarter liability alignment, and we have a fighting chance to turn the tide. It’s time to upgrade our concept of digital identity and trust, so that the next time a fraudster calls pretending to be your bank, the system will already be a step ahead of them, protecting you and your money by design.