GenAI could make KYC effectively useless
techcrunch.com
techcrunch.com
Many people had to go physically into a bank branch (half of them were closed) and show ID when BMO bought Bank of the West. Your cards and electronic banking didn't work until they were reissued, which required physical presence.
God forbid, you were traveling out of country.
ADDED: And there are a number of such reasons even if you consider this one an edge case. I have absolutely triggered fraud detection when traveling and most banks don't even want you to enter your travel plans any longer. (And I've even had a trivial purchase rejected in the US when traveling--admittedly this hasn't happened recently.)
It’s always either a government approved agency or bank that does the initial identity verification.
The EU will also eventually force all of them to be interoperable.
Most financial institutions I'm dealing with don't have branches. The ones that do are offering atrocious savings rates and charge high monthly fees for their zero-interest checking accounts.
> In turn, those institutions could provide federation of identification to smaller entities.
Do you seriously expect these same entities to willingly become federated identity verification providers for their direct competitors?
> KYC, or “know your customer,” is a process intended to help financial institutions, fintech startups and banks verify the identity of their customers
vs Wikipedia:
> * Know Your Customer (KYC) guidelines and regulations in financial services require professionals to verify the identity, suitability, and risks involved with maintaining a business relationship with a customer. The procedures fit within the broader scope of anti-money laundering (AML) and counter terrorism financing (CTF) regulations.*
> KYC processes are also employed by companies of all sizes for the purpose of ensuring their proposed customers, agents, consultants, or distributors are anti-bribery compliant and are actually who they claim to be. Banks, insurers, export creditors, and other financial institutions are increasingly required to make sure that customers provide detailed due-diligence information. Initially, these regulations were imposed only on the financial institutions, but now the non-financial industry, fintech, virtual assets dealers, and even non-profit organizations are included in regulations.
Generative AI isn’t going to help people that have been intentionally excluded from the monetary system obtain legitimate bank accounts.
(Unless the KYC providers are selling snake oil, which wouldn't surprise me, but that would make it even harder to feel sorry for them.)
In the case of synthetic identity fraud, they establish a history with the credit bureaus by applying for cards and getting denied (eventually they are approved for some low level starter credit card) or getting added as an authorized user to someone with a good credit history (people on eBay sell this).
I'm thinking of packaging my brilliant insights into a $6000 per month "threat intelligence" subscription.
Surely these ID checking services validate the passport/driving licenses with the issuing authorities, validate address through multiple sources etc.
I know zipcar/streetcar in the UK validated driving licenses through the DVLC.
As for organizations like AWS, they presumably have a business presence of some sort in countries where they do business and are setup to verify identity in those countries if they so choose. They also presumably don't have the same degree of KYC requirements that a bank does.
Although many banks in the US can't be bothered to do KYC for non-residents, some certainly allow it. I've done it myself.
Outside the US, opening an account as a non-citizen is very common and usually not a problem at all. In the EU, it would even be illegal to only accept citizens as customers.
I'm sure it's possible with a lot of bigger banks. As you say, I assume a lot of smaller, local banks consider it a headache not worth it as the profit to them is miniscule.
In financial context (e.g. verification for a bank account), usually banks will only accept ID that they can verify as primary ID.
In an immigration context, the agency is often able to verify passports even with countries that government is at war with.
This usually includes passports. I don't think banks can actually reach out to the issuing government to check whether the passport is stolen or cancelled.
I've done it myself, both for branchless/online-only banks and for banks that do have branches in my state but didn't require me to show up in person to open a checking account.
The ICAO even maintains its own sort-of-PKI system: https://www.icao.int/Security/FAL/PKD/Pages/default.aspx
I believe that the standard can be adopted by anyone (national IDs, etc...).
What's missing for this to be an actual remote ID scheme is checking the passport for being reported as stolen, as well as authentication of the person presenting it (e.g. using a PIN or local biometry). Otherwise, anybody could wave your passport over a reader and open a bank account etc. in your name.
For example, Germany does have a (national) remote/online ID scheme on top of an ICAO-compliant (in-person identification only) smartcard-based ID card using a 6-digit PIN.
https://www.aamva.org/technology/systems/verification-system...
> The service assists states in issuing more secure driver’s licenses and identification (ID) cards.
In other words, this doesn't help non-government entities trying to remote KYC their (prospective) customers.
Banks will still get KYC done through face to face.
The internet needs to go back to being anonymous and weird.
Whose face? Many banks don't even have branches.
for now
Think about a lot of European countries where having an ID is mandatory (which frankly I'm not in favor of) and carrying said ID is mandatory (which I'm wholly against).
But the reality of things is that in Belgium I have no issue authenticating myself to any platform that needs to know my identity. I don't need to upload a photo of something. I don't need to look left/right while a camera takes a photo of my face and does a 3D scan trying to give some certainty that I am actually me, and that I am alive.
I put in the card which is just a smart card, and it contains a certificate. I sign the request with a PIN and I am me.
It is perfectly right that moral, legal citizens share all their online data, all the time, with our ever-loving government. /s
What could possibly go right?
Look at the payment card industry: the whole system is fundamentally broken by design and has zero meaningful privacy and security since its inception, yet it somehow survives, decade by decade, with more and more layers of bureaucratic band-aid.
Quite the contrary: The parts of it that are broken are broken due to industry inertia and backwards compatibility considerations.
Payment cards have had the capability for strong cardholder authentication both online (3DS) and at the POS (chip/EMV and PIN) for almost two decades now.
There just isn't political/regulatory will to enforce their use in the US, and nobody will move first without being forced (since it's game-theoretical/economic suicide to be the first mover). In the EU, both are now largely mandatory.
Although I went ahead and got a PIN for my US credit card after I had an issue, I don't know the last time I've had to use it in Europe. I do sometimes scrawl a not really signature now and then.
In other words, it's effectively impossible to get a PIN-preferring, i.e. more secure, credit card in the US...
My comment was that I have been asked to enter a PIN in Europe which is why I requested one. But I've never used it since.
You're covered for fraud by the credit card bank so, as a consumer, I don't really care about the level of security.
I think a rule for all submissions, that use acronyms and initialisms, should include the definition of those in the extra submission text.
Or use an acronym LLM to fill as an extension to Firefox! (Since everything "has" to be a model nowadays)
Agreed, in principle.
> Russia you can’t even buy a e-sim online without a cryptographic signature connected to your eID
And this already highlights the biggest caveat of establishing such a system: It lowers the bar for requiring KYC for all kinds of transactions that currently are possible anonymously.
In the best case, e-ID can be done in a more privacy-preserving way than analog ID (e.g. only revealing information on a need-to-know basis, e.g. your age or citizenship rather than your full name and photo); worst case, it becomes a privacy nightmare.
Unless the “use” of it is to harass and exclude citizens from free commerce with each other for trivial amounts of money, while allowing industrial-scale fraud in the trillions to continue unabated.
I don't know enough about GenAI or the KYC process to say whether or not that could be faked, but I'm confident saying that with only traditional tools it's a barrier that would stop all but the most sophisticated actors.