They have your data anyway, it's much harder to impersonate somebody this way, it doesn't require the verifying company to hire any workers to do the verification, you could even do it without the site you're verifying yourself at learning anything about you.
Both banks and carriers somehow manage to at the same time make identity verification incredibly painful and obscure, without actually protecting me against identity theft.
It also seems like it would make it even harder to switch banks and phone providers than it already is.
I've been seeing more and more carrier based verification, but it's hidden in the disguise of 2 factor auth.
Cash App and Capital One are two examples I can give concretely that do this, as I've been locked out of my account a few times until I can get my husband to read me back the 2fa code (cell carrier has a pre-marriage last name for me and refuses to update it).
I imagine this also works with other vendors. All you need is 1 company with a weak process.
I've spent ~20 years working in and around finance, on the trading side. If your lawyers aren't paranoid about KYC, that's a major red flag.
Do you mean you expect me to give my banking site/app credentials to X?
PayPal used two small (less than $1) transactions and the verification that I own the bank account was verified by correctly identifying the two transaction values.
Plaid, I believe, uses 3rd party auth with some banking institutions that support it, to pull read-only data from my bank account on my behalf.
South Korea and Estonia use government-issued digital certificates that private institutions can use.
There are lots of ways to deal with high assurance authentication, but very few are popular in the US.
Based on my experience with (non-PayPal) financial institutions in the past year, this is going away. For now, it appears you can still force them to fall back to this when providing your login credentials does not work, but who knows how much longer.
No no. Over here (Poland), the way this works is that you get a big list of banks, you click on one, get redirected to their site, log in there, complete any 2FA they need you to complete, are given the typical oAuth "this application wants to access this sort of data" consent screen, and then are redirected back if you consent.
This is mostly used for fast online bank transfers, which we often use for online payments instead of credit cards, but there's also a system to use this for ID verification.
Banks in the US depend on government-issued ID and information contracted from credit bureaus (3 big companies that are effectively data brokers about consumer lending behavior). We have federated identity, but in a weird, ineffective way.
Every once in a while, someone bold makes a political proposal to make our authentication / identity proof systems simpler, but then people realize the privacy implications (and religious fundamentalists point to the “mark of the beast” part of the Bible) and then the proposal doesn’t go anywhere.
Carriers in the US don't all require ID, so they're not particularly useful for identity verification.
In Finland it is common for many online shops to handle payment, and authentication, using a banking account.
You never hand over your actual banking credentials, instead it is something akin to OAUTH2 - so you're at a merchant site and you'll see "Pay with Online BanK" with logos to click for whichever bank you have an account with. Exactly the same as "Login with Google/Github/Facebook/etc".
I changed my name last year, and due to other integrated services many companies automatically updated their records when the change became legal. These kind of integrations seem common and thus far "secure".