Are Selfies for Identity Verification Secure? Insights and Concerns

Are Selfies for Identity Verification Secure? Insights and Concerns

The growing trend of using selfies for online identity verification has surged since the pandemic, prompting both banks and governments to adopt live image requirements for digital transactions. This shift raises questions about cybersecurity and privacy.

In Vietnam, residents must now use face scans for digital transactions over $400, a mandate that began last Monday. This move has sparked debate, as Vietnam is often ranked poorly in internet privacy and cybersecurity. Local media have criticized the new rule, suggesting that selfies won't enhance security, and some apps have already been criticized for accepting still photos instead of live images.

This concern isn't isolated to Vietnam. In late June, US cybersecurity firm Resecurity reported a spike in leaked identity documents containing selfies of Singaporeans on the dark web. These selfies, originally provided to fintech and e-commerce providers, were leaked by cybercrime groups running fake telemarketing or customer support scams.

The use of selfies for identity verification has been growing for the past five years, with a significant increase during the pandemic. Akif Khan, a VP analyst at Gartner, notes a high and rising interest in selfie-based authentication. Katie Mitchell, CEO at consultancy New World Advisors, also highlights the need for online financial services to replicate account opening services digitally, driving the demand for proof of personhood online.

Anti-money laundering (AML) and know your customer (KYC) processes, governed by laws and bodies like the Financial Action Task Force, vary by jurisdiction and are constantly updated. Mitchell points out a gap in the comprehensive regulation of biometric data collection for account verification.

the shift towards selfie-based identity verification brings both benefits and challenges

Acronis CISO Kevin Reed identifies mishandling of selfie data as a key problem, noting that data is often not properly discarded after verification, creating security risks. If the data holds value for criminals, it becomes a target for theft.

Resecurity's report cited a Singapore-based digital payments provider requiring individuals to hold their government ID and a handwritten note during verification. Reed describes this as slightly better than a simple photo but still vulnerable to motivated attackers.

Khan suggests that businesses using simple selfies for verification often do so as a stopgap measure against fraud. For better security, vendors implement liveness checks, requiring real-time verification through video and specific actions, combined with machine learning to detect deepfake attacks.

While Khan acknowledges that no security measure is foolproof, he believes that liveness checks significantly reduce the risk of identity theft from still images. The main challenge lies in ensuring accessibility, diversity, and inclusion without creating loopholes for threat actors.

Overall, the shift towards selfie-based identity verification brings both benefits and challenges, necessitating robust measures to safeguard against potential cybersecurity threats.