Requiring every financial institution to collect and store its own copies of customers’ identity documents spreads sensitive data across many organizations and works in attackers’ favor, according to Fold founder and CEO Will Reeves.
Reeves discussed identity verification, fraud and AI with hosts Tony Bitzionis and Alex Perala on the latest episode of the ID Talk podcast, “Fold’s Will Reeves on Why Risk Teams Make or Break Fintechs.” Fold, whose parent company Fold Holdings trades on Nasdaq, offers checking accounts, debit and credit cards and bill pay through partner banks and pays customer rewards in bitcoin.
Under the Bank Secrecy Act, the U.S. anti-money-laundering statute, each institution has to run its own know-your-customer (KYC) checks, whether it is a large bank, a local credit union or an exchange where customers buy bitcoin, Reeves said. Customers’ documents therefore end up stored by many organizations. “Now, any breach into any one of those means that all of them have been breached,” he said, calling it “a fundamentally broken aspect of the system.”
Fold moved its customer identity checks to Persona this summer, a choice Reeves called “a no-brainer.” He said such platforms should be judged not only on stopping fraud but on giving “the best users with the best intentions” full access, while catching applicants who use identity documents stolen from the dark web and “look like a great user with an 800 credit score.”
Fraud control decides which fintechs succeed, Reeves said, because margins are thin enough that a platform that cannot handle fraud “can’t operate a business.” He said Fold’s risk team comes across a technique it has “never seen before” about once a day.
Reeves said attackers have already used AI tools to find vulnerabilities in bitcoin wallets. He argued that slowing AI development would leave defenders with weaker tools while attackers turn to unrestricted models built elsewhere.
For KYC itself, Reeves pointed to government interest in zero-knowledge proofs, which let an institution confirm a fact about a customer without taking possession of the underlying data, and in letting customers complete KYC once for use elsewhere. In a September speech, then-SEC Commissioner Hester Peirce, speaking for herself, urged regulators to move from prescriptive data collection toward attribute-based verification, including zero-knowledge proofs.
How verification is done is the important question, Reeves said, adding that advances in technology make it possible to verify identity in ways that respect people’s privacy and security. “Identity verification will always need to be here,” he said.
Listen to the full ID Talk conversation, or find the episode wherever you get your podcasts.
–
By the ID Tech Editorial Team
