Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
Login.gov Builds a Verify With CLEAR Option
Federal single sign-on platform Login.gov has developed an internal integration allowing users to complete identity verification using an existing CLEAR account, according to code commits merged into the service’s public GitHub repository ahead of an October 13 production deployment. Although the administrative controls remain disabled by default, the proof of concept redirects citizens to CLEAR’s platform to inherit verified credentials—including Social Security numbers and government document records—to provision an official Login.gov profile without duplicative Identity Assurance Level 2 proofing. The codebase updates also introduce privacy configurations that enable Login.gov to transmit captured identity document photographs and biometric selfies directly to whitelisted federal agencies following explicit user authorization.
UK Lays Draft Code for Sharing Public Data With Digital Verification Services
The UK government has presented Parliament with a statutory draft code of practice outlining rules for the information gateway to share public data with digital verification services, establishing operational guidelines under Section 45 of the Data (Use and Access) Act 2025. Prepared jointly by the Department for Digital, Culture, Media and Sport and the Office for Digital Identities and Attributes, the framework instructs public authorities to grant registered and certified providers non-discriminatory, cost-neutral access to official data stores via APIs or verifiable credentials while enforcing data minimization through binary validation queries, such as age verification without disclosing full dates of birth. The legal power, which awaits affirmative resolutions from both legislative houses, will establish standardized data-sharing protocols across commercial verification ecosystems ahead of subsequent expansions covering national tax authorities.
Mozilla and Google Drop eMudhra Root Certificate Over Weak Keys as India Opens Probe
Browser vendors Mozilla and Google have initiated procedures to revoke trust in emSign ECC Root CA – G3 after discovering that eMudhra operated certificate authorities with compromised private keys, prompting India’s Ministry of Electronics and Information Technology to launch a formal investigation. Security researchers identified that eight intermediate certificate authorities under the Bengaluru-based provider’s global TLS brand utilized trivially crackable numeric keys smaller than 256 due to a flawed April 2025 generation script, exposing roughly 30,000 public certificates to potential spoofing. While Mozilla has moved to distrust the root and Google plans removal in Chrome Root Store v43, Indian authorities clarified that domestic digital signature operations and CCA-regulated eSign services remain technically unaffected.
Benin, Ghana and Rwanda Complete First Phase of Smart Africa Cross-Border ID Pilot
Benin, Ghana, and Rwanda have concluded initial interoperability trials linking their national civil identity registries under a Smart Africa cross-border digital identity pilot utilizing the federated Smart Africa Data Exchange architecture. Executed with technical support from Ascend Digital Solutions, Co-Develop, and the African Development Bank, the testing phase verified synthetic identity profiles across borders without creating a centralized database or compromising sovereign control over national records. Operating within the governance framework of the Smart Africa Trust Alliance, the partner nations plan to commence controlled operational pilots in early 2027 to facilitate real-time identity authentication for airport automated border e-gates, hospitality registrations, and remote financial account opening across 19 signatory member states.
iProov Launches Human Approval Service for AI Agents With Cerbos and Agentgateway
Biometric verification provider iProov has unveiled a cloud-hosted authorization engine enforcing mandatory human biometric approval for AI agents in collaboration with policy engine Cerbos and Solo.io’s agentgateway project. Built upon the open-source Human Approval and Presence Specification, the service intercepts high-consequence agent actions—such as unauthorized funds transfers or administrative permission alterations—and pauses execution until a designated approver completes a genuine human presence check via Dynamic or Express facial biometrics. The platform subsequently issues a single-use, cryptographically signed authorization credential bound to the exact operational parameters, automatically invalidating the transaction if an autonomous agent alters amounts, routing targets, or operational scopes.
Mexican Senate Passes Digital Economy Law Recognizing CURP Digital for Financial Services
The Senate of Mexico has approved the Digital Economy Law for Digital and Electronic Payments, officially establishing the CURP Digital as a valid trust mechanism for digital finance alongside the new Citizen Digital File. Passed by a 72 to 34 margin and transmitted to the federal executive for promulgation, the statutory framework obligates commercial banking institutions to accept the voluntary digital population code for remote onboarding and account creation while expanding merchant acceptance of QR codes, contactless NFC, and electronic payments across all levels of government. Overseen by the Agency for Digital Transformation and Telecommunications and the Bank of Mexico, the legislation aims to broaden financial inclusion and streamline digital public services while implementing gradual digital onboarding safeguards.
Procivis Joins EU Co-Funded mDL4EU Consortium for Mobile Driving Licenses in EUDI Wallets
Digital identity software specialist Procivis has joined the mDL4EU consortium as an architectural technology partner to integrate mobile driving licenses into European Digital Identity Wallets under a 24-month initiative co-financed by the Digital Europe Programme. Operating across 24 European Union member states and more than 30 technical organizations, the project will map national infrastructure, conduct localized cross-border pilots, and implement issuance and verification services compliant with ISO/IEC 18013-5, ISO/IEC 18013-7, and eIDAS 2.0 standards. Procivis is supplying its production-ready Procivis One engine to establish the mobile driving license as the first high-impact, interoperable credential supported natively across participating sovereign national wallets.
Broadcom Launches Arcot Scam Defense to Flag Fraud After 3-D Secure Authentication
Broadcom’s Payment Security Division has introduced Arcot Scam Defense, an automated fraud mitigation layer within its 3-D Secure platform engineered to intercept social engineering fraud during card-not-present transactions even after a cardholder successfully satisfies an authentication challenge. The real-time detection engine evaluates checkout parameters, device telemetry, physical geolocation disparities, delayed passcode entry, and concurrent phone call indicators to recognize when legitimate account holders are being manipulated into completing step-up biometric or OTP challenges by impersonators. Pilot evaluations against a month of live transaction volume demonstrated that reviewing the top 1 percent of suspicious authenticated challenges prevented approximately $4 million in fraudulent losses, providing a secondary defense against scams that exploit authorized consumer sessions.
TransUnion Launches Adverse-Actionable Synthetic Identity and Credit Washing Scores
Consumer credit bureau TransUnion has released specialized Synthetic Fraud and Credit Washing Scores, establishing adverse-actionable fraud scoring for consumer lending through an initial integration with Oscilar’s risk decisioning platform. Designed to operate under the regulatory framework of the Fair Credit Reporting Act, the solution provides financial institutions with clear reason codes that can be cited in formal adverse action notices when denying applications involving manipulated credit histories or fabricated consumer identities. With national lender exposure to synthetic fraud reaching $2.4 billion, the predictive risk scores evaluate charge-off suppression tactics and identity anomalies at the point of origination, enabling automated platforms to deny compromised applications while meeting federal disclosure mandates.
–
By the ID Tech Editorial Team