Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
PayPay to Replace Photo-Based eKYC With Chip Reading
Japanese mobile payment service PayPay will eliminate document photograph uploads for customer onboarding by early November, requiring new account applicants to complete chip-reading identity verification on My Number cards and driver’s licenses via app version 4.28.0 or later. Prompted by rising identity theft risks following high-profile data breaches exposing physical driver’s license scans, the policy shift anticipates the April 2027 enforcement of revised regulations under Japan’s Act on Prevention of Transfer of Criminal Proceeds, which formally abolishes photo-based non-face-to-face verification. Under the streamlined protocols, applicants can authenticate in as little as two minutes using electronic signature certificates, PINs, or secondary facial matching against chip records, accelerating review times to same-day turnaround across an active user base where more than 44 million accounts have already completed identity verification.
London City Airport Selects Amadeus for Biometric Check-In and Bag Drop
London City Airport has partnered with Amadeus to deploy shared, biometrically enabled self-service kiosks and automated bag-drop systems across its passenger terminal. The deployment leverages the Amadeus Airport Cloud Use Service (ACUS) common-use multi-cloud platform, integrating biometric passenger processing across check-in and bag drop to serve more travelers without expanding the physical terminal building as the facility scales toward its statutory nine-million annual passenger cap. The opt-in system enables travelers to register their facial biometrics against a verified identity credential via smartphone or on-site kiosk, creating a temporary profile that allows automated check-in, bag handover, and security clearance without repeated physical document presentation.
Ondato Adds EUDI Wallet Verification Through Trinsic
London-headquartered compliance and identity verification provider Ondato has expanded its regulatory technology suite by integrating EU Digital Identity Wallet verification through Trinsic, preparing enterprise clients for forthcoming European verification mandates. Leveraging Trinsic’s cross-border gateway connecting more than 50 national eID frameworks and 1.9 billion pre-verified profiles, the capability allows European consumers to authenticate using sovereign wallets and national digital credentials like Smart-ID directly alongside Ondato’s document-checking and fraud-monitoring engines. The integration positions banks, fintechs, and online marketplaces to meet eIDAS 2.0 obligations requiring EU member states to issue state-backed wallets by late 2026 and compelling regulated entities requiring strong customer authentication to accept them by December 2027.
HyperVerge Passes BixeLab Presentation and Injection Attack Tests
Biometric developer HyperVerge announced that its HyperKYC identity software and facial liveness backend successfully completed two distinct evaluations conducted by Australian testing laboratory BixeLab, recording zero attack classification errors across presentation and injection testing. Testing against ISO/IEC 30107-3:2023 Level 3 criteria in September yielded zero accepted spoofs across 150 presentation attacks using sophisticated physical artifacts, alongside a zero percent user-level error rate for genuine subjects. In a separate evaluation aligned with the CEN/TS 18099 Substantial benchmark, all 630 digital injection attempts—including face swaps, deepfake video streams, and virtual-camera hooks executed over iOS, Android, and Web platforms—were intercepted and rejected, validating the system’s defenses against manipulated camera feeds.
Sumsub Liveness Clears iBeta Level 3 Presentation Attack Testing
Identity compliance platform Sumsub has cleared iBeta Quality Assurance Level 3 presentation attack detection testing under ISO/IEC 30107-3, maintaining an attack presentation classification error rate of zero percent across 900 sophisticated spoof attempts. Conducted using native web browsers on Android and iOS devices connected to Sumsub’s production cloud backend, the rigorous evaluation allowed laboratory testers up to 56 hours per artifact species to construct hyper-realistic facial masks and physical attack instruments. The accredited assessment builds upon Sumsub’s prior Level 1 and Level 2 conformances, confirming the biometric engine’s capacity to repel advanced physical presentation attacks without human intervention.
Oleria Launches AI Connector Builder for Identity Governance
Identity governance specialist Oleria has released Integration Studio, an AI-assisted connector builder that converts application API documentation into automated identity governance integrations within its TrustFusion access graph at no additional cost to customers. Employing autonomous research agents, the studio analyzes third-party authentication protocols, pagination, and endpoints through a four-stage verified workflow, outputting structured manifests validated by an independent deterministic testing runtime. The framework enables enterprise security teams to onboard custom SaaS platforms, service accounts, API tokens, and autonomous AI agents in under a day, feeding granular permissions, audit trails, and automated access-revocation rules directly into Oleria’s central risk engine and Copilot assistant.
Huntress Finds Stolen Microsoft 365 Sessions Used Across 79 Organizations
Cybersecurity research firm Huntress has uncovered a large-scale token spraying campaign that hijacked stolen Microsoft 365 session tokens to breach 79 organizations between July 14 and September 22. Generating nearly 500 successful sign-ins and more than 200,000 failed attempts, attackers harvested authenticated session tokens through adversary-in-the-middle phishing relays and device-code exploits to bypass multifactor authentication without triggering step-up challenges. Threat actors maintained persistent access by registering at least 48 rogue device profiles in corporate directories, wiping existing MFA methods in favor of attacker-controlled authenticators within three hours of compromise, and deploying stealth inbox rules to intercept sensitive corporate communications.
Greece Passes Under-15 Social Media Ban With Wallet-Based Age Checks
The Hellenic Parliament has approved legislation prohibiting social media access for children under the age of 15, establishing statutory age verification via national digital wallets and KidsWallet scheduled to take effect on January 1, 2027. Sponsored by Minister of State Akis Skertsos and amending Law 5099/2024, the statute applies a calendar-year age calculation rule and permits platforms to verify users through the privacy-preserving KidsWallet app, which transmits a binary confirmation of age without disclosing full birth dates or personal identifiers. Supervised by the Hellenic Data Protection Authority and the National Council for Radio and Television, the law gives digital platforms two and a half months to deploy compliant verification architectures while containing an automatic sunset clause should a binding European Union regulation be enacted.
–
By the ID Tech Editorial Team