ID Tech Digest – September 10, 2026

Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:

Steam Uses Credit Cards For Australia’s New R18+ Age Checks

Valve has introduced mandatory credit-card checks for Australian Steam users seeking to access storefront pages for mature titles, establishing an indirect credit-card age check to meet the September 9 statutory deadline under Australia’s Age-Restricted Material App Distribution Services Code enforced by the eSafety Commissioner. Rather than integrating facial age estimation or identity document verification—routes recently adopted by Epic Games via Yoti and Veriff—Steam requires users to attach and retain a valid Australian credit card on their account as ongoing proof of adulthood before viewing R18+ games. The account-level gating mirrors Valve’s deployment model in the United Kingdom, applying verification directly at the browsing layer while standing alongside broader industry moves by distributors like Sony to impose age controls across digital gaming storefronts.

Philippine Agencies Discuss PhilSys-Based Age Checks For Social Media

Philippine government agencies have initiated public-private policy consultations exploring whether the PhilSys national identity system can serve as the foundational verification backbone for proposed social media age restrictions. Led by Cybercrime Investigation and Coordinating Center Undersecretary Aboy Paraiso alongside the Department of Information and Communications Technology and the Philippine Statistics Authority, the legislative proposal seeks to bar children under 13 from social platforms and impose parental-consent rules for users aged 13 to 17, drawing on prior technical discussions with Meta and Roblox’s planned PhilSys integration. While the National Privacy Commission emphasized the need for independent oversight to safeguard citizen data, the initiative reflects an expanding domestic footprint for PhilSys verification, which is already slated for mandatory banking authentication and facial recognition onboarding at LandBank.

Microsoft Tracks Passkey-Themed Social Engineering Behind Cloud Data Theft

Microsoft has uncovered an ongoing cyber espionage and extortion campaign where threat groups deploy passkey-themed social engineering to trick corporate employees into surrendering cloud account access. Active since May and linked to tracked actors Storm-3121 and Storm-3032—who feed extortion operations by ShinyHunters, Falcon, and Helix—the attacks do not compromise underlying passkey cryptographic algorithms, but instead impersonate IT support desks to steer targets toward adversary-in-the-middle phishing portals or illicit device-code authorizations. Once inside Entra ID environments, the attackers register rogue software authenticators and leverage Microsoft Graph to exfiltrate sensitive files from SharePoint, OneDrive, and email systems, underscoring the critical need for organizations to monitor new credential registrations and restrict unneeded device-code authentication workflows.

UIDAI Launches Native Aadhaar Face Authentication SDK And Test Sandbox

The Unique Identification Authority of India has launched an in-app native Aadhaar face authentication SDK alongside a dedicated developer sandbox, eliminating the legacy requirement for users to switch into the external FaceRD utility during identity verification. Built for Android and iOS deployments across authorized public bodies, banks, and fintechs, the integrated toolkit incorporates on-device liveness detection, anti-spoofing algorithms, and encrypted data channels to cross-reference live selfies against central identity records without auxiliary biometric hardware. Backed by an operational track record of over five billion authentications across nearly 200 organizations since 2021, the release forms part of UIDAI’s technical overhaul that includes privacy-focused mobile app architectures and domestic research into contactless fingerprint systems.

Germany Names EUDI Wallet d-you And Sets January 2027 Launch

Germany’s Federal Ministry for Digital Transformation and Government Modernisation has officially branded its national European Digital Identity Wallet as d-you, scheduling the state-backed mobile credential platform to launch on January 2, 2027. Operating within the European Union’s revised eIDAS framework, the free, voluntary application stores encrypted credentials on the user’s personal device, enabling selective disclosure for core use cases including age verification, legally binding digital contracts, and bank account opening. Around 40 public and commercial entities—including regional administrative bodies, universities, Deutsche Post, Vodafone, and Swisscom Trust Services—are currently validating relying-party workflows inside national test sandboxes ahead of full cross-border interoperability.

Instructure Adds Veriff Identity Checks To Parchment Transcript Network

Instructure has integrated Veriff automated identity verification into its Parchment academic credential network, giving participating institutions a mechanism to require government-ID and selfie checks prior to releasing educational transcripts. Currently undergoing pilot testing ahead of general United States availability in November across 6,200 colleges and 6,700 school districts, the system matches government credentials against a live selfie and routes high-confidence requests automatically while flagging anomalies for manual registrar review. Parchment retains only the verification outcome and associated audit metadata rather than raw biometric images, while laying the groundwork to introduce step-up verification for sensitive account alterations such as student name or birthdate updates.

Delhi High Court Orders Biometric Aadhaar Checks For All GST Registrations

The Delhi High Court has issued an interim nationwide order mandating that all new Goods and Services Tax applicants complete biometric Aadhaar authentication before receiving tax registrations, expanding what was previously a targeted risk-based requirement. Presiding Justices Anil Kshetrapal and Shail Jain handed down the ruling in response to identity-theft petitions where stolen PAN and Aadhaar records generated shell corporations responsible for Rs 150.85 billion in alleged tax evasion during the 2023-24 financial year and Rs 131.09 billion the year following. While revenue authorities have been granted until September 22 to submit operational objections regarding nationwide technical feasibility, the judicial directive accelerates government initiatives to scrub compromised and deceased identities from UIDAI databases.

Safetrust Launches Aliro Credential For Gradual Access-Control Migration

Safetrust has released the Aliro 1.0 Migration Credential, an enterprise physical card engineered to enable seamless infrastructure migration toward the open Aliro access-control standard without demanding immediate legacy reader replacements. Certified under Connectivity Standards Alliance specifications, the card interfaces with older proprietary door readers via NFC while housing organization-controlled digital certificates that can double as browser sign-in tokens, reducing organizational reliance on standalone FIDO2 hardware keys. Safetrust also enables credential provisioning across Apple Wallet, Google Wallet, Samsung Wallet, and its proprietary digital wallet, offering enterprises a transitional bridge as commercial smart lock manufacturers and physical identity management platforms expand native Aliro compatibility.

RAND Calls For Layered Oversight Of Biometrics And Digital ID In Security Agencies

A 59-page study published by RAND Europe for the UK Foreign, Commonwealth and Development Office recommends that defense and security agencies implement layered governance for biometrics and digital identity systems, cautioning that single-point human-in-the-loop safeguards are insufficient to prevent algorithmic deference and mission creep. Evaluating nine emerging security capabilities, the report urges public bodies to establish lifecycle oversight combining initial risk assessments, continuous technical training, independent external audits, and direct co-design with impacted populations to mitigate risks surrounding data sovereignty, privacy infringements, and algorithmic bias. The findings parallel warnings from the UK Information Commissioner’s Office and the Center for Strategic and International Studies regarding the espionage vulnerabilities and regulatory exposure inherent to massive centralized biometric databases.

–

By the ID Tech Editorial Team