Digital identity: A complete guide
Today, we use the internet in ways that were unthinkable when it was first created more than 40 years ago. With a single swipe or one-button click, we can connect with friends online, make purchases from around the world, apply for jobs, complete college classes, access banks, invest our money, shop for a house — even log into work remotely.
While this migration online has brought many benefits, it hasn’t come without challenges. Here’s a big one to think about: How can we trust that someone is who they say they are online, especially with the specter of generative AI growing more and more capable every year?
This is where the concept of digital identity comes into play.
Below, we explain what digital identities are, why they’re so important, and how they can be established. We also walk through the different ways you can establish and confirm a user’s digital identity to keep your platform safe from fraud.
What is digital identity?
A digital identity is a collection of data, activity, behavior, and other attributes that can be tied to a single individual in a way that differentiates them from everything else. While it is not the same thing as your digital footprint, the two concepts are similar.
Individuals rely on their digital identities to navigate the web in a safe and secure way, accessing accounts and services that belong to them while keeping intruders out. Meanwhile, online businesses often seek to understand their customers’ digital identities in order to identify and mitigate fraud, inappropriate data access, and other risks.
Digital identity examples and use cases
Different businesses in a variety of industries leverage digital identities to ensure that their platform or services are only being accessed by the people who should have access to them. Some common use cases include:
Employers looking to protect their digital systems to ensure that only employees are able to access sensitive corporate information — using workforce IDV, for example
Online marketplaces and other e-commerce platforms that want to limit transaction fraud in order to protect both their finances as well as other users
Healthcare providers that need to safeguard patient health information under HIPAA
Financial services providers that are required by law to establish a customer’s identity — digital or otherwise — before onboarding them
In each of these use cases, a business or organization might leverage multiple different aspects of an individual’s digital identity. An employer, for example, might require an employee to log into their account using credentials, while raising suspicions if this takes place on an unfamiliar device. A financial institution, on the other hand, might collect a customer’s government ID during initial onboarding while scanning their social media profiles for other risks.
How does digital identity work?
As noted above, a person’s digital identity is a collection of multiple data points that are tied to various accounts and help paint a picture of who that person is. These pieces of data are called digital identifiers, and include things like an individual’s:
Date of birth
Username and password
Email address
Phone number
Fingerprint and/or face data
IP address
Browser fingerprint
Device fingerprint
Physical ID numbers
Search history
Purchase history
Cookies
Some of these digital identifiers are constant, rarely (if ever) changing over the course of a person’s life. This is true of birthdays and ID numbers, for example.
But other identifiers can and do change:
The IP address associated with an individual can change depending on where they log into their account, for example, or whether they are using mobile data or WiFi.
A single individual may have multiple device fingerprints if they own (and use) multiple devices.
People can choose to create a new email address for any number of reasons.
Behavior-driven digital identifiers — like their search history, purchase history, and presence (or lack) of cookies — are constantly changing every time an individual does anything online.
What all of this means is that a person’s digital identity is dynamic. It’s constantly changing and evolving over time, which can pose a challenge for businesses that leverage the digital identities of their customers or users for security and access purposes.
How businesses can establish a person’s digital identity
If you require your users to create an account in order to use your platform or service, it's important to have a plan in place for establishing and protecting their digital identity. Some options to consider include:
Authentication
Identity authentication is the process of determining whether or not the person attempting to log into an account is actually the account’s owner. Any business that requires users to create an account on its platform must have an authentication strategy in place to facilitate a secure login.
At its simplest, authentication requires a user to provide a username and password to log into an account. Two-factor (2FA) or multi-factor authentication (MFA) up the ante by requiring a user to provide an additional piece of evidence upon using their login credentials, such as:
The answer to a security question
An authentication code
A selfie or fingerprint scan
Multi-factor authentication is especially effective at defending against account takeover (ATO) fraud completed via password spraying, credentials stuffing, AI phishing, and other attacks. But it’s important to note that even MFA may not be able to fully protect against fraudsters leveraging AI-powered social engineering tactics at scale.
Keep learning: Identity verification vs. identity authentication
Verification
Identity verification (IDV) is the process of verifying a digital identity to a real-world, physical identity. While authentication is used to determine whether or not a person should have access to an account, verification is used to determine whether or not a person actually exists and is who they say they are.
Identity verification is especially important for online businesses subject to regulations requiring any form of Know Your Customer (KYC), such as the financial industry and online marketplaces. It’s also helpful for industries where trust matters, such as online health and education platforms.
The type of identity verification you choose varies depending on the laws you’re subject to, unique customer expectations, and the level of assurance you need. IDV options include:
📗 Curious to learn more about the top digital identity players across the market? Explore the 2024 Biometric Digital Identity Prism Report to understand and evaluate different digital identity technologies and solutions
Reporting
Sometimes, identity verification on its own doesn’t provide enough information about an individual. In these cases, it may be possible to run a variety of reports to gather additional context about who a person is — both online and offline:
Phone & email risk reports: These reports return information like age, spam scores, and more to help you evaluate the reputation of an email address or phone number provided by an individual.
Social media risk assessment: These reports take an inventory of the individual’s social media footprint to help you decide whether you want to work with them.
Watchlist and sanctions list screening: These reports compare information provided by the individual (such as name, date of birth, and contact information) against information contained in official watchlists and sanctions lists.
Adverse media report: These reports scan media databases for negative mentions of an individual. This can include criminal convictions, involvement in lawsuits or disputes, and other negative mentions.
Reports help you paint a more robust picture of who a person is and can help you gauge the risks associated with working with them — particularly important if your business is subject to Anti-Money Laundering (AML) regulations and you’re looking to hire remote applicants.
Link analysis
Link analysis is a process of determining how a user is connected to (or linked with) other people on your platform or within your database.
Businesses use link analysis primarily to identify instances of fraud. For example, if multiple accounts all share suspicious details (like an IP address, device fingerprint, browser fingerprint, or payment details) it may suggest that a single user has created multiple accounts on your platform for some reason.
While this may be legitimate, it could also be indicative of referral fraud, promo abuse, and other nefarious actions. It may also point to a ring of fraudsters on your platform, all sharing the same details.
Likewise, link analysis can help you understand if an account belongs to a real person or if it may be a shell account. You can do this by analyzing an account’s connections to other accounts to determine whether it follows a natural, expected pattern, if it’s random, or if it’s generally suspicious. Like reporting, link analysis offers one more layer of context and detail to help tie a person’s digital identity to a real-world counterpart.
The role of digital identities in identity verification
Identity verification is all about ensuring that a person or business is who they say they are. For some companies, like financial institutions and online marketplaces, it’s a necessary part of complying with Know Your Customer (KYC), Know Your Business (KYB), and Anti-Money Laundering (AML) laws and regulations. For other businesses, it offers a path to reduce and mitigate other types of fraud risk.
Digital identities can empower you to comprehensively verify your customers’ identities. While this isn’t a comprehensive list, here are some of the ways you might leverage a digital identity as a part of your broader IDV strategy.
Social media profiles
Not every person has a social media profile, but an individual’s presence on social media (especially across multiple platforms) can go far in helping you establish whether or not a person is real, as opposed to synthetic identity fraud.
Profiles can also give you more information about an individual to inform your risk analysis. Photos on a person’s social media profile, for example, can be compared against selfies submitted by a person during onboarding in order to identify potential cases of identity theft.
Personal details on a profile, like a date of birth, can be compared against information submitted by the user and found in official databases. Social media posts in general can serve as a source for adverse media screening, amongst other uses.
Device identities
When a user signs up for an account, if you collect information about their device — such as their device fingerprint, browser fingerprint, IP address, etc. — you then have the ability to recognize that device when the individual tries to log into their account in the future. This can provide additional assurance against account takeover (ATO) fraud by allowing you to trigger reverification or heightened security measures when a user tries to log in using an unrecognized device.
Collecting a user’s device identity also gives you data to help identify fraud rings on your platform. For example, a single individual might use one phone to create multiple accounts on your platform to take advantage of freemium features or to engage in marketplace referral fraud.
Keep learning: What is account creation fraud?
When an individual signs up for an account using their email address, it’s important to ensure that they actually own that email address and that it isn’t fake. Email verification gives you that assurance and makes it possible to leverage two-factor authentication (2FA) in the future as a part of the login process or during reverification attempts.
You can also use an individual’s email address to perform an email risk report, which can help you uncover helpful information about an email address, including:
How old the email address is
Whether or not it is tied to spam activity
Whether or not it is included in any blocklists
And more
Selfies and government-issued IDs
By collecting and verifying a customer’s government-issued ID when they open an account on your platform, you are linking their account to an official form of identification, allowing you to deploy database verification and other methods — offering some of the strongest assurance that someone is who they say they are.
If you’re worried about user experience friction, you can use digital IDs like mobile driver’s licenses and e-passports to speed up your verification process.
Similarly, you can collect a user’s selfie for identity verification during the onboarding process in order to link their face to their digital identity within your system. Then, you can require the user to upload a selfie as a means of two-factor authentication when logging into their account or during reverification. For added identity assurance, consider collecting both a photo ID and selfie, and comparing the two to protect against the risk of stolen IDs.
Get the best digital identity verification software with Persona
Persona’s flexible digital identity verification software was designed to give you the power and freedom to build an identity verification strategy that makes the most sense for your business — including components of a user’s digital identity.
Here’s a quick overview of how Persona can help you verify identities online:
Collect and verify selfies, government IDs, and other documents
Cross-check information and evidence submitted by your customers and users against authoritative and issuing databases
Detect passive and device signals to better screen for fraud
Run ancillary reports like adverse media reports, watchlist screenings, email risk reports, and more for a more robust risk assessment of each customer
Streamline your IDV processes with the right level of automation for your needs while leveraging progressive risk segmentation to manage friction and keep conversions high
Ready to learn more about how Persona can help you get your digital identity strategy right? Contact us today for a free demo.
Frequently asked questions
How does digital identification relate to identity and access management (IAM)?
Identity and access management (IAM) is a collection of processes and techniques that organizations use to secure their data and systems. The goal is to ensure that only individuals (employees, users, etc.) with appropriate access privileges are able to log into a particular account, access sensitive data, or otherwise interact with the organization’s systems.
IAM is a multi-pronged effort, often utilizing a variety of different technologies and methods to secure business systems. That being said, in order to implement IAM of any kind, the organization must first establish a digital identity for each of its users.
What are the main digital identity benefits?
For many online businesses, digital identities are a requirement. For example, without the capacity to establish and manage digital identities for their users and sellers, banks and online marketplaces, respectively, could not operate in compliance with the law.
Digital identities also offer a number of benefits to businesses not required to establish them under law:
Fraud prevention: Establishing and verifying a customer’s digital identity gives businesses the opportunity to reduce fraud on their platforms, including account takeover fraud and identity theft.
Information security: Securing the digital identities of employees streamlines identity and access management (IAM) to protect sensitive company or customer information.
Friction reduction: Generating a more comprehensive digital identity for users — like their devices — can help reduce friction during sign-ins, purchases, and at other key junctures.
Together, these digital identity benefits can lead to an improved customer experience, cost savings, and an all around more profitable business model.
What are some digital identity risks for businesses?
The primary risk associated with a digital identity is that it essentially aggregates all of the information known about an individual into a single profile. This profile, if compromised, can lead to significant challenges, including the risk of:
Identity theft
Privacy concerns
Breach of sensitive data
Legal and regulatory action
What are the best practices for digital identity security?
If your business has decided to leverage digital identities, it’s essential that you take appropriate measures to both establish and secure those identities. Some best practices include:
Deploying a risk-based framework for identity verification and authentication
Leveraging multiple types of verification to establish a user’s digital identity, and multiple types of authentication when granting access to an account or systems
Verifying and authenticating digital identities continuously, as opposed to a one-time process
Ensuring that your company’s digital identity policies are in compliance with all relevant laws and regulations, which may include KYC and AML laws, anti-fraud legislation, and data privacy and security rules
What are the top digital identity trends for businesses to be aware of?
Digital identities are constantly evolving. What years ago consisted of usernames and passwords has grown to include true identity verification, recognition of trusted devices, and a multitude of additional data sources offering a much more comprehensive view of an individual’s digital footprint.
While it’s impossible to know how digital identities might evolve in the future, some trends to be aware of include:
Expansion of IoT technologies: As the Internet of Things (IoT) continues to expand, more people will routinely use things like smart speakers, smart cars, wearables, and other technologies. Eventually, businesses will likely see those devices as a potential means for their customers to interact with their platforms. As such, they will likely eventually be included in an individual’s digital identity.
Deeper dependence on AI: In many ways, AI allows for a more accurate and cost-efficient analysis of digital identities than is possible via manual analysis. As AI continues to advance, it’s likely that more and more decisioning will be handed off to it instead of human workers.
Widespread adoption of digital IDs: While a handful of states in the US currently offer digital driver’s licenses, they have not been adopted on a widespread basis. In the coming years, it’s likely that more states will allow their citizens to leverage these IDs. More widespread adoption will lead to changing consumer expectations, requiring businesses to have a plan in place to accept digital IDs for things like identity verification, age verification, etc.
Population-level insights: Advanced data analysis techniques like link analysis make it possible to understand how these identities are related to one another, potentially helping surface fraud rings and other high-risk situations. As this technology becomes embedded in more software solutions, it will likely become much easier for businesses to leverage population-level insights for a variety of use cases.
