3

I'm working on improving the security of an application for something much like paying child support. With that said, if the wrong person gains access to our application, it can become very dangerous for the user. Sadly, there have been several instances where an ex or current spouse gained access to an account, or signed up as one of our users.

The biggest challenge is our demographic: many of our users are people who need to protect their information from someone they could be living with, work with, knows quite a bit about them, or still shares a device that can be used to access their account. Additionally, some of our users live in very remote areas, and may lack the means to ever meet with a worker in one of our offices. Without a face-to-face interaction, it's hard for us to be certain who is really creating an account or requesting access.

At the moment, part of our security process includes sending a letter in the mail with a verification code. However, many users hate this, as it can take up to two weeks for them to receive the letter. Additionally, if they're still living with their ex or spouse, there's no way to know which one of them will receive the security code.

In regards to security questions: which questions would a spouse not know? If anyone could guess the answers, it would be them. Also, if the account was created fraudulently, this would only make things worse for everyone.

We also cannot mandate users to meet directly with an employee for verification, as some of our users don't have the means to travel to one of our offices.

When it comes to using SMS and a cellular number, there is still concern that a malicious person will just use their number when creating a fraudulent account, or has access to the user's cellphone.

Without being able to meet with a person, how can you best be certain that they are who they say they are, instead of a well-informed ex, when creating an account or requesting a password/username reset?

  • 1
    Have you thought of a real phone call instead of texting and then having some conversation? For once the voice most times shows if you are dealing with a man or woman which can be used to weed out the wrong person. Also, trained personal might be able to detect more suspicious behavior and then mark the account as suspect for further investigation. – Steffen Ullrich Jun 1 '18 at 19:58
  • 1
    there's shared secrets, like your mail code, and time of first use, where you trust whoever you talk to first, which likely isn't a bad fit for your model. i was thinking you could use time as a factor as well; have the user conact you in the future at a pre-determined time. Any contact outside that window invalidates the account, even if all other factors match. – dandavis Jun 1 '18 at 20:04
  • 1
    @invot: I don't think there is a single and simple solution. The idea is instead to do simple things first and if they are not enough to clearly find out who do you deal with put more efforts (and more time and costs) into it. Watching the kind of voice is a simple solution which already makes misuse harder (but not impossible in all cases). Also, operators can be trained in psychology to look for more suspicious things since most people act different when they do wrong things. – Steffen Ullrich Jun 1 '18 at 20:11
  • 2
    @invot you are trying to determine positive identity without a conclusive method to establish identity. This situation is why we have photo ID and why we have to show that ID in person when the services that ID grants access to is important enough. Some countries are working on a "Digital ID" that uses cryptographic tools to do this kind of thing digitally, but most countries are not ready to try this yet. – schroeder Jun 1 '18 at 20:15
  • 1
    Set up a webcam session (that you can record) where they will show themselves and some kind of government issued ID (in sufficient clear view so that you can read what is written on it, or ask them to send it to you before and just compare). Some systems work like that in France to rent a car on the street: you sit in a cubicle (on the street) where you have a live webcam session with some support agent in order to record your driving license, etc. to open your account. – Patrick Mevzek Jun 1 '18 at 23:17
4

There are a few options now.

  • In real life

    1. hire a notary.
  • Online with (outsourced) human

    1. Online notary using a web cam
    2. scan and verify identification (drivers license, etc). There are services that do this but setup an elance/upwork contractor account to see it in action. Also look at the INS form that employers must use to verify their new hire is a US citizen.
  • Online with human you employ

    1. call the person
    2. ask the person to send you an email while you're on the phone with them
  • Online automated

    1. text, and voice call
    2. send snail mail
    3. layer / parent / friend voice verificationn
    4. deposit cash into a bank account to verify they have access
    5. use plaid / yodlee to verify they can access a bank account (this is similar to what mint.com does)
    6. cell phone providers have an alliance that provides cell phone to user information

Not everyone of your customers needs the full level of access though.

A customer should know which of the options will work for them.

The best bet is to use a bank account - banks have Know your Customer laws requiring them to accept IDs before opening accounts. While not full proof, it's a great improvement over what is out there otherwise. And if your app is financially related, it's not a huge step to ask the user to login to their bank account.

What not to do:

  1. DO NOT use security questions
  • This would work wonderfully as we're negotiating a way to implement bank payments into the system anyway. Bank verification could also be automated which would reduce labor hours. And it could be done within 48 hours. Our current process can take weeks. – invot Jun 4 '18 at 14:13
2

Without being able to meet with a person, how can you best be certain that they are who they say they are, instead of a well-informed ex, when creating an account or requesting a password/username reset?

You can't. You can't really know someone without getting to know them.

In-person investigation is likely going to be a part of any reasonably reliable identity verification.

For more information, you could check out the US Government's take on the matter... some of which is contained in FIPS 201-2 Section 2 (https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf).

  • You can't know for certain even if you know them. Think about Russian spies who infiltrate the US government - lots of people know them. Identification isn't ever certain. It's a reasonable best guess. And I do agree you have a better chance of guessing right if you meet someone. But this questioner's threshold isn't that high. In most cases if the guy looks like a woman on a webcam, it's not him. – Jonathan Jun 1 '18 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.