Onboarding Under Attack: The 2026 Identity Verification Leaders

Hello everyone and welcome to this KuppingerCole webinar titled Onboarding Under Attack. I am Guillaume Teixeron, Senior Analyst at KuppingerCole and I'm going to present you the results of the last Leadership Compass about Identity Verification Leaders that was published last month. A little bit of housekeeping before we start. So you are all on mute, so don't worry for the noise. I will run a couple of polls during this webinar. I invite you to participate. It's always interesting for all the participants and for myself, obviously. If you have any questions, please put them in the chat.

I will do my best to answer them as clearly as possible, obviously, and obviously everything is recorded so you will get the recording and the slides in a couple of days. So first things first, the title of this webinar was Onboarding Under Attack and that's a little bit, maybe a little bit emphatic, but that's true. A few years ago where we were discussing attacks about an IDV solution, Identity Verification Solution, we were talking about presentation attacks. Today we see slightly different things. We see injection attack rising with generative AI rising. So it's just a parallel term.

The easier it is to generate fake videos, the more attack we do with injected fake videos. So injection attack, for those of you who are not aware of that, it's I don't use, I don't present a fake screen or I don't present a person with a mask in front of a camera, but I try to inject directly a video stream inside the app or inside my web browser so I fake the capture of the face or the human picture.

This is what it is about and it's easier and easier because now I can generate a video from from almost anyone because we've all published pictures of us on the social networks and the technology today that has generated video from that. So this is a kind of attack that is arising as I may say. So based on that, we do have all the providers of IDV that try to circumvent this kind of attack, but not only because they have much more to propose and they do differentiate themselves and that's what we are going to discuss along this webinar. That's what I'm going to present you.

So how do we distinguish the vendors in that field knowing the context? So the first thing I wanted to give you in that presentation, in that webinar, is that you have understanding of who are the leaders, how do they distinguish themselves, and how do you have to select themselves, what questions do you have to ask them. So because there are three things that should be considered.

First, identity verification is not only about onboarding. Today we will see that it used to be, but it's not only reduced to onboarding. The second thing is that attack has moved, as I presented you in the slide before, the detection has changed and has to change and there is a question about that. And IDV sits in the user journey. IDV is not a standalone solution, it sits in the broader journey and that has a lot of importance when you select the vendor you provide. So first things, as I said, we have two poles.

The first one here is to see where you use IDV, how do you run identity verification today. If you do, I'm interested in understanding where you have it because that's important, it gives us a kind of map of the landscape. So do you use only IDV in account recovery, step-up or i-transaction, workforce onboarding, age assurance maybe, or onboarding only? I'll give you a little bit of time to answer this question. You can do it along this webinar, the poll will not be closed, so feel free to participate if you need a bit of time.

And I asked you the question because a few years ago when we were discussing about IDV, most of the use cases we had was, okay, I am a bank, I want to open an account or I want to let my customer open an account remotely, and so regulation forced me to have remote onboarding protected by IDV, and so all the use cases were around, okay, how do I find advantage of remote? What you see is that today, IDV goes beyond simple account opening, it goes to account recovery, step-up verification, i-transaction, workforce onboarding verification, and also age assurance. Why?

Because the regulator forced most of the regulatory business or some of the regulatory business to use it, and why account recovery, step-up verification, and so on, because there is something that is really important, and it goes beyond IDV.

With the raise of passkey and with the raise of unphishable authentication means, we see that the attackers change the way they target their victims with not trying to phish something like SMS OTP or password, because now people are moving to passkeys, and this is a trend, and we can neglect that, but if your passkey deployment is still protected by a password when it's about recovery of an account, when it's protected by an OTP, when you're about doing step-up verification, then they will target this one, and this is where IDV has a room, has something to play in the sense that IDV is a solution that you can use to enforce your authentication journey with verifying the identity of the user to who you deliver the passkey, for example.

So IDV moves from only account opening to much more different use cases, but it also offers new possibilities that is about reusing what is done during the identity verification, because during identity verification, once is great, but something that is even better is that you can reuse the value of the identity verification to do much more. It means that you can reuse the identity verification for step-up authentication also, as I said, for a configuration, but also for re-verification, and as written, every new journey has the same question again, so reuse becomes the value.

You verify once, and then you have something that you can use to re-verify your ID, and this is where IDV is often combined with verifiable credential issuance, and this is something you see in large ecosystems like the Microsoft ecosystem, for example, where you use IDV once, and you have a verifiable credential that you can reuse to verify your identity later during a country query or step-up authentication. And the most visible part of the reuse of an identity after an IDV solution is the EUDY wallet.

So EUDY wallet is simply an IDV solution, a state IDV solution combined with issuance of verifiable credentials, and that's something that will happen end of this year according to the regulator, so we all know that it will not be the case. All the states will be expected to provide a EUDY wallet by the end of the year, it will not happen, some will, but some will be late. But the next step will be end of next year, all the regulated business should be able to accept the EUDY wallet as a proof of identity. So this is a trend, will that change fundamentally the market of IDV?

No, it will be something new that will have to be supported, but as I had written earlier this year in a blog post, that will be only something new. The IDV market will not be drastically destroyed by the EUDY wallet next year, because we will see the adoption, but it's highly probable that the adoption will be not 100% next year. But it will be a new way for people to verify their identity and they will expect some of the related parties they are working with to accept it, and some of them will be forced to accept it.

So that's something that will disrupt the IDV market, it will not kill the IDV market, but that's a component to take into account and that's something the vendors of solutions need to provide in the coming months, or at least to provide solutions to support this extra way to verify their financial that comes with the EUDY wallet. On top of that, as I said, the market changed because there is no new way to verify identity, but also there is no way for attackers to prove their identity very quickly. So the presentation attack remains something.

So presentation attack in front of the sensor, you have an attacker using a mask, a screen with the all printed photo, and it works. Not for everyone, but in the good condition with enough time, we know that some attackers can bypass the solution. Injection attack, as I said earlier, is the trend because of Gen-AI and the new video. So you need to have strong pipeline hardening to make sure that nobody can inject video in the IDV pipeline. So vendors need to invest to detect that something is injected or that the video comes from a Gen-AI process.

That's two different ways they have to address the problem. First, enforcing the acquisition pipeline, and second, detecting that the stream is not a genuine one. And the third one that is a combination of both is the generation of synthetic documents. So with the Gen-AI, we also see documents generated based on existing templates or completely new documents. So either they modify the images coming from a genuine document, or they generate completely new images, and very good ones. So these are the different things.

And for all these kind of attacks, vendors must provide a solution, and vendors do provide a solution. So as a buyer, what is important to check when addressing that topic is that there are two different ways of testing the solution, and the vendors need to provide both certifications or address both topics. The ISO 3107-3, and this is the test of attacks in front of the sensor. So we test that attackers with a mask are captured or detected. And the CENTS-18099 is this one, an injection.

So you test that someone cannot inject a video, a genuine Gen-AI video, in your capture path, so you are able to do that. So these are two different things, addressing two different kind of attacks, and you need both as a buyer, you need your vendor to provide you both certifications, because these are two different things you have to deal with.

Obviously, I have to say a word about the acquisition through NFC, especially for document capture. We know that document capture from a video has weakness, as I said. There is something that is more robust than that, but has also some counterpart, this is the NFC acquisition. So most of the passports provide NFC, all of the passports provide NFC. So chip reading is obviously better than photo acquisition for document, because you do provide your cryptographic verification of the document beyond the image analysis.

So even if you have to do an image acquisition of the MRZ, you will read the NFC chip, and you will have a cryptographic signature of the information. So this one is obviously much more robust to attack. The counterpart of that is the user experience. So there are two different views on that. Mine is that it's not that difficult to do NFC acquisition. Some people say that it's a burden to do NFC scanning because of the phone, because of the data, and you need to drive your user to do it properly.

So this is something to evaluate, this is something that you need to discuss with UX designers when you do acquisition, always the provider of the solution. But this is something that is a solution to fake documents or video of fake documents. So this slide, to close the topic of the detection and summarize, so there are tests that will give you assurance that your provider was tested against the most common attack. You have as a buyer to provide, to ask them to the vendors, and you as a vendor has to provide them to your buyers. It's a strong assurance that things are done properly.

And you have also a way to implement things with NFC, for example, that is more robust than some other, with some user experience. Probably a burden, I lost my word, but you got it. So detection of attacks is very important because we see, as I said, IDV scope being broader and broader, but we see also attacks being easier and easier. So detection is a huge topic when you discuss about IDV, but detection is not the only thing you have to consider.

As written inside the report, we do have several with specialist depths in biometric liveness, decay detection, document forensic, NFC verification, but that face constraints related to global reach, deployment scale, partner coverage, or completeness. So when you look at the market of IDV and the providers, the vendors in that market, obviously being robust to attack is very important. Having a strong liveness, having a fair liveness is very important. Having a good document coverage is very important.

And defect detection is very important, but it's only a part of the equation because we do see vendors, as written, that have this expertise in biometrics, expertise in document acquisition, but IDV sits in an ecosystem and you have to properly accommodate your solution with this ecosystem. So having, being an expert in biometry or document acquisition is not enough. You need to grow more features and more capabilities.

And that's why when we evaluated the vendors in that market, we consider six different capability areas that have to be covered by the vendors and that are covered by the leader. The first, obviously, document verification, the broader, the better. Biometric verification, the more robust, the better. Additional method, because it's good to support document acquisition and biometry, but also being able to verify identity attributes from all those sources is bring also extra value to the IDV process. Automation and AI, so everything you can automate in your process is very important.

Privacy, the way you keep data private, biometric template, PII, and so on, and orchestration. How do you orchestrate your own user journey, but also your user journey inside the global ecosystem? And at this game, the winner, if I may say, or we have a group of winner, you can read on the side. There is a group of vendors that play all on all those capabilities.

Obviously, we do have also product leaders that you can see on the bottom right, and innovation leader that you can see on the top left. These are vendors who are either experts or prove a deep expertise in some of the capabilities, like biometric document acquisition, but who do not reach the breadth of the other leaders, or on the contrary, vendors who have an extensive coverage of the capabilities, but suffer from a lack of expertise in some of the key dimensions. What separates the leaders in what they build?

So one of the things is that automation at global scale, so we see a leader who implements way of managing the world workflows almost automatically, where the workflow is built from templates, based on no-code platform, where it's very easy to deploy everything at scale, with customization of the workflow per user journey, per demography, and so on. And this is also the orchestration and configurability part of the equation.

We see verification carried into authentication, so vendors who, as I said earlier, don't stop at the identity verification, but also issue credentials that can be reused later during authentication process. We see leaders that integrate with IDP solutions, and when I say integrate, it's not only offering an API, but also being available in the marketplace of the biggest IDP, where with a few clicks you can deploy the solution.

One of the things that is tremendously important is the way vendors and leaders give you access to fraud and data analytics, not only inside their own solution, but also in a way that it is integrated with the whole solution you might want to deploy, so you can investigate by yourself and do a deep dive in the transaction. You don't only get a yes or no, but you have scores about generative AI detection, you have scores about presentation attacks, threshold, and so vendors or leaders provide you this kind of depth in terms of fraud and analytics.

And obviously, trust, citizen, identity, and web. Supporting documents, paper-based documents, or state-based documents is something, but also supporting digital ID that exists in some European countries gives them an advantage compared to the US and so on. So these are the pillars of the capabilities that distinguish the leaders between themselves and from the rest of the vendors. So beyond the leaders, you do have also some challengers, so I said a word about that earlier, but I wanted to say more about them.

You have some of the vendors who are really strong in one dimension, so we do have vendors who master the biometry, for example, we do have some vendors who master the document acquisition, and it may be enough for some of the use cases where you need an expert in biometry, you need an expert in document acquisition because you don't really care as a buyer from a full platform and you prefer something that is more targeted. So some of the vendors in the report do provide this kind of ability.

They are in the innovation leadership part, so if you look for someone who is really good in the biometry, we invested lots of money in the biometry, but maybe lack of explanation, you do have some vendors. Same for document acquisition, there are leaders and most of the time those challengers are used by the leaders in their own platform because they are providing deep expertise inside those fields.

And on the other side, you have vendors who are more OEM based and who prefer to give you a deeper orchestration abilities rather than deep expertise inside the core features, and you will find them also in that report. So the second point I wanted to share with you, or the second question I would like to ask you was, how many identity verification providers does your organization use today?

Unknown, one, two, three or more? That's the question that has become somewhat important and I would like to, I would be interested to know your feeling about that or to know, okay, I see the poll, so one, three more known. I let you wait a bit of time to answer.

Anyway, you can answer later. So what we see is that buyers, the bigger the buyer are, the more provider they do use, and many organizations already use several providers. There is a very good reason for that because the expertise may differ from vendor to vendor. So even the leaders do most of the time, several different engines, because it's really a strong investment that is needed in this core technology. And so most of the time, the leaders will work with either an in-house version of the core brick of biometry and document acquisition and some of the specialists.

And it's important because as I said, and I repeat myself, but it's very important, the expertise in biometry and document acquisition require lots of investment. And so it's very important for people providing this kind of solution to have the best of the solution, but also to be flexible because it's very hard to cover all the use cases. So having different vendors and having different providers of the core technology is a choice that is made by lots of buyers and makes a lot of sense. Demographic coverage, document, the difference of document and so on, require several providers.

Working with a single provider may make sense in specific use case where there is very low diversity in the user journey or in the demography of the final user. The larger is the final user demography, the larger is the number of use cases that the solution should provide. The more incentive there is to have several providers to cover everything at the right level of performance. And this is where orchestration makes even more sense because the moment you have several providers, at that moment you need a stronger orchestrator.

And so vendors who are able to orchestrate their solution and the experts in the field you require have clearly a leadership in that field. So I promised you at the beginning five questions you should ask to select your vendor. And so here they are. And the first thing is a question you should ask yourself, which journey beyond onboarding must it serve? Because it will make a difference between a solution that is designed only for consumer onboarding but a solution that should be really for password recovery, for step-over verification, or for edge assurance. You don't ask the same thing.

You don't ask the vendor to provide you the same thing. And that's important to have a plan and to have a good understanding of what user journey you want to use or you want to protect. Something you should ask to the vendor is injection and presentation test evidence. What do you have? What do you do? Who gives you the assurance? Who gives you the certification of the test? What is your process? What is the frequency? How many times did you pass the test for each release, once a year, once all the three years? That's something that is important. Things are moving fast on the attacker side.

Things have to move fast on the side, unfortunately for them, but that's the reality. Something that has an importance, what is native and what is OEM. It's important for you to know if the core bricks of the solution is natively provided by the vendor or is from an OEM.

Obviously, the accountability will be on the vendor, but it's important to know if, for example, the algorithm, the biometric algorithm was certified by NIST. If yes, where does it come from or not? That's the question to ask. Can the verified identity feed recovery and authentication?

So, as a vendor, do you stop telling me that yes, that identity is verified in the sense that this user face matches the document provided and the document looks genuine? Or do you issue a verifiable credential that I can reuse later in my process for recovery later or authentication? That's something that makes a difference. And what is your position regarding reusable and wallet-based identity?

So, everybody knows that EUDY wallet is not live today. Yes.

So, supporting it is telling that to support it today is nonsense, obviously, but there are tons of mobile or digital identity in the field today. Do you support them or no? What is your strategy? What is your roadmap? Do you plan to support that? Yes or no? These are questions you should ask to the vendor. And I will finish on that three points I would like you to go with after this webinar. And after that, I will look at the question, if any.

First, identity verification left the onboarding gate. So, identity verification go beyond the onboarding.

I say, so, it should be used in account recovery. It should be used for step-up verification. That's a tool that can enhance the security of the identity lifecycle. The attack move from the face to the pipeline.

So, the attack move from the presentation to the injection. Your algorithm has to be robust, but your pipeline has to be robust.

So, it means that application hardening should be part of the equation. Fraud detection signal need to be part of the equation. Fraud monitoring goals need to be part of the equation because the attack is not someone presenting a fake video or mask in front of your camera. It's much more elaborated on one side and simpler on the other side.

So, that's really a thing. And the last thing is the leaders that were evaluated in that field obviously work on deep fake detection, obviously work on being the best or working with the best on the biometry matching and document acquisition, but they go beyond that. They go into the direction that let them integrate their solution in an easy way in broader ecosystem and give you access to a monitoring that is strong enough to give you confidence and trust in what is verified.

And at the same time give you the flexibility of tweaking the user journey according to your need from simple age assurance if you need to the deepest identity verification combining multiple scanning with face but also with additional attribute verification and so on and so on.

So, the action I encourage you to take if you take anything from that webinar is to, based on this criteria, revisit your next selection criteria and based on that select the vendor on at the same time the expertise in the core value of the identity verification but also in the in the ability to fit in the in the identity ecosystem. So, I see that there may be some questions.

So, I will take some questions. To protect against injection attacks, are browsers still a recommended plan for IDV or is a native app to prefer.

So, the fact is that IDV solution vendors provide IDV solution for browsers and for browsers. Native app. Something you can do only with native app, for example, is NFC scanning.

So, if you need NFC document scanning, you will have to go with native app. It needs some vendor and some web solution. Most of them provide native app and native SDK.

And so, I don't think that there is any recommendation. The recommendation is to use the one that fits the best in the user domain. Both need to be protected and some are easier to protect than others but some are also easier to use than others.

So, again, it's a balance between security and user convenience as everything in our world. So, the decision is not only based on what is the most secure but also what is the most convenient. Do you see a trend in verified credential format being supported by IDV?

So, the trend is IDV wallet in Europe and mobile driving license in the US. So, this is the trend we are all expecting. What is true is that everybody waits for the IDV wallet to be launched. I think there is everyone is waiting that to say that, okay, it's live, we do support that. Verifiable credential will be definitely something that will change the market. As I said at the beginning of the presentation, I don't expect it to be 100% soon. There will be a transition period. What I see is that IDV solution supporting or using IDV solution is a trend.

Now, it has to be multi-format for the months and the years to come and we will see what in Europe and we will see what UDI will be in the future. What we see with mobile driving license in the US is that the takeoff is slow. Some states put them out a few years ago and vendors start to support them.

So, verifiable credential is a thing. Unfortunately, I think that the takeoff is slower than I was expecting, but I still think it's a good solution and that's the solution of the future. As IDV extends beyond onboarding into the full life cycle, we see mutual encroachment. IDV vendors move to IAM territory where primary IDPs push for consolidation. How will this play out? Will IDV be natively absorbed into major IDP or maintain or specialize more? That's a very, very good solution. Very good questions. I have no clue in the sense that I predict the future.

I would say that the bigger will absorb the smaller. Now, we have pretty big players who are doing IDV, but it's a small part of their game. There will be consolidation. That's obvious. As you say, both are moving in the direction of the other, so there will be consolidation. I'm very bad in predicting the future, as I said earlier, but we clearly may expect that and we do have some IDP providing IDV solutions. Will IDV be able to survive as a standalone solution? No. That's my guess.

But will IDV provider move to something new like verifiable credential provider or orchestrator or will they move to IDP solution and survive? That's something. I don't think that being standard, providing IDV as a standalone solution will be enough in the year to come. What is EUDI worth with PID worth if including a photo is not mandatory? That's a very good question and I think that's why some of them were done.

Obviously, EUDI is as strong as the IDV solution used to provision it. If there is no photo, so there is use case where it was not expected. I think that there was a modification in the specification to include the photo, so clearly I think that the future is making the photo mandatory and having the matching done against the photo and having the photo in the verifiable credential. I don't really see the point of not having it. Would you also recommend reuse between departments? One IDV for HR, candidate onboarding, IEM onboarding and eldest verification. All of these are different disciplines.

So this is where vendors and leaders are good at. They are good at using the same core technology in multiple forms and giving you ability to create workflow for different departments, HR, candidate onboarding, IEM onboarding, eldest verification and at the end either giving you a yes or no or issuing a verifiable credential. This is where the leaders have something to provide you. So some of the vendors, yes, to answer this solution, some of the vendors can cover all those use cases and they are designed to provide a use solution for all those use cases with the same technology components.

In an easy way, I mean, because obviously it's always possible to integrate a solution that will follow all the path, but the good vendors provide you no code platform where you can tweak your workflow according to your department, your user journey, your user demography and so on and so on in an easy way. That's where they have something to say about that. Which solution today would you name to protect onboarding your past case, let's say in the context of mTRI-ID? So I don't have to name anything. If you go to mTRI-ID, you will see the list of vendors that are provided.

I suppose I remember there are four that are already registered in the ecosystem. So I have no solution to highlight. You may see them by yourself. As I don't remember all of them, I will not quote any of them, but if you go to the mTRI-ID website, you will see the list of IDV providers that are supported. How will you categorize the use case anti-money laundry regulation as onboarding? So the question is, how would you categorize the use case anti-money laundry regulation as onboarding?

So to some extent, yes, because the regulation forced you to do identity verification at the onboarding, but these are two different things. I'm seeing one is the consequence of the use, but I have nothing smart to say about it. I don't know. I think the last question, so if there is no more questions, I will. Thank you. I will thank you. So there is no more questions. I don't see any more questions in the chat. So thank you very much all for your time. I hope you enjoyed this webinar.

Of course, as usual, if you want to contact me, here we have my details at the end of the slide. Feel free to download the slide. Feel free to challenge me, give me your opinion. If you disagree, I'm more than happy to discuss with you about that. Let's talk about that as you go. It's a pleasure to exchange. So I'm happy to be challenged and I'm happy to when people have different opinions because it's all the time very interesting. Thank you very much for your time and thank you for listening and enjoy.