Artificial intelligence can support identity monitoring through document data collection, facial comparison and suplanting sign analysis. Each task provides different evidence: reading an identification, finding face similarities and evaluating capture answer different questions.
Let's think about a hypothetical example: a person applying for credit from his or her cell phone. He or she sends an identification and catches his or her face. Before continuing, his or her company needs to evaluate his or her document, to have his or her relationship with his or her person and to determine whether his or her interplay indicates of manipulation.
The corporate question is what evidence can be put together and how to use it to make a risk-proportional decision.
How are artificial intelligence used to verify an identity?
A process can combine models of automatic learning, rules, source consultations and human review. Not all solutions use AI in the same components or offer the same range.
Documentary reading and extraction
The optical character recognition, known as OCR, converts text of images or documents into information that can be processed. Your implementation can use automatic learning models.
In an identification, you can support field extraction to reduce manual transcription. But reading a name correctly doesn't prove that the document's true. Extracting and validation have to be evaluated independently.
Documents analysis
According to its design, a solution can analyze visual inconsistencies, fields and signs of impairment. It's useful to ask what documents they admit, what elements they check and what limitations they have when they get low quality photographs.
A favourable result should be interpreted within the scope of the analysis undertaken.
Facial Comparison
The biometrics uses physical or behavioral characteristics to support people's recognition. facial comparison one by oneand contrasts a sample with a reference, for example a capture of the applicant with his document's photo.
The similarity found does not answer all the questions of the process: it still matters where the images come from and what evidence supports the declared identity.
Liveness detection and Detection of Input Attacks
The Expression Liveness detection usually used for checks evaluating genuine presence signs during a capture. detection of presentative attacksor PAD, analyzes attempts to mislead the sensor using elements such as images or reproductions.
A specific reference is FATE assessment PAD NISTfocused on passive algorithms of software and two-dimensional visual material. Its range illustrates why it's best to review what was evaluated, rather than assume protection from any attack.
Additional signs
When the process looks at them, it can include checks about the capture, consistency of data or conduct of applications. He asks what the supplier actually uses, what result each delivers and how they affect the decision.
It is also necessary to distinguish these checks from all the activities of KYC - Know Your Customer, or meet your client -its scope depends on the process and applicable framework.
What can AI contribute and how does its performance depend?
Automation can help to process catches, apply repeatable criteria and separate cases that require care. Their value should be measured at full flow, including errors, reattempts and exception care.
To evaluate an implementation, select these questions:
- Do people get to capture usable images with their usual devices?
- What about insufficient light or damaged documents?
- How are the thresholds that determine a coincidence selected?
- What populations and conditions were represented at the tests?
- How are unfinished results met?
A threshold is the cut-off criterion used to interpret a result. To make decisions, ask the supplier to explain its impact on the errors and to justify the proposed configuration for your operation.
On a pilot we recommend to measure completion, reattempts, referral to review and resolution times. A useful assessment should consider both safety and the ability to complete the process.
AI can also facilitate suplanting
Conviene separar tres conceptos:
| Concepto | What do you describe | A hypothetical example |
|---|---|---|
| Deepfake | Content generated or modified with AI to simulate an appearance or performance | A video representing another person's face |
| Presentation attack | A deceit attempt at the capture sensor | A photo shown before the camera |
| Injection attack | The introduction of content into the digital capture or processing flow | Replaced images before reaching the analyzing component |
Deefake describes the contents and an injection describes a mechanism. They can be combined but they are not equivalent. No attempt at suplanting requires AI.
The Section 3.14 of NIST SP 800-63A-4 It addresses the injection and the manipulated content. It warns that biometric comparison alone does not prevent these attacks and that capture and presentation controls do not cover all cases.
For a company, this means asking both what the solution looks at and what confidence it offers about the origin of the material received.
The boundaries of an ID with AI
Comparison errors and process decisions
A face comparison can incorrectly associate images from different people or do not associate images from the same person. NIST document these errors and their variation between groups in its demographic impact assessment.
In complete flow, we talk about false acceptances or false rejections as decided. They should not be automatically confused with the errors of a component: a facial coincidence is just an entry into the process.
Differences between conditions and population
NIST also indicates that image quality influences non-coincidence errors and that some demographics can be related with photography. Not all algorithms have the same performance.
We recommend evaluating the solution with representative conditions for users treated, rather than directly transferring an added result to the whole operation.
Scope of evidence
A separate assessment provides evidence about what was tested. To interpret it, request the component's version, conditions, attack types and approval criteria.
A facial comparison test alone does not prove an injection resistance. PAD Nor does it automatically credit the safety of the whole platform.
Updating and privacy
It sets up regular monitoring of errors, incidents and version changes. The review should allow us to detect when a monitoring needs to be adjusted or re-tested.
In privacy, our recommendation is to document what data are requested, what they are used for, who can access, how long they are preserved and how they are eliminated. It includes photographs, videos and biometric representations as appropriate. These decisions require legal review according to treatment and industry and to incorporate AI does not solve that review itself.
Realizing a face's enough?
Facial comparison is useful for matching samples. To decide about an identity, we recommend interpreting that result with documentary evidence, capture and other relevant checks.
NIST distinguishes the validation of evidence from the verification of its link with the applicant at its Identification check guide. Here it is used as a technical reference without giving them general obligation in Mexico.
The editorial posture of JAAK That's how check an identity requires evaluating different signsThe quantity and depth of controls have to be responded to for use.
To add steps indiscriminately can make access difficult. We recommend to justify every requirement, explain reattempts and offer a path for legitimate cases that cannot complete the usual flow.
What to review while choosing an identity check solution
Use these questions to turn a commercial demonstration into a documented evaluation:
| Criterio | Pregunta al proveedor | Evidence to be requested |
|---|---|---|
| Alcance | What does each module check and what's out? | Functional description and documented boundaries |
| Amenazas | What presentation and injection attacks have been evaluated? | Threat and result matrix by stage |
| Pruebas independientes | What version and terms and conditions do the report cover? | Report with dates, methodology and scope |
| Mistakes | How are mistakes, reattempts and exceptions handled? | Decision policy and review flow |
| Privacy | How are data preserved, used and deleted? | Treatment, access and maintenance documentation |
| Integration and traceability | What results are available to investigate a case? | Technical documentation and examples of registries |
| Experiencia | What about users who don't complete capture? | Pilot results and assistance mechanisms |
Before the pilot, agree what results will allow them to continue, what will require adjustments and who will solve outstanding cases. Thus, the evaluation responds to concrete operational needs.
The perspective of JAAK
JAAK works on digital identity for companies. Identification check page with facial comparison, life and documentary monitoring components and with a offer OCR documentary.
The approach we propose is to discuss what evidence each process needs, how to interpret its results and what exceptions have to be met. JAAK all the checks described.
Preguntas frecuentes
Do facial comparison check an identity?
It supports the relationship between a sample and a reference. To decide about an identity, the reliability of that reference and other relevant controls have to be assessed as well.
What's the difference between face recognition and liveness detection?
The first supports face comparison or identification. The second evaluates genuine presence signs during capture, within the range implemented.
Do all life-testing systems detect deepfakes?
It should not be assumed. It requests evidence about the contents, attack mechanisms and conditions tested in the version to be used.
What's the difference between presentation and injection?
The presentation acts against the sensor. The injection introduces material into the digital flow. Your controls should be evaluated separately.
Can AI completely replace human review?
It can automate determined tasks or flows. We recommend defining who will care for exceptions, inconformities and contradictory signs without assuming that each case needs manual review.
A decision based on evidence
Before adopting a solution, define what your company needs to check, what risks to cover and how it will care for mistakes. Check each component and then test complete flow with representative conditions.
To explore these criteria in your operation, get to know the an approach to monitoring JAAK.