The Elephant in the room

[Dave Birch] Off to the British Bankers’ Association seminar on Identity Fraud to hear an "Update on Identity Cards" by Stephen Harrison, Director of Policy, UK Passport Services and Identity Cards programme.  Having promised myself that I wouldn’t bore readers of the new Digital Identity Blog with yet more about the UK ID card, the truth is that for many businesses and other organisations trying to develop identity management policies, the ID card is the elephant in the room.  Now, clearly, my clients (eg, card issuers) are potential big users of ID cards so they need to know exactly how it is all going to work for them so that they can start planning.  Since, according to Mr. Harrison, the government will start issuing them in only three years time, they ought to be part of short- to medium-term strategies now.  So, for example, what should a bank put into its branch strategy because of the ID card?

Technorati Tags: banking

Mr. Harrison explained a few use cases to the listening bankers, including CRB checks that will be performed by taking fingerprints from the National Identity Register and running them against police databases.  He gave a few other examples: the police will be allowed to match scene of crime prints against the Register; enrollment "footprint" checks will involve access to credit reference agencies and the electoral roll and one or two other points.
He also spoke about the passport verification service that will be launched in the Autumn.  In a two month pilot working with HSBC, Preferred Mortgages, Abbey and Barclays Bank Company Card they had a 2.5% referral rate (ie, 2.5% of the passports presented in support of applications for financial products had "something dodgy" about them) which resulted in £700,000 in mortgage applications being declined.  This is a simple telephone service, which was popular and worked well.  It sounded like it would make a genuinely interesting case study for the Forum this year so I will see if I can get someone to come and talk about it.
The ID card verification service — the service of most interest to banks — will have two kinds of query: the simple "is this card valid" and the more complex verification and/or provision of subsets of information held on the card or the register.  A record will be kept of the verification.  Mr. Harrison also said that there would be a "light touch" accreditation process to determine which organisations would be allowed access to the identity verification service and that the business case for the scheme (I strongly object to the use of "business case" in this context because the Home Office is not a business, but that’s just me) assumed that it would stop a "fair proportion" of the £1.7 billion in identity fraud that they are targeting.  (Interestingly, David Lennox of CIFAS said in his talk that insurance fraud alone was in the range £1.4-£2.2 billion and that social security fraud was "grossly underestimated" at £2-£4 billion).  The identity verification service would allow banks to confirm name, date and place of birth, gender, addresses, residential status, identifying numbers, validity of identifying documents, photograph, signature and validity of the ID card.
As an aside, he said that there was never any intention to proceed with procurement right away and that the next major step would be the publication of the results of the market sounding exercise so that the views of the IT companies consulted by the Home Office could be shared with their peers.
I would have thought that the first question on the bankers’ minds would have been the issue of liability: in other words, if a bank gets an identity verification from the government, does this cover their KYC (know your customer) obligations?  No-one asked it, so I did, and he said that he thought it would although he didn’t know the details of the money laundering regulations.