The Canadian payment system is evolving into something almost completely different, an evolution that's birthing new ideas to handle authentication.
Since mobile commerce and authentication risk are inextricably linked,
"We are in a really good spot to help drive the future of digital identity in Canada," said Neil Butters, the director of product and platforms for Interac Association and Acxsys Corp.
Time is of the essence, according to Interac, which reports ID fraud is expanding 33% per year in Canada, carry a currently yearly cost of $200 million to businesses.
Interac seeks an ID system that combines different elements of authentication for different tasks into something more universal. For example, when a consumer downloads a mobile app and signs up via a social media account, that user is answering a "who you are" question—similar to showing a driver's license or a passport, though inadequate for more substantive transactions.
"Social identity is not good enough for a large volume transaction, and with a physical ID you have to be present," Butters said. "If you want to move money faster and more conveniently, you have to develop a digital ID system."
Part of solving this problem is a shared ID system that, according to Butters, uses available ID vetting systems and technology. The system starts with government documentation such as birth certificates and citizenship papers. These personalized credentials are tokenized for use at routine service levels, such as driver's licenses, passports, health care cards and social security cards--the tokenization makes these ID documents more dynamic than in the past. These "supporting" ID relationships can subsequently be used with utility bills, employment credentials, point of sale payments, or any function that requires a digital ID.
"Canadians would not have to have different ID solutions for different purposes," Butters said.
In a separate project, Toronto-based SecureKey is drawing investment from Canadian banks for a digital identity and attribute sharing network. Canadian consumers can opt in to a blockchain service via a mobile app, which uses the digital credentials that consumers have with a bank or other provider. A blockchain is a digital ledger system, originally developed to support bitcoin payments.
SecureKey uses IBM's Blockchain service, and added National Bank as investor in late October—giving the SecureKey ID blockchain the support of seven of Canada's largest banks.
"By having a single credential held securely in a blockchain, I think the vision is it will help to drive take-up of new services more easily due to the key point of reducing frictions, particularly in terms of initial registrations and sign up," said Gilles Ubaghs, a senior analyst at Aite Group.
The SecureKey initiative will bring together financial services, telecommunications, health care organizations, and other parties for a shared open ID system with consumer involvement. Users will be able to limit how their ID is used and compartmentalized, similar to how a driver's license does not automatically unlock all of a person's information if the license holder is using it to prove age at a bar.
"With the recent breaches, it's ridiculous that consumers don't get to see their data," said Greg Wolfond, CEO of SecureKey. "Consumers should get an alert each time their data gets shared."
Interac and SecureKey's projects are not a direct part of the
The unaffiliated ID initiatives could solve some of the authentication challenges facing Canadians, said Andrew McCormack, senior director of technology for Payments Canada.
"A digital identity or verifiable claims is very important with payments in general and not only for faster payments. Rock-solid authentication in the digital space is an important step to initiate any payment," McCormack said, adding that Payments Canada's distributed ledger, Project Jasper, is using aliases (proxy database) to simplify the way payments are addressed to payees. "That said, I see a world where every Canadian will have a digital identifier and can securely authenticate him or herself. That's what we are working on together as an industry, taking another big step to remove friction when it comes to payments."
A federated ID has a lot of value, but while straightforward in concept, the premise is much harder to implement in the real world, according to Julie Conroy, a research director at Aite Group.
"Most businesses have so many layers of security associated with enrollment as well as ongoing login that it's very difficult to establish the trust required for federated identities," Conroy said. In a consolidated market such as Canada with a limited number of big banks and a handful of credit unions, she added, the concept can work and there's a lot of utility.
