The Identity Proofing Guide: Identity in the Metaverse and Web3

The following was produced by Tearsheet Studios. We worked with consulting firm Ulysses Partners to create a four-part series on identity proofing and the importance of user experience in its emerging landscape. The series is based on our co-created publication, The Identity Proofing Guide: A practical hands-on review of user experience in leading solutions.

In this fourth and final session, we’re joined by David Milligan, managing partner at Ulysses Partners. We’ll be talking about why we need identity proofing the Metaverse and Web3 and the future of identity and doing business online.

To recap, here’s a quick take of what we covered throughout this series:

Why user experience matters in identity proofing

• Recent advances in core identity proofing technologies have greatly weakened the previous trade-off between security and usability.
• Banks, other financial institutions, and many other industries who need to verify the identities of customers should look at the newest updates from established firms like the top firms in our report and see how they can improve UX while retaining security.

How FIs can measure identity proofing success, and why we need biometrics

• Banks and other organizations using ID proofing need to have a better understanding of which metrics actually matter for their business. Simply looking at false positive or negative rates is inadequate. There are more nuanced measures that will help make the right trade-offs.
• Biometrics have improved greatly, but have also become somewhat contentious, especially in the provision of government services. Still, organizations must not abandon biometrics because of this. It is possible to apply biometrics in a privacy enhancing way, and unlock a lot of value for both end customers and the organizations that serve them.

The digital ID verification landscape and why biometrics are crucial

• ID proofing linked to government issued ID documents remains the gold standard. While more data aggregators, and recently data consortiums, have sprung up to make onboarding easier, they have significant risks.
• Banks and other organizations looking to verify customer identities need to have robust, traceable links to original government issued ID documents.

Watch the video

Listen to the podcast

Subscribe: Apple Podcasts I SoundCloud I Spotify I Google Podcasts
The following excerpts were edited for clarity.

Introductions

I'm David Milligan, and I run a company called Ulysses Partners. We are a boutique consulting firm that helps fintech firms, banks, and other financial institution firms to work together and leverage emerging technology. I've been working in the fintech and banking space for over 20 years. 

I previously headed innovation ventures at a bank for over a decade, which was some of the earliest fintech partnerships before there was even fintech back in 2006. I took that experience and started up a firm that was an early fintech platform, and eventually connected over a thousand fintech firms around the world, which we connected with over 130 financial institutions globally. I’ve worked across the world with banks from Asia, Australia, Europe, Israel, Africa, the United Kingdom, and in the United States. I've been fortunate to see how this industry has evolved. 

Most recently, we've done research with Tearsheet in trying to understand the role of identity, and identity proofing in particular. I think it is a critical case of capability that has broad implications for financial institutions, and frankly, for society as a whole.

Gate’s Law

We don’t really know where Metaverse and Web3 is going. But there's a classic quote, attributed originally to Roy Amara and later Bill Gates, that goes “We tend to overestimate the effect of a technology in the short run and underestimate the effect in the long run.”

Looking at the metaverse today, there's a lot of buzz. JPMorgan's just launched a virtual branch, and lots of other news, or noise, if you like. 

Some years ago, you may recall something called Second Life. Second Life was an early incarnation of sorts of the Metaverse and there was a lot of buzz around it, and then it sort of died away. This might lead people to think the same would be quite likely as well for the Metaverse, but in fact, try to think about it differently. 

The .com boom happened, then there was the .com bust, where many business models that started there had flamed out spectacularly, like Webvan. Yet 20 years later, the web business model is essentially what Amazon and all these other global giants have successfully brought to market. So the point is that just because it didn't work in the first incarnation doesn't mean that it's not going to be refined and take off in the second generation. 

Now, maybe the Metaverse is the Webvan equivalent of what happened to Second Life. We'll see whether it has this widespread adoption or ends up having more narrow adoption. Whatever this phase of adoption is, we believe that asserting and being able to understand the identity of people you’re interacting with in the Metaverse is going to be critical.

Identity ownership looks different in the future

Think of social media, where there's this sort of social phenomenon of people being willing to do and say things online that they would not do in a face to face environment. In one vision of the Metaverse, we will be in a virtual reality setup without a lot of the cues that we have today – like you and I are looking at each other on a screen and knowing we’re both real people, based on our human behavior. There has been a rise in ‘deep fakes’ that create realistic mimics or doppelgängers of real people. Depending on the nature of the interaction, it will be necessary to prove identity by linking it to government issued IDs.

So in a way, it becomes even more important to do identity verification when you're dealing with one another in the Metaverse in order to be able to know who you're really dealing with. Not in every context, but certainly as the Metaverse allows for things like real estate transactions, payments of any kind, NFTs – you need to be able to know who the person is behind the transaction.

And the full implications of this have yet to be worked out. But I think we should take lessons from what we've experienced in previous incarnations of the web and make sure that we can apply these here. 

The traditional banking system is already behind – then enter the Metaverse

The value of the transactions that are likely to happen in the virtual environment are immense. Many analyst firms, like McKinsey and Gartner, are putting out numbers to the tune of billions and trillions of dollars, and those are reasonable extrapolations. 

I have kids, who are playing online games, and the number of times that they're shelling out money to buy items of clothing for their avatar just shows you – extrapolating forward – the market for what's going to happen as current transactions are only going to grow. In that world, I think it's very important to make sure that we can enable transactions in the most safe and secure way by leveraging some of the features of the technology. 

Throughout recent history, financial institutions have been told that one channel will replace the others; there was the branch, then ATMs. I remember working in a bank at the time we were introducing the first cash accepting ATMs and people were saying, ‘The branches are going to die away, we won't need as many tellers.’ That didn't happen. Then came online banking on your laptop or desktop, and back in the day people said, ‘Online banking reduces the need for branches.’ Well, not quite, as many people bank online but others still use the branch and ATM. Then step forward to mobile banking and apps, and the same thing has happened. 

So from a bank's perspective, all we've had is layering of channels that don't disappear – and that introduces its own complexity. I wonder if the Metaverse will come into being what we think it will. I don’t think it necessarily supplants stuff, but rather becomes yet another channel that the bank has to manage. 

It becomes an ongoing challenge over time, but that shift takes many years and over that intervening period, the bank has to support all of those channels, and so the same thing will happen here. 

Lastly, real time payments are coming. I was just at a conference here in Charlotte, where many speakers were talking about real time payments in the US or the markets that have had them for a while. Come 2023, we know that this is coming into place. As you get this confluence of real time payments and settlement, at the same time the Metaverse usage goes up, and you need to know who's behind the transaction in case something goes wrong.

In short, along with all the other technologies that have to combine to make the Metaverse work, it will be critical to have ways to know -- to prove -- our identities. This is the next wave for identity proofing, and I’m excited to see how it develops.