Rising Demand for Strong Authentication Helps Propel KBA Vendor Verid

The rising interest among banks and Internet merchants in more robust methods to verify that online customers are who they say they are is helping drive business for a form of such verification known as knowledge-based authentication. Verid Inc., a 6-year-old supplier of KBA processing services, says its transaction volume, in terms of billable authentications, is growing at least 400% annually, with September volume projected to be up 20% over August. “Right now we're 15 times the size we were two years ago in terms of volume,” says Kevin Watson, chief executive of privately held Verid, which will not disclose actual volume figures. One promising market these days, Watson says, is merchants that are starting to use Fort Lauderdale, Fla.-based Verid to authenticate transactions cleared through the automated clearing house, a cost-effective electronic settlement system many online merchants have nonetheless avoided because of its weak authentication. Verid's system works by supplying clients with sets of questions that can be posed to customers, who are on clients' Web sites or on the phone with their call-center agents. The questions–such as type of card previously owned and what color the car was?can presumably be answered only by legitimate customers. Verid uses data aggregators to query more than 1,000 databases, such as state motor-vehicle departments and marriage records, and serves up sets of anywhere from two to six multiple-choice questions in four to five seconds. That allows banks and retailers to use the system for spontaneous transactions, where the customer has not enrolled with the merchant or is not otherwise known to it. “The [KBA] concept has been around for quite some time, most commonly as a user-name and password,” says Watson “We looked at this and said this can be expanded into the first-time customer market, where the retail establishment has no idea the customer is coming, and can't rely on passwords or PINs. We said, 'Let's still use that concept of verifying customers based on what the customer knows, but we'll cull through all public data [to develop questions].'” Watson says Verid–whose client base includes payment processors, Internet service providers, banks, and telecom companies, as well as online merchants–stays away from questions related to customers' financial history, which can be regarded as intrusive. “Abandon rates increase dramatically when you have to tell someone something about your bank loan,” he says. At the same time, the system discourages fraud, since criminals may know one or two critical things about their victims' lives through schemes such as phishing, but not likely half a dozen. Also, the system serves up a different set of questions each time the same customer presents himself. Half of Verid's volume comes through call centers. In these cases, Verid serves up questions to call-center agents, who pass on answers to Verid. The company will simply indicate to the agent whether the customer passed the screen according to the client's criteria. Clients set their own risk tolerances–letting customers pass with three out of four correct answers, for example?as well as the number of queries they want to pose. The range, Watson says, is from two to six, though three or four is typical. Verid charges from just over $1 to just under $2 per completed authentication, depending on volume, regardless of whether the customer goes on to complete the transaction. “We focus purely on whether this person is who they claim to be,” says Watson. Watson says so-called alternative payments, such as ACH-based transactions, hold much promise, since they are less costly than credit cards but require strong authentication. “We have a lot of clients using Verid for ACH,” he says. “The whole world of alternative payment methods is driving our usage significantly.”