Identity/biometrics/technology marketing and writing services
Can YOU tell a real ID from a fake ID? Even if you don’t have the specialized equipment to examine every ID presented to you?
And even if you can do it, how about that voting precinct worker behind the table?
Honestly, you can’t. Which is why it is so unbelievably easy to vote fraudulently in a voter ID state.
When the land is dry, you irrigate. As threats mushroom, the Department of Homeland Security (DHS) is proposing a RIVR expansion.
RIVR is the current name for the DHS’ Remote Identity Validation Rally, addressing ways to know who you’re dealing with. The “rally” format allows participants to test new technologies. Perhaps those technology will eventually meet Identity Assurance Level 3 (IAL3).
To encourage participation, the test results from participants are anonymized, and the identities are only revealed if participants choose to reveal them because of stellar performance. Here’s what Microblink said:
“Microblink was evaluated under the anonymized identifier DVS6. Among all participating vendors, Microblink was the only provider to meet RIVR “high performing” system benchmarks across every measured accuracy metric.”
Just a warning that RIVR tests are kind of like NIST tests. They’re sliced and diced in so many ways that almost everyone can claim to be the “winner” of the test. But as I mentioned before, this particular test resulted in a bunch of losers.
In the past, RIVR concentrated on basic identity document validation to ensure that a California driver’s license really was a California driver’s license. The rallies concentrated on topics such as basic document validation, the “selfie to ID” facial recognition matching process common in identity verification, and both active and passive presentation attack detection (liveness).
But the 2026 RIVR expansion encompasses new testing related to deepfake detection.
“To build more robust evaluations, DHS S&T is calling on organizations that can produce or share examples of identity deepfakes attacks and the methods used to create them. Identity deepfakes, which may include face-swap videos or digitally generated or altered identity documents. This data will help the S&T develop a more complete and rigorous dataset for testing.”
This data-gathering exercise is a prelude for additional testing.
“December 2026: Applications open for companies developing presentation attack detection (detecting physical spoofing like masks or photos) and Biometric Deepfake Detection (detecting AI-generated impersonations, such as in video chats or teleconferencing).”
At the same time, DHS is also gathering “a broader set of real and fraudulent passports and driver’s licenses.”
Why? Because security of the homeland doesn’t just include keeping planes from flying into buildings. It also includes digital attacks to our infrastructure.
Today we will learn about identity and a car battery purchase. From personal experience.
The last couple of times that I started my car it was difficult to start. This afternoon it wouldn’t start at all. The battery had a sticker that read “09/19”; if that was a month and two-digit year, then it was probably time to replace the battery.
So I called the company that sold the battery to me. I won’t reveal the name of the company, but its initials are AAA. (Or “Triple A” to the kewl kids.) They sent a truck out, and informed me that I did NOT purchase my battery in September 2019. I purchased it in OCTOBER 2019. (Presumably 09/19 was the month the battery was available for service.)
Before the driver from Golden Bear Towing arrived, I reviewed all the ways I would have to identify myself.
The one odd part? While I had to prove everything about myself, I didn’t have to prove anything about the car, such as title. I previously wrote about the importance of title from a non-person identity (NPE) perspective:
“Because of their expense, certain NPEs such as vehicles and real estate are associated with title, or proof of ownership.
“Just because I have physical possession of a car or house doesn’t mean that I’m the lawful owner. Maybe I am house sitting. Or renting a car. Or I am a squatter or thief. When it comes to legal (and financial) title, possession is NOT 9/10ths of the law. Otherwise, Hilton and Hertz would be out of business.”
Ah, Hertz has been in the news lately, regarding how its identity verification vendor handled driver’s licenses…
But back to my immobile car.
I was sitting in said car, waiting for the Golden Bear Towing truck. AAA messaged me a handy dandy link to show me where my service person was, but by the time I got around to clicking it, he had already arrived.
I got out of the car, but as you and I know that did not prove I had title to the car. But I had the key.
And after the old battery was tested (12%, below recommendations) and replaced with a new one, it came time for my identity proofs.
But he simply looked at the card, called the card number and the total into his office, and got approval over the phone.
If you always go by the book, this would be horrifying. After all, I write about Identity Assurance Level 3 (IAL3) all the time. And I never even had to show a driver’s license at all.
Why not?
Now presumably it is possible that I may have fraudulently induced Golden Bear Towing to replace a battery on a car that wasn’t mine.
Possible, but not probable.
In the real world, you need just enough proof of identity to keep things…running.
When someone asked on LinkedIn why IDScan.net had all that personably identifiable information in the first place, I remembered something about the ability to perform identity verification. Specifically, I remembered one significant sentence from my paradox of identity verification. Emphasis mine.
“To prevent fraud you have to risk fraud by giving selfie plus ID to a firm you don’t know—not Meta or Hertz, but a third party vendor you don’t know.”
Look at simple (?) facial recognition, which Amazon and Google and Meta could perform if they weren’t scared of their own customers. (That fear may have subsided.)
But identity verification is much more complex.
So who can do all of this?
I will tell you who can’t.
Meta can’t do all this, and neither can Amazon or Google.
And Hertz can’t do all this either, and neither can Bank of America or Jerry Rainbow’s Cannabis Shoppe.
Why? Because multi-billion dollar companies, and Jerry, don’t understand all the skills needed. Sure Amazon can route goods within warehouses, but it doesn’t know squat about ghost images or microprinting, much less how to check PEP lists.
So Meta et al outsource their identity verification work to companies that most of you don’t know.
But I do. I worked at Incode for a year and analyzed over 80 of its competitors while I was there.
(Dirty little secret: NONE of these identity verification vendors author ALL their algorithms. Sure they may own intellectual property for certain tasks, but they buy the other tasks from other suppliers.)
Are you a large company trying to understand the identity verification market?
Are you an identity verification company trying to understand your own market?
Do you need confidential help to analyze and plan the impossible?
Perhaps Bredemarket’s identity verification and product marketing expertise is what you need.
Talk to me.
Oh, as a postscript: remember when I created three similar videos last Saturday night? I also created a fourth one just for the identity folks.
In a prior post I mentioned the Driver’s License Data Verification (DLDV) Service from the American Association of Motor Vehicle Administrators.
What is this service?
“The purpose of AAMVA’s Driver’s License Data Verification (DLDV) Service is to provide commercial and government entities with the real-time capability to verify DL/ID information against data from the issuing agency.”
Note AAMVA’s emphasis on “real-time” for verifying driver’s license data. Since this word can have different meanings depending on the use case, here we are talking about someone at a place such as a car rental counter, where the person (and his mother) provided their driver’s licenses.
Now envision all this data getting passed around between the different states, a car rental company, the identity verification service used by the car rental company…and a hacking operation that steals the data.
Messy.
My 45-second video summary of recent Bredemarket blog posts. The posts discussed the hack at IDScan.net of over 153 million driver’s licenses and other data.
Here are the three most important posts I’ve written:
I was reluctant to reveal the party involved in the massive hack of 153+ million driver’s licenses and other data.
But now the company, IDScan.net, has spoken.
And as I noted earlier this morning, many other firms must send out notifications now.
On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization. Upon this discovery, we took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident. This investigation is currently ongoing.
While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud. The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers.
Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services. If you have questions about this incident or would like to enroll in the credit monitoring and identity protection services, please call 1-833-516-2980, Monday through Friday, between 8 AM and 8 PM ET, excluding holidays. You may also write to us at 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003.
Individuals are encouraged to remain vigilant against incidents of identity theft and fraud by reviewing credit reports and account statements for suspicious activity and to detect errors. Individuals may also place a fraud alert or credit freeze by contacting the credit reporting agencies: TransUnion 1-800-680-7289, P.O. Box 2000 Chester, PA 19016, transunion.com; Experian 1-888-397-3742, P.O. Box 9554 Allen, TX 75013, experian.com; Equifax 1-888-298-0045, P.O. Box 105069 Atlanta, GA 30348, equifax.com. Individuals can further educate themselves regarding identity theft, fraud alerts, credit freezes, and steps to protect their personal information by contacting the credit reporting bureaus, the Federal Trade Commission (“FTC”), or their state Attorney General. The FTC may be reached at 600 Pennsylvania Ave. NW, Washington, D.C. 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261.
In response to this incident, we immediately began an investigation and reviewed our policies and procedures related to data security. We are also cooperating with federal law enforcement on their investigation.
(Update: Statement from IDScan.net. You heard it here last.)
No, we don’t really KNOW yet.
If you missed the story about the 153-plus million Driver’s licenses on the dark web, see my post from yesterday.
Specifically:
“The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.”
Of course, the Nexus hackers may be lying to misdirect anti-fraudsters and cover their tracks. Fraudsters are not trustworthy people.
But if the Nexus hackers are telling the truth about the source of the hacked driver’s license data, some identity verification company is going to be in very big trouble.
Now some of you are saying, “But John…we KNOW who the identity verification company is!”
So how come I’m not naming the company now?
Two words: Richard Jewell.
He was falsely accused of the Atlanta Olympics bombing in 1996.
By August 2007 he was dead from complications from diabetes; he was only 44. His mother, who was caught in the same negative press onslaught, outlived him by over a decade.
So I’m waiting for more definitive information. Smoke isn’t enough.
(Update: Statement from IDScan.net. You heard it here last.)
From Krebs on Security:
“A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada….The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards.”
Now this isn’t a hack of a single state or province, since none has 153 million records.
But there are services that aggregate driver’s license data. The first one that came to mind is the American Association of Motor Vehicle Administrators, or AAMVA. Specifically, its Driver’s License Data Verification (DLDV) Service and its State-to-State (S2S) Verification Service.
But this doesn’t mean that AAMVA was hacked, since a number of third party entities can access the AAMVA data.
So with all these entities that can access the AAMVA data, you have a nice little third party risk management issue.
In fact:
“The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.”
Of course, the Nexus hackers may be lying to misdirect anti-fraudsters and cover their tracks. Fraudsters are not trustworthy people.
But if the Nexus hackers are telling the truth about the source of the hacked driver’s license data, some identity verification company is going to be in very big trouble.
Regardless, you can buy licenses of real people. Brian Krebs says that Pete Hesgeth’s license data is on the dark web. As is Krebs’ own license. And his mother’s.
No idea if my data is out there.
But 153 million people will be very interested in the source of the hack.
I have been talking about mobile driver’s licenses for years, ever since my then-employer IDEMIA began issuing them almost a decade ago. When accepted, mobile driver’s licenses can function as the physical equipment of your physical driver’s license. Even at the airport.
But you know what we haven’t had? Mobile birth certificates.
Part of the problem is the complexity of the birth certificate ecosystem.
Actually, some have. Several years ago when performing analysis research for a Bredemarket client, I looked at a number of these offerings, including VitalChek.
Which brings us to the news from Arizona.
“Arizona has become the first U.S. state to let residents present a verified digital birth credential from a smartphone during Motor Vehicle Division (MVD) transactions, eliminating the need for a paper birth certificate in eligible cases.
“The program, developed by LexisNexis Risk Solutions, the Arizona Department of Health Services and the Arizona Department of Transportation, delivers the credential through VitalChek.”
So, when accepted, the Arizona mobile birth certificate (I’m calling it an mBC until someone forces me to stop) can function as the equivalent of a physical birth certificate.
The birth certificate is probably the most important document you can have. If mobile versions of birth certificates take off, it will be revolutionary.
If your company offers mBCs and needs help marketing your product, let’s set up a free meeting to discuss how Bredemarket can help you with content, proposal, or analysis services.
Ask before the courage fails.