Fides Cloud Technologies launched WhoYou, an application that lets individuals and businesses verify the identity of any South African resident using photographs of their thumbprints.
Developed in South Africa, the WhoYou app has launched on Android and Windows, and the company promises that an iOS app is in “advanced development” and will be released soon.
WhoYou compares the photos of a person’s two thumbprints to the National Population Register (NPR), which is maintained by the Department of Home Affairs. It then returns a confirmation of the person’s identity details, along with their photo.
It aims to play a significant role in curbing identity fraud in South Africa by offering individuals and any business — not just banks and network operators — the ability to verify a person’s identity.
Among the clients it hopes to serve are retailers who allow customers to open accounts, insurers handling claims processing, and authentication for debit orders. The app can also help individuals verify the identity of suppliers working at their homes or businesses.
“More and more, you as a business or an individual need to know who you’re dealing with amid the country’s high levels of identity fraud,” said Craig Hills, the business development director at WhoYou.
“WhoYou gives every South African the ability to confirm everybody else’s identity biometrically, without any specialised equipment or upfront costs. This, in turn, will further help boost trust in transactions across various environments,” Hills said.
WhoYou states that it is fully compliant with South Africa’s Protection of Personal Information Act, also known as POPIA.
It also assures that the subjects of identity verification first have to give consent and accept the terms and conditions in the app before allowing their fingerprints to be photographed.
“WhoYou creates an audit trail which works as follows: A person who is using WhoYou to conduct identity verifications has to enrol all 10 of their fingerprints on the app,” Hills told MyBroadband when queried about the security of the app.
“This person is then NPR verified before they are even allowed to validate any other identities. Every time they use the app, they have to log in with their fingerprints. If there’s any alleged imposter fraud, WhoYou can use its audit trail to go back to an exact date and time and investigate.”
When a user consents to have their identity verified, this is also stored in the secure audit trail. When someone places their thumbs in front of the camera for verification, this is also seen as a form of consent.
“In addition, if the individual is not present or a perpetrator attempts to impersonate another identity, the biometric image would not match the one stored on the NPR and, as a result, no corresponding information relating to that individual will be returned.”
Scanning live thumbs
WhoYou also includes anti-spoofing technology to ensure that live thumbs are being scanned, and not printed photos of someone’s thumbs.
“The app has an embedded anti-spoofing algorithm as well as liveness detection to ensure that the individual is, in fact, present when the fingerprint capture takes place,” Hills told MyBroadband.
He also said that it should be borne in mind that WhoYou will typically be used as just the first step to check that you are dealing with the correct individual.
Data usage, API, and security
Hills added that WhoYou can work in areas where data connectivity is a challenge, as the app is light on data.
WhoYou’s technology also ensures that the fingerprints are not stored on the device, nor are they kept for any other parties to access. The request for ID validation from the device is sent over HTTPS.
“The app also has open Application Programming Interfaces (APIs) or Software Development Kits (SDKs) which third-party developers can use to plug into to create their own apps,” said Hills.
Pricing and availability
WhoYou does not charge a subscription and instead charges R14.99 per verification to use the app on an ad-hoc basis.
“Corporates can use the service primarily through back-dated invoicing based on the number of identity verifications performed,” Hills said.
The WhoYou mobile app for Android launched in the Google Play Store on 6 August.
Hills said that their Windows application is currently used by various corporate clients, and that companies have to request access to the Windows WhoYou app to use it.
It is a cloud-based service that is invoked via a browser, and is currently operating on Windows XP, 7, 8, 8.1 and 10.