Why is South Africa shying away from digital IDs?

By Louis Fourie

ACCORDING to estimations there are globally about one billion people who do not have any form of recognised identification. A further 3.4 billion people have some form of legally-recognised identification, but have limited ability to use it in the digital environment.

And even though the remaining 3.2 billion do possess a legally-recognised identity, and could participate in the digital economy, they often are unable to use the identification effectively online.

The problem is that in the digital economy, the lack of digital identification contributes to sophisticated cybercrimes such as card payment fraud, electronic transfer fraud, account takeover, phishing, smishing (phishing attacks via SMS/text), intellectual property theft, piracy and social engineering, to name but a few.

For this very reason, organisations are increasingly turning to digital identity verification as a means to keep fraudsters out. With more than 10% of the world’s population lacking some form of legal identification, it hampers economic growth and financial inclusion.

The 2022 Jumio Global Consumer Research found that consumers are more likely to engage with financial and healthcare organisations when they perform robust identity verification to protect their clients against online fraud.

Some South African banks are doing quite well with regard to robust identity verification. Unfortunately, the Jumio research found that social media sites and sites with age-restricted services, are not doing well with online identity and age verification. The verification of identities would also make it easier to hold users accountable for online hate speech, racism and other transgressions of the Cybercrime Act.

Digital identification is one of the most significant technological developments today and transformed the way people interact with public and private institutions. Very similar to physical identities of individuals, digital identities consist of a set of validated digital attributes and credentials that can uniquely identify a person such as the unique identity number, name, place, date of birth, citizenship, and biometrics.

The digital identification differs from country to country. Germany, Italy, Spain and Portugal, for instance, have eID cards, while Finland, Belgium and Estonia have mobile IDs. India has an even more extensive biometric-related ID system, the Aadhaar card, to verify a person’s unique identity.

The main reason for its introduction in 2009 was to ensure that the marginalised population would receive the benefits assigned to them. Countries such as Malawi, Senegal and Uganda also use biometric ID systems, while others, including Ghana, Kenya, Nigeria, Tanzania and Ethiopia, are in the process of implementing biometric IDs.

The adoption of digital methods of identity verification was greatly advanced by the Covid-19 pandemic, when social isolation and distancing were required. The pandemic made digital onboarding a necessity for companies. This leveraging of digital processes revolutionised the relationship between companies and clients.

Digital identification usually make use of one or more of the following technologies:

Facial liveness

One of the popular methods of identification is facial biometrics. Simultaneous with verifying that the person is who he/she claims to be, it also detects liveness to confirm that the person is alive – often via a mobile phone, or a computer, tablet or other camera-enabled device. It then uses a machine learning algorithm to identify the authenticity of customers within seconds. This provides the customer with a better quality of service that is fast and secure.

Facial match

Another, often supplemental, technology used in digital identification is face matching, which entails the matching of faces in a photograph on a government-issued ID card and a selfie taken by the person. This technology enables organisations to digitally identify a person or to authenticate documents without the need for the physical presence of the person.

Digital Know Your Customer (KYC)

Digital Know Your Customer includes a validation check and liveness check of a user, ensuring instant onboarding from the comfort of wherever they are. Currently in South Africa biometric validation-based KYC has become popular due to the high prevalence of identity theft and fraud. Biometrics link individuals to their digital identities and can include a fingerprint, iris or retina scan, voice recognition, facial recognition, body movements, or a unique ID to help organisations or governments to instantly verify the identity of the person and provide services to them.

Traceable SIM cards

Because of the increase in fraud, scams, spam and organised crime, governments are increasingly implementing digital IDs and traceable SIMs. Many African and Asian countries have mandatory SIM card registration laws that require users to provide their state issued ID when registering their SIM card. In Kenya and Uganda, mobile network operators, banks, and financial institutions are required to verify the state issued ID whenever customers carry out transactions such as mobile money transfer.

Nigeria recently blocked 73 million SIM cards not linked to users’ National Identity Number (NIN), while Zambia blocked two million SIM cards, Kenya blocked 200,000 SIM cards and Tanzania blocked 18,000 SIM cards to stem the volume of fraud carried out using mobile lines. Ghana also warned that it will soon block unregistered SIM cards.

However, in South Africa, a MyBroadband investigation found that it is extremely easy to buy an illegally pre-registered SIM despite the stipulations by the Regulation of Interception of Communications and Provision of Communication Related Information Act (RICA) that all SIM cards purchased in the country need to be registered to a specific identity.

There is little doubt that the RICA stipulations are ineffective in preventing and detecting crime. Meanwhile, linking biometric data to SIM cards has been proposed by the Independent Communications Authority of South Africa (Icasa) but is still under discussion.

Digital identities have many benefits, such as enabling citizens to participate in the digital economy, limit corruption and fraud, prevent tax evasion and promote financial inclusion. It will certainly be of benefit to South Africa’s welfare system to purge the countless number of people receiving benefits fraudulently. I cannot help but wonder why South Africa is so far behind other African countries in implementing digital IDs. Could it perhaps be that too many politicians and government officials are benefiting from fraud?

But there are also some drawbacks to digital IDs, such as the erosion of privacy, the misuse of collected data, and an increase in government surveillance capability and information control.

The digital ID is, as is the case with all digital technologies, also exposed to potential data breaches and other cybersecurity threats. Digital IDs will therefore certainly see a large pushback in South Africa as is the case in other countries.

A possible solution would be to use self-sovereign identity (SSI), where the data is not centrally stored by the government, but individuals store their digital ID in virtual wallets and provide their identity information only when required. Blockchain technology could be very useful in this case.

Digital identity technologies are fast transforming the way we undertake verification processes. Hopefully, most physical appearances and at-home checks will soon be something of the past and easier onboarding processes will be the order of the day. Digital IDs will enable the broader use of digital payment systems and digital services.

But for the protection of privacy, it is crucial to ensure that strong data privacy and security legal frameworks and systems are in place before South Africa considers a national digital identity.

Professor Louis C H Fourie is an Extraordinary Professor at the University of the Western Cape.

BUSINESS REPORT