Hitachi Capital rolls out identity-as-a-service to handle huge rise in loan applications post-lockdown

Lender is extending its use of Nomidio IDV to speed application processing for the UK government's Coronavirus Business Interruption Loan Scheme (CBILS)

Hitachi Capital is one of the lenders being asked by the UK Government to help businesses survive the effects of the pandemic through the Coronavirus Business Interruption Loan Scheme (CBILS). As such, the financial service company has seen a massive increase in the number of applications since the lockdown started.

Applications for loans can come direct or via intermediaries such as brokers and other third parties. To verify quickly that applications are genuine, Hitachi Capital is deploying the services of Nomidio, a UK identity management start-up spun out of cryptography specialists Post Quantum.

Identity-as-a-Service (IDaaS) is a growing field in which responsibility for identifying and authenticating an individual is handed over to a third party. This means that credentials do not need to be held on the first party provider's servers, with all the security and regulatory risks that would entail. It also gives individuals more control over their online identity, since documentation and biometric credentials can be kept in one place, leaving them to grant or deny access as they see fit. Identity verification (IDV) is a subset of IDaaS which is used to ensure customers provide information that is associated with the identity of a real person.

See also: Working from home, staying secure: 14 Identity & Access Management tools to deal with the coronavirus fallout

Nomidio IDV verifies individuals through a combination of a photo-ID and biometric information such as face prints and voice recordings. In the Hitachi Capital case, users are required to upload a selfie taken on their smartphone as well as a picture of their passport. These are held in the company's cloud-based repository and protected by multi-party cryptography, with keys held on the applicant's device, meaning that no-one can access their biometrics without their consent. Nomidio IDV is available as a plugin to Avaya call centre software and also on AWS marketplace where it can be used in conjunction with the Amazon Connect virtual contact centre software.

Hitachi Capital originally deployed Nomidio IDV last year for direct sales but is now rolling it out to brokers and other 'introducers' following a quadrupling of demand for user verifications since the lockdown. "When it became clear we would need to support UK businesses incredibly quickly, at scale, as a partner in the CBILS we knew we needed a digital way to validate applicant identity for the vast majority of our business, which is handled in-directly via partners," said Jo Morris, Head of Marketing at Hitachi Capital Business Finance. "The decision was taken to roll-out Nomidio across the entire business in March and we did it in just 24 hours."

When an introducer submits a loan application on behalf of a business Hitachi Capital sends the applicant a link to undertake the Nomidio identity verification process, which involves uploading a passport photo plus a selfie. The system automatically verifies that the ID is genuine and that the photos match.

User's biometrics are protected by a "double layer of encryption", said Philip Black, commercial director at Nomidio.

"Each individual identity and the components of that identity - voice prints, face prints and so on - are separately encrypted, and the encryption keys that are used are effectively managed by the individual consumer. It's a self-sovereign identity model. Businesses using the service don't get to share the individual's identity. What they get is an attestation from Nomidio that the person is who they claim to be."

Beside security, the main advantage of the system, claimed Black, is that it does not require the user to download an app or for the business to install any additional infrastructure and so it can be rolled out very quickly.

"The whole of the identity management is delivered as a service, so there's no footprint in the business's contact centre or in their own IT estate to have to implement biometrics or customer management," he said.