Digital identity and verification service OCR Labs, utilised by a number of high-profile Australian Government agencies, has announced it has secured Identity Proofing Level 3 (IP3) on the Trusted Digital Identity Framework (TDIF), making it the first private company to be accredited at the ‘Strong’ level.
IP3, also categorised as ‘Strong’ under the TDIF, is the highest level of accreditation available for digital or remote identity verification providers.
The accreditation is applied for higher-risk transactions that require a user to prove their identity through remote facial verification. Identity proofing at this level may be required to access welfare or other related government services.
At IP3, OCR boasts that it now matches the identity proofing level of the Federal Government’s myGovlD service.
While an IP4 does exist under the TDIF, it requires providers to conduct in-person physical interviews to confirm their identity.
Identity Proofing Levels currently range from IP1 to IP4.
At IP1 or ‘Basic’ level, for instance, users or applicants of a service would be required to submit an email address or mobile phone number, alongside one identity document, such as an Australian driver licence or Medicare card.
At IP3, a user or applicant would need to “prove that [they] are the same person as shown on [their] identity documents”, requiring them to scan their face with a smart device which is then matched against official government identity documents (of which at least two need to be submitted).
Currently, Australia Post’s own DigitaliD service sits at IP2, requiring at least two official identity documents, but without facial scanning.
OCR’s head of risk and compliance Paul Warren-Tape said the company has achieved “an exceptional milestone”, having been elevated from IP2 to IP3 within a matter of months.
“Regulation that addresses identity document verification and biometric technologies is aligning,” Warren-Tape said.
“The TDIF accreditation in Australia is a positive step forward to ensure there are standards to protect Australians when using identity verification solutions.
“The boost to IP3 gives our customers the trust and confidence that we maintain the very highest level of security and compliance.”
The TDIF consists of a set of standards, rules and guidelines established by the Australian Government for digital identity, credential, and identity exchange services.
OCR said it also currently conducting independent tests of its Near Field Communication (NFC) capabilities, including ‘death checks’ that verify whether an individual is active in society.
The NFC capability would enable individuals to scan passport chips from their smartphones to confirm their ID and the authenticity of their identity documents.
OCR Labs has in previous years secured contracts for its services from the Australian Taxation Office (ATO) and Digital Transformation Agency (DTA). The company notes that it has satisfied 262 TDIF requirements across a broad range of areas, including protective security, privacy assurance, risk management, usability, and accessibility.
