Massive Leaks Expose Weaknesses in KYC Protocols, Sparking Calls for Change

A recent spate of security incidents has highlighted the weaknesses in Know Your Customer (KYC) protocols, which are designed to make financial systems safer. The FBI is investigating a leak of over 153 million US and Canadian driver's licenses that ended up on a dark web identity service called Nexus.

Another incident involved fintech company Revolut, which disclosed that it was tricked into releasing sensitive customer information, including passports and verification selfies. A hacker has been drip-feeding documents belonging to 680 customers while attempting to secure a 10,000 Bitcoin ransom.

The issue is not just with the technology itself, but with the governance, standards, and institutional incentives that currently treat ID documents as the safest form of proof. Zero-knowledge (ZK) proofs could allow users to prove facts without handing over or storing the underlying documents, but deployment is constrained by compliance systems designed around storing copies of documents.

Evin McMullen, whose organization develops privacy-preserving digital identity and ZK solutions, notes that the challenge is a 'governance and standards problem wearing a technology costume'. The European Union is moving toward privacy-preserving age verification concepts in its digital identity and age verification design, but financial KYC deployment remains limited.