Every week, we pick the identity stories worth having on your radar – from new fraud tactics and emerging technologies to regulatory shifts and changes in how identity is verified and protected. Here’s our quick guide to what happened, why it matters, and what it could mean for the industry.
Over the past few days, two developments put identity verification standards and practices in the spotlight: Germany announced plans to benchmark facial background removal technologies, and the UK moved toward using bank-verified data for government identity checks. Meanwhile, an AI-assisted hacking campaign targeted South Korean financial institutions, and suspicious filing patterns among UK companies raised questions about potential identity fraud and compliance with mandatory director identity verification.
Here are four identity stories worth knowing as you start the week.
Germany's BSI to benchmark facial background removal technologies
Germany's Federal Office for Information Security (BSI) is inviting developers to submit facial background removal technologies for independent evaluation. The benchmark will cover both software-based solutions and devices such as photo booths, with submissions open until November 27, 2026.
The initiative focuses on a deceptively simple task: separating a person from the background without changing important details of the image. But algorithms can introduce halos around the head, cut off strands of hair, or leave traces of the original background. These artifacts may affect compliance with identity photo standards, including ISO/IEC 39794-5 and ICAO requirements, and potentially degrade subsequent facial recognition performance.
Why it matters: Background removal is often treated as a cosmetic adjustment, but the changes it introduces can have implications for biometric security.
Facial boundaries are among the areas where traces of face swapping and other image manipulation may appear. If legitimate processing modifies those regions, it can become harder to distinguish processing artifacts from signs of fraud. A technically acceptable image is not necessarily an authentic one, making the integrity of the original capture just as important as image quality.
Our take: Read why facial background removal can complicate biometric fraud detection and what organizations should consider before modifying images used for identity verification.
UK to add open banking to GOV.UK One Login identity checks
The UK government is adding open banking as another identity verification option for GOV.UK One Login, the system used to access online public services.
The Government Digital Service has awarded Ecospend, an open banking provider, a £4.7 million contract covering identity verification, identity validation, and fraud risk assessment. The new option is expected to become available in 2027.
Instead of relying exclusively on conventional identity documents or other verification methods, users will be able to authorize the sharing of information already verified by their bank. The approach builds on the established open banking model, extending its use beyond payments and financial data access.
Why it matters: Bank-verified information offers another source of identity evidence that could make access to government services more convenient. It also reflects a broader shift toward using trusted information from one organization to support identity decisions elsewhere.
However, the reliability of the original data and the security of the sharing process remain important. Organizations need to establish where identity information comes from, whether it has been transmitted securely, and whether it provides sufficient assurance for the particular interaction. Access to trusted data does not automatically establish that the person presenting it is its legitimate owner.
Read more: Explore how alternative identity verification methods, such as mobile driver's licenses, are changing the way organizations establish trust in digital identities.
AI-assisted hacking campaign targets South Korean banks
CrowdStrike has uncovered an AI-assisted hacking campaign targeting South Korean financial institutions. The activity, observed from late September into early October, involved an attacker using ARTEX, an open-source agentic penetration testing tool, alongside several large language models.
Researchers found that the attacks led to data theft and affected banking services, including loan applications. The exact number of affected institutions remains unclear.
Why it matters: The immediate concern is the use of AI to accelerate cyberattacks. For identity verification, the longer-term risk lies in what happens to the information stolen during those attacks.
Compromised personal and financial data can later be used to impersonate legitimate customers, support fraudulent loan applications, or make account recovery requests appear credible. The more authentic information fraudsters possess, the less useful a simple match against personal records becomes as proof of identity.
Banks and other financial institutions, therefore, need to look beyond whether the submitted personal details are correct. Document authenticity, biometric presence, device and session context, and the integrity of identity signals all help establish whether the person using that information is genuinely entitled to do so.
Read more: Learn how stolen personal data fuels identity fraud and account takeover, and why matching personal details is no longer enough to verify someone's identity.
Thousands of UK companies show a suspicious pattern after director ID checks
An analysis by Shareflo has identified over 33,000 active UK companies that appear to have changed their filing behavior following the introduction of mandatory identity verification for company directors.
According to the analysis, these businesses had previously submitted their filings on time but subsequently missed filing deadlines and had no visible record of identity verification for at least one director. They represent roughly 1% of the active private companies examined.
The pattern raises questions about whether some directors are unwilling or unable to verify their identities. However, late filings and missing visible verification records do not establish that a director is fictitious or that a company is involved in fraud. Administrative delays and other explanations remain possible.
Why it matters: Mandatory identity checks can help uncover problems with company records. Even if a company has filed its paperwork on time for years, that doesn't necessarily mean its directors are who they claim to be.
For banks, brokers, and other regulated businesses, a director's verification status at Companies House can become a useful signal in Know Your Business (KYB) checks. An unusual filing pattern may justify closer examination, particularly when combined with other risk indicators.
But registry information is only one part of corporate due diligence. Financial institutions still need to verify directors and beneficial owners independently, assess ownership and control structures, and determine whether the people acting on behalf of a business are who they claim to be.
Read more: Learn what Know Your Business (KYB) involves and how it helps organizations verify companies, their directors, and beneficial owners.
We’ll deliver hand-picked content from Regula’s experts into your inbox
.webp)
