What is the digital identity?

As more of our everyday activities shift online, from grocery shopping and mortgage applications to school exams, the ability to trust other people’s digital identities is critical. But unfortunately, it’s getting harder to make sure people online actually are who they say they are. 

Specifically, there’s a lack of streamlined, interoperable fraud solutions designed to manage the complexity of today’s online environments. There are more ways to interact online than ever before. Artificial intelligence has transformed the way consumers shop, offering more personalized recommendations and experiences. Consumers have quickly adopted advanced payment methods, from Buy Now, Pay Later (BNPL) services to digital wallets. Delivery options like buy online, pick up in store (BOPIS) further add to the complexity of online shopping.  

The explosion of online interactions poses a major security dilemma for companies. Each of these channels and behaviors require their own identity verification methods, and the number of touchpoints makes it incredibly difficult to know who’s logging in from behind a screen. Data breaches impacted over 1.7 billion victims in the U.S. alone in 2024, making it much harder to trust the credentials companies have long relied on to verify identity. 

So, it’s no surprise that online fraud is on the rise. The average rate of account takeover (ATO) attacks was up 24% year over year in Q2 2024, according to Sift. This situation risks eroding users’ trust in the companies they interact and transact with online. 

As we continue living so much of our lives online, we need to close the security gaps in our identity ecosystem. It starts with embracing a more nuanced definition of digital identity that doesn’t rely on any single credential or attribute such as username and password — and that’s flexible enough to apply across digital channels without adding undue friction to the user experience.

In today’s complex digital environment, we all know PIN numbers and passwords alone are no longer enough to confirm users’ identities. With modern solutions, it’s possible verify identity via device, account or individual user behavior by looking at an entire constellation of data points. These types of data points can include the following: 

• Individual information like your name, address and phone number. 

• Passwords and other authentication information for your account. 

• Device information like your cell carrier, how long an email account has been open for, or whether you’re logging in from a trusted device. 

• Contextual information like transaction or interaction history. 

Modern identity solutions leverage multi-layered, dynamic processes to replicate the kind of reasoning and risk assessments humans apply during face-to-face interactions. For example, if you bump into a friend in the street when you’re not expecting it, you’d still recognize them and have a nice chat. Similarly, if someone logs into an online account from an unfamiliar device, but types with the expected cadence for that user, a modern identity system can weigh those factors and assess whether the user is likely to be fraudulent. If fraudulent, the system could lock them out completely or issue a challenge, like a prompt over email, to further validate their identity. If the system determines the user is not fraudulent, it would allow their interaction with that account to continue. 

Tomorrow’s notion of identity goes beyond that: It provides the right identification layer for each user depending on their specific needs. Whether it’s based on the type of device they have (Does the device allow for biometrics?), their physical ability (Can the user only control the device through voice?) or simply what type of information a company needs from the user (Do they need to know this user is the account holder, that they are of legal age or do they need to see a copy of a driver’s license?). 

Customers deserve seamless, streamlined experiences that are adapted to their needs and their devices across all digital channels — but they need security, too. Using flexible combinations of security layers and data requirements, companies can continuously verify users with minimal friction and customize requirements to each situation. As more companies take a 360-degree approach to identity, we’ll see the growth of a ubiquitous identity ecosystem that supports seamlessness and inclusivity while also reducing fraud. 

Modern online identity reflects who we are as people, embracing rich human diversity. Innovation powered by Mastercard Identity is moving technology forward to embrace this understanding and build a more secure online ecosystem that nurtures user trust. Customers want more control over their personal data — and a robust form of digital identity can help provide it. 

For example, a modern digital identity solution can empower users to decide exactly which information to share and which information to keep private. Australia’s Deakin University used Mastercard’s digital identity service, ID, to verify the identity of students taking exams online, ensuring privacy and safety for the users’ personal data. Students created a shareable identity using a dedicated app on their phones, retaining complete ownership of which personal information was used. 

When they’re ready to take an exam, a student scans a QR code from the university’s online portal to launch the app. The app then shares only the specific, minimal data points the university system needs to verify identity — such as their full name — leaving the rest of the information the student shared totally private and locked within their phone. This revolutionary approach creates an experience that’s seamless and secure, while putting students in control of their privacy.

In the new digital reality, relying only on a person’s username and password simply isn’t enough. Effective identity verification requires additional layers of data and context to ensure users are truly who they claim to be. We must look at the big picture, rather than a single credential or isolated data point. Only by embracing a more adaptive and multi-layered approach to identity will we be able to build an ecosystem of seamless and secure online products and services that customers can trust.