Almost 20 years after the REAL ID Act became law, its enforcement is starting in full force. Starting May 7, travelers will need a REAL ID-compliant credential — or another Transportation Security Administration-approved document — to get through airport security or undergo additional screening.

The REAL ID Act was passed in 2005, in the aftermath of the 9/11 Commission reporting that the terrorists were able to obtain U.S. driver licenses. The law aimed to create a strong Federal standard for the process necessary to obtain a state driver’s license. To get around the federalism issue – specifically, that the decision on how to issue driver’s licenses is a state issue outside of Federal control – the REAL ID Act simply stated that states were free to continue to do what they wanted, but if they wanted their residents to be able to use state-issued driver’s licenses to access federal facilities and, most importantly, get through TSA airport security checkpoints, they would need to comply with Federal standards.

As we see REAL ID full enforcement begin, I am filled with, well, apathy. Improving driver license security and documentation is not a bad thing and has some value. But the fact that the single biggest issue getting Federal government attention in identity is tied to the kinds of plastic cards states issue in the physical world seems out of touch with the current threats in the digital world.

Generative Artificial Intelligence (GenAI) technologies with deepfakes are creating massive gaps in current identity verification processes. Beginning in 2023 and continuing in 2024, FinCEN observed an increase in suspicious activity reporting from financial institutions describing the use of deepfakes in fraud schemes. These schemes often involve criminals altering or creating fraudulent identity documents to circumvent identity verification and authentication methods.

Fraudsters can create deepfakes of driver licenses and images of individuals, bypassing prevalent identity verification technologies that are used to open bank account and apply for tax returns. This technology can bypass some liveness systems and other fraud detection systems enabling the deepfake technology to be used in real time. GenAI could enable financial services fraud losses to reach $40 billion in the United States by 2027, from $12.3 billion in 2023, a compound annual growth rate of 32%.

Legacy identity solutions — and I would put REAL ID in that category — are not sufficient to mitigate the attacks we’re seeing today. The current administration talks a big game when it comes to fighting fraud, waste, and abuse but at the same time they are shuttering programs that would look at better ways to fight fraudsters, protect individuals and companies from financial loss. Focusing on enabling a strong digital identity would go a long way toward fighting fraud, waste and abuse and protecting people and companies from fraud.

The administration needs to look at:

• Supporting state mobile driver license (mDL) projects — before leaving office, President Biden signed an executive order encouraging grant-making agencies to consider funding state mDL projects. This order has not yet been repealed, but there hasn’t been any action either. More than a dozen states are issuing mDLs but additional encouragement and resources to issue REAL ID-compliant mDLs would enable them to be used in the physical world and enable a high-assurance digital credential that could be used to prove identity online.
• Encourage government and commercial organizations to accept mDLs and other counterparts —it’s great for states to issue mDLs and other digital counterparts to state IDs, but the real value will be realized when consumers are able to use them across a variety of use cases online. The federal government should enable the use of mDLs for access to federal services and encourage states to do the same. Additionally, regulatory guidance that would explicitly permit other sectors — such as financial services — to accept mDLs for account opening would encourage greater use and acceptance of the credentials.
• Establish more government attribute validation services — The Social Security Administration is looking to expand and enhance the electronic Consent-based Social Security Verification system (eCBSV), which is a critical, privacy-preserving tool to prevent synthetic identity fraud – but is available today only to financial services companies. Beyond allowing Americans to ask SSA to “vouch for them” when they need to prove who they are to entities outside the financial services sector, there are other agencies that are also authoritative sources, and that could also vouch for an individual online.
• Create a U.S. digital identity strategy — The U.S. stands alone among our peers in having no vision of what “good” looks like when it comes to digital identity infrastructure or a plan on how to get us there in a way that improves security and privacy. The last time the U.S. government published a digital identity strategy was 2011, and it lapsed in 2016. It is time for the U.S. to prioritize digital identity again. Hundreds of billions of dollars in fraud could be prevented if we take steps to improve digital identity. These credentials – if implemented correctly – can also preserve the privacy of the individual using them by limiting the information shared during transactions.

This week will be an interesting one for many travelers, as many will not have the necessary IDs required to clear a TSA checkpoint. It will be fascinating to watch and see how airports handle the situation and how the government responds. Regardless of the outcome, it’s clear that the threats we face due to weak identity systems are at least as acute in the digital world as they are in the physical – and that government actions to mitigate these threats needs to expand beyond worrying about what sort of ID people bring to a TSA Checkpoint.

In January, the Better Identity Coalition published an updated Policy Blueprint for the New Administration, complete with a 22-point action plan laying out steps for the Administration and Congress to take to not only address concerns about identity fraud but also give Americans tools that they can use to better protect themselves everywhere they do business online. It’s high time that the government looks beyond REAL ID and identity challenges in the physical world to focus on critical vulnerabilities in the identity “fabric” that we use in the digital world.