The Document-Authentication Vendor's Scan Corpus Leaks — severe-but-plausible scenario — ITOL

Vector: Third-Party & Concentration · Severity: severe

The vendor that authenticates driver's licenses for the bank's onboarding kept the scans. Now they are for sale, infrared and ultraviolet images included. Fraudsters hold perfect templates and the control itself is untrustworthy. The bank suspends digital document verification and branch ID scanning, and owes notices to customers whose licenses were scanned.