ID please? MeitY verifies identity verification startups

Time of India

4 days ago

The
Ministry of Electronics and IT
(MeitY) has stepped up scrutiny of startups such as
Surepass
, Digitap, Zoop and Signzy for possible unauthorised access to Aadhaar, permanent account number (PAN) and goods and services tax (GST) databases, three people in the know told ET. The government is checking if these firms, which offer identity verification services, are using authorised service providers or bypassing protocols.
MeitY has restricted access to some of these companies' websites through certain telecom networks.
'Representatives of some of these firms are trying to meet government officials over the next few days to understand the concerns and what they can do to address the issue,' said one of the people cited.
The government allows regulated entities like banks to use Aadhaar under licence to authenticate their own customers. Authorities are trying to find out what routes are being used by these startups to offer such verification services.
These identity verification platforms work with financial services firms, consumer-facing startups and other entities that need to authenticate businesses or consumers they work with.
Live Events
Typically, they use these services to check for fraud and to underwrite these clients.
Discover the stories of your interest
Blockchain
5 Stories
Cyber-safety
7 Stories
Fintech
9 Stories
E-comm
9 Stories
ML
8 Stories
Edtech
6 Stories
ETtech
'We understand that access to the Zoop website is currently restricted on certain networks,' Zoop founder Ritesh Kothari told ET. 'This appears to be part of a regular regulatory clarification process initiated by MeitY involving multiple companies offering ID verification solutions.'
Kothari said Zoop has reached out to the relevant department to discuss the matter to understand the government's concerns.
'At this stage, we are not aware of the scope of or reason behind this action,' he said. 'Given this, we are unable to speculate on any causes for this takedown.'
Meity, Signzy, Surepass and Digitap didn't respond to queries.
'The government is becoming extremely careful about who is accessing citizen and business databases and how they are doing it. This move is part of that larger endeavour,' said one of the people cited.
ET reported on October 24 that
the National Payments Corporation of India (NPCI) has been cracking down on all forms of unauthorised access to the Unified Payments Interface (
UPI
) database by various startups that were using this to enrich customer data.
NPCI sent a letter in October last year asking all banks and fintechs to refrain from any unauthorised usage of the UPI database beyond payments, balance enquiries and settlement confirmations.
The second person quoted above said that some of the identity verification startups usually obtain customer application forms from clients and scrape multiple databases to verify them. This data is typically available online, some through open website links and application programming interfaces (APIs) or even through dark web databases, he said. The service is used to predict fraud, verify customers and authenticate users.
'While legal and authorised access to any database is not a problem, the authorities are concerned about any unauthorised access,' he added.
Experts said startups, some funded and some bootstrapped, have proliferated across the ecosystem and are scraping various government databases to offer these services. This could be unauthorised in many cases, they said.
Companies such as Idfy, DigiO, Signzy and Datasutram are the most popular identity verification platforms, offering services such as customer verification and fraud detection. Only certain platforms have faced penal action from the authorities, ET has learnt.
Signzy says it offers PAN, Aadhaar, driving licence and GST authentication. Digitap offers backend verification of government documents and Surepass provides Aadhaar verification APIs. The government is checking what licences are being used by these firms to offer these services.
While Signzy, founded in 2015, is backed by major venture funds such as Gaja Capital, Stellaris Venture Partners and Kalaari Capital, data from Tracxn shows that Pune-based Zoop was founded in 2016 and has only raised funding from a bunch of angel investors. Digitap is an unfunded startup based in Bengaluru and Surepass is a 2019-founded startup based in New Delhi and is yet to raise funds.
The third person cited above said that these trends indicate that India needs a stringent data security law urgently.
'Many technology-first platforms have accessed these databases through some means,' he said. 'They are also hoarding data and sometimes using that to offer certain services. The DPDP (Digital Personal Data Protection) Act is time-critical in this matter.'