Companies that keep digital identity verification in-house face a pronounced exposure to adversarial bots and agents: 53% report know-your-agent (KYA) related incidents or losses, compared with 28.8% of firms using a mix of internal and external teams and 24.1% of those relying on external providers. The difference shows that the way identity verification is operated can affect both security outcomes and the business costs that follow.
The findings come from PYMNTS Intelligence’s “How Enterprises Can Build a ‘Know Your Agent’ Defense: Digital Identity Verification in the Age of Bots,” produced in collaboration with Trulioo. The study surveyed 350 leaders in compliance, risk management, fraud, underwriting, supplier acquisition and merchant monitoring at global companies. Overall, 89.5% of organizations say managing bot traffic is a challenge, and 52.3% reported an increase in bot traffic over the prior year.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Three findings show how the operating model changes the problem:
- In-house teams absorb more KYA losses and customer friction. Internal teams report the highest KYA incident/loss rate at 53%. They also rely heavily on manual review: 86.4% use staff reviews in their verification processes. The customer cost is visible in onboarding, where 61.4% of internally managed programs report missed business opportunities from user abandonment caused by friction. Their average false-positive rate is 3.3%.
- External teams reduce some direct risk but create consistency and expansion problems. Only 24.1% of externally managed programs report KYA-related incidents or losses, and their false-positive rate is 2.2%. But 82.8% report inconsistent results from their outsourced technology, while 81% say their setup contributes to an inability to add or expand customers, markets and geographies.
- Hybrid models land between the two on incidents, but they are not insulated from attack. Companies combining internal and external teams report a 28.8% KYA incident/loss rate and a 2.7% false-positive rate. They also report the highest exposure to credential stuffing and account takeover attempts, at 73.1%, and 60.2% report fake account creation during sign-up.
The data does not point to a single operating model that eliminates the trade-offs. Internal programs report more direct KYA incidents and onboarding friction; external programs report fewer incidents but more technology inconsistency and limits on expansion; hybrid programs reduce the incident rate from the in-house level while remaining exposed to credential-based attacks. For enterprises, the operating question is how to combine verification accuracy, automation and layered controls without turning identity checks into either a security gap or a barrier for legitimate users.
At PYMNTS Intelligence, we work with businesses to uncover insights that fuel intelligent, data-driven discussions on changing customer expectations, a more connected economy and the strategic shifts necessary to achieve outcomes. With rigorous research methodologies and unwavering commitment to objective quality, we offer trusted data to grow your business. As our partner, you’ll have access to our diverse team of PhDs, researchers, data analysts, number crunchers, subject matter veterans and editorial experts.
Add as Preferred Source
