Wise (formerly Transfer Wise) are asking me to send them photo of my ID

[gwnywg]

Hi HN,

I wonder if anyone here knows how is Wise handling photos of ID when they request one.

I'm Wise customer since 2012, used it without any problem multiple times and was happy with the service I was receiving.

A few days ago I received an email asking me to send a photo of my ID and also photo of my face.

I understand they are doing this to fulfill some regulations but on the other side I can't stop thinking what damage will it cause if they fall a victim of hackers attack and photo of my ID is stolen from them. In the country where I live you can take a loan based on information from ID.

Please share if you have gone through that process or if you know what they do with those photos once they confirm the photo of face matches with the photo on ID. I asked them through e-mail and will post here if I hear back.

--edit--

I should have mentioned photos are uploaded through Wise web app, not through the e-mail, sorry if my explanation was confusing.

[traceroute66]

Speaking as a long-standing Wise customer who was asked to revalidate ID within the last 12–18 months ....

If Wise are asking you to email your ID, then that request is NOT kosher. Period.

A real email from Wise would invite you to login to the Wise website and upload it.

You do not even have to follow a specific link, because they flag your account so that whenever you login you are instantly prompted to upload ID. Infact the same flag will put a temporary block on your account until such time as you have submitted ID and they have validated it.

So, it follows that if you can independently visit the Wise website, and you can login, and you are NOT prompted for ID, then you have hard confirmation right there that the email you received is not kosher.

IN ADDITION: I would invite you to go to your Wise profile settings and add a custom "email ID" (or whatever they call it) that way you know for sure if a Wise email is kosher because only you and they know the ID that will show at the top of any genuine email they send you.

[Fischgericht]

This is called "Perpetual KYC" (Know-your-customer), it didn't exist back when you signed up. Depending on your risk score, your data needs to be validated every 5 years, every 3 years or even annually.

So, this is the new normal.

(I also just had to do it yesterday.)

I still love Wise and I am happy to go through this KYC stuff. Because in exchange they pretty much accept paying everywhere, where other payment providers would block your payment. I often have the situation that credit cards from my local (German) bank reject purchases made abroad, and every time I am so happy that Wise always works.

[amanzi]

"So, this is the new normal." You're right - I've had to do a few KYC checks recently with banks, lawyers, and accountants, and in the past I've had to do it for a personal finance application for an "interest-free deal" from a furniture store. Here in NZ there's legislation that mandates the KYC checks as part of anti-money laundering laws.

Unfortunately, I've already had sensitive information breached because of this - twice! One was from a large financial institute in Australia called Latitude - I didn't even know that I had ever interacted with them, but they are the parent company of a bunch of these interest-free credit card deals.

So yes, this is the new normal but it's not good.

[moffkalast]

More to the point, regular banks are subject to this as well (although Wise keeps insisting it's not a bank, fooling exactly nobody) and require people to show up in person for identity verification every so often. At least mine was pompous enough to demand that.

[traceroute66]

> I am so happy that Wise always works.

Always works is a bit strong. I have a few horror stories.

Certainly Wise are not as good as they used to be back in the day.

I still use them, mostly because they are probably the safest fintech outfit compared to the others that operate out of, e.g. Hong Kong. But I'll still never forgive them for some of the dumb shit they've done on some of my transactions in recent years (sadly I can't discuss in public because, well, you know, security).

What I can say publicly are more generic things like how transactions can be so lethargic these days, i.e. operationally they are clearly batching and netting far more aggressively, which is clearly entirely for their operational convenience ... who cares if your transaction doesn't go through for 4–8 hours, right ?

[paulette449]

Over Black Friday I tried to buy two pairs of shoes from Vessi. This would've been my third order from them with the same delivery details in 24 months. They told me my order was flagged for random security check and asked me to send them a copy of my driving license / passport by email. I told them that these were an incredibly sensitive documents with which a bad actor could literally take over my life, reminded them that I was a repeat customer, and asked them if they could send me any independent verification of their cybersecurity chops. They responded with a templated response telling me that the order would be cancelled if I didn't send them my license/passport. I told them to go ahead and cancel it. They've lost me as a customer. I'm not sending those documents to a shoe store with no ability to even confirm there is any security behind the scenes.

[mmxmb]

Yes, I’ve received a similar email from them in the past. It’s not the first time a financial services company asked me for these documents in the recent years. I assume they need it for their KYC/AML checks.

In my case, I believe it was triggered by a specific transfer I received. But I didn’t want to ask for details why that happened, since that’s usually considered a red flag by a financial services provider.

[solardev]

I had to do the same thing when I signed up a while ago. I thought they'd just scan it and trash it, but apparently not... their privacy policy says they do collect the photograph, national ID info, etc. And then they'll do their best to protect it: https://wise.com/gb/legal/global-privacy-policy-en

> Additional information you give us for security, identification and verification purposes may include your [...], photograph, [...], proof of residency, passport and/or National ID. If you fail to provide any of this information, it might affect our ability to provide our Services to you.

> As part of our identity verification process we collect, use and store biometric data, namely: We extract face scan information from photos and videos [...]. We will retain biometric data for the period necessary to complete the identity verification process, and in any case no longer than 1 year after collection, unless required by law or legal process to keep it longer.

Their US Facial Scan privacy policy has a bit more detail, and apparently they outsource that to a company called Onfido (https://onfido.com/): https://wise.com/us/legal/facial-scan-notice

I'm not sure if that same method is used internationally.

But yeah, it's an overall risk for sure. You'd hope they'd be a bit more cautious being a financial institution and such, but you never know. If it gets leaked, it'd probably be very hard to deal with a situation like this internationally.

[gwnywg]

Thanks, I'll dive into sources you shared. At the moment I'm glad I'm not dependant on my Wise account...

[voussoir]

I had an account with privacy.com for about four years, then in July of this year they disabled my account and requested I upload photo ID and a selfie. I told them that if a four-year-old account with no issues has suddenly "failed to validate security checks", that's their problem and not mine. So, my account is still suspended and I've never used it again.

I was on their free plan anyway, so I can't say they "lost a customer". But I think asking users to upload a selfie is humiliating and I don't want to take part in it.

[TekMol]

I think in most countries, and ID is to identify yourself with it. Not to copy it by giving someone a photo of it. If you give someone a photo, they could identify as you with that photo, breaking the whole concept of an "ID".

What happens if you don't give them a photo of your ID? Do you already have funds from you? Are they in the same country as you? I would be surprised if they could legally blackmail you into giving them a photo of your ID.

[gruez]

>I would be surprised if they could legally blackmail you into giving them a photo of your ID.

AML/KYC laws mandate that they "blackmail" you into giving your ID, otherwise they risk being prosecuted for failing to comply.

[lxgr]

Well, all this nonsense is just what happens when the provider of analog IDs (usually a federal, state, or local government) does not step up and provide a digital equivalent.

Online photo ID verification just does not make any sense at all: Identity documents usually have physically hard to forge features that just make no sense in a remote context, and that’s not even factoring in generative AI.

Looking at an ID document without a person standing next to it (whether online or in person) is one level of ridiculous beyond that.

But all of this is brought to you by the industry that thinks an SSN is a bearer authentication token, so I’m not too surprised.

[i_have_an_idea]

Due to AML regulations, banks and e-money institutions are required by law to perform KYC procedures on their customers. That invariably means storing and verifying your govt issued ID.

If you don't want to provide your ID, then that essentially limits your options to:

1) cash

2) crypto (assuming you never interface with exchanges/banks)

3) use e-money services up to the cumulative amount that triggers the KYC process. I forget what that is, but probably a few hundred dollars.

[traceroute66]

> use e-money services up to the amount that triggers the KYC process. I forget what that is, but probably a few hundred dollars.

Just FYI this is not viable because the limit is cumulative. So you can't just fly under the radar with a bunch of small transactions. Once you hit the KYC limit, ID becomes mandatory.

[Aardwolf]

> That invariably means storing and verifying your govt issued ID.

I get the verifying part, but why is storing after the verification needed?

[n8ta]

I use wise ~1 time / yr. Last time I started a transfer they required ID first. I uploaded two photos and my account was immediately locked since my bday on ID did not match my wise acct (typo). Quick email to support and it was unlocked 2 hrs later. Was able to complete my transaction after that without issue. Fine experience overall if inconvenient.

[nonrandomstring]

Treat this as an additional cost.

It's no different than the overhead of a delivery charge, fuel to drive to a event, a sales tax or any other cost you need to factor into a decision or purchase.

Problem is that high probability [0] of data loss doesn't seem a tangible harm you easily attach a dollar value to. You should think about this and try, even if you are wrong, to get a sense of what that really means to you as a loss prospect [1].

If the company is "doing it because of some regulation" that's their problem not yours. You will find alternatives. Meanwhile their claims to need your ID photo is simply their cost of doing business in that market, and if that loses them customers, then things are working as expected.

[0,1] Probably higher than you think

[KaiserPro]

Your location is the biggest determinant of this. I'm in the UK and was asked to re-validate my ID recently.

I had to provide my ID when I signed up about 4 years ago.

This is part of the theatre of stopping small scale money laundering. Any laundering not using HSBC[1] is considered bad form.

[1]https://www.fca.org.uk/news/press-releases/fca-fines-hsbc-ba...

[imarkphillips]

Yep. Wise are one of the more agressive banking providers with their KYC. Twice yearly is becoming normal for Wise. (7 year customer here too)

But its normal for banks to do this. One of my banks (our group has over 10 accounts on 4 continents) even sent a KYC renewal the day after my French residency permit expired. Had to upload and tdo the selfie thing with the new permit to get access to the account again.

I echo the other comments that you should use the official banking apps for doing your KYC/KYB process.

[EricRiese]

I feel like the way this sort of thing should work is you'd have a class of entities that you would trust to be identity providers, like banks, credit unions, ID.me, maybe cell providers and maybe Google/Apple/Microsoft if you so choose. Then another class of entities like Wise or regular merchants could verify your identity via some sort of OAuth connection with a cryptographic handshake underneath.

[solardev]

Isn't that basically Plaid?

[tkiolp4]

But do they need to keep your ID in their dbs? I would imagine a simple check would suffice and then they could discard the uploaded ID. They could check every year. I really don’t trust internet companies in general, and having to upload my passport in many websites worries me. Last time it was Hetzner. I also use Wise. What’s next? Amazon?

[isbvhodnvemrwvn]

For compliance you need ability to prove you did actually validate the ID and not just ticked a checkbox.

[lxgr]

Of course online services need your photo ID! How else are they going to make sure the person standing in front of them is really you? /s

This pattern is up there with “SSN as an authentication bearer token” and needs to stop yesterday (but I’m not holding my breath for that).

[gwnywg]

In the country where I live we have a system which allows me to prove my identity online without having to show my ID (actually I must admit I'm quite impressed by this system). But sadly, Wise is not taking advantage of that..

[lutorm]

In Sweden, you can't open a bank account without showing your face and ID. I just had to do this for my Wise account, too, and it seems par for the course for the quite intrusive money laundering rules in the EU these days.

[sireat]

Every money transmitter/service/bank/financial institution/western facing crypto exchange/auction house/betting place at some point in time(at certain transcational threshold (ask a black box for the threshold)) will ask for ID/some sort of KYC.

Now you can of course decline, but it will severely limit your options.

[daft_pink]

It's a money transfer service. They have strict regulatory requirements.

I've used them for a long time and I feel they are honest.

[latchkey]

Wow, that's all?

Wise made me send them $20 to prove myself before they would allow me to accept money from a friend whom I loaned $500 during covid (also through Wise).

Of course, I could withdraw it afterwards, for another small fee.

If only there was an easy decentralized way to send money around the world without all this KYC bullshit... I know that there are criminals in the world abusing the system and we all have to pay for it, but still... there should be a way to mark yourself as "global entry" and stop presuming that you're a fraudster...

[gwnywg]

Some time ago I had to deposit £20 in order to open an account in another country, which I could accept :) but them storing photo of my ID... makes me feel bad. I would send it if it was used as mean to confirm my data and then erased. If they store it I'm trying to evaluate risk I'm taking...