camaraproject / KnowYourCustomer

Repository to describe, develop, document and test the KnowYourCustomer API family
Apache License 2.0
7 stars 5 forks source link

Add postpaid / prepaid / business information to KYC Match #95

Open HuubAppelboom opened 3 weeks ago

HuubAppelboom commented 3 weeks ago

In the current Mobile Connect specification of KYC Match there is also a feedback what type of subscription the user has.

We have recently seen quite some fraud cases in which this kind of information is valuable for developers. Most fraud cases happen in my country with anonymous prepaid cards, but for business user subscribers there is limited or no risk (because there sim cards are registered by a business).

I therefore we propose to include this kind of info also in the CAMARA version of KYC Match.

In the Mobile Connect spec it is specified as (optional) billing_segment, with Allowed values “PAYG”,” PAYM”, “Business” See https://www.gsma.com/solutions-and-impact/technologies/mobile-identity/wp-content/uploads/2023/01/IDY.23-v1.0.pdf Page 16.

KevScarr commented 3 weeks ago

@HuubAppelboom What rules would you propose for when those attributes are returned, ie how many (if any) of the fields provided would need to match before these values are returned?

HuubAppelboom commented 3 weeks ago

@KevScarr I would propose to make these return values optional, and let the MNO's decide on local market conditions in what case they return the data. For example, in case you have anonymous prepaid in a market, you always return the data, so the customer decide to ask for additional identification in case the answer is PAYG, ans skip this additional identifcation if the answer is PAYM or Business. In countries where identification for prepaid SIMs is regulated mandatory, I would only offer the data as at least for example family name is matching.

KevScarr commented 3 weeks ago

@HuubAppelboom Excellent - Sharing your best practise (like the above) or a recommendation would help everyone have a common service; I think this was one failing from the MobileConnect days as we had 4 different sets of logic in our country for when they would be returned. I fully accept your point, Camara can't mandate the return of these values.