UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM
10-K
(Mark One)
☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
For the fiscal year ended December
31, 2022
☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
For
the transition period from to
Commission file number 001-40747
authID
Inc.
(Exact name of registrant as specified
in its charter)
1385 S. Colorado Blvd
Denver,
CO80222
(Address of principal executive offices)
Registrant’s telephone number,
including area code: 516-274-8700
Title of each class Trading Symbol: Name of each exchange on which registered
Common Stock par value $0.0001 per share AUID The Nasdaq Stock Market, LLC
Securities registered pursuant to
Section 12(g) of the Exchange Act:
Common Stock, $.0001 par value
per share
(Title of class)
Indicate by check mark if the registrant is a well-known
seasoned issuer, as defined in Rule 405 of the Securities Act ☐
Yes ☒No
Indicate by check mark if the registrant is not required
to file reports pursuant to Section 13 or Section 15(d) of the Act. ☐
Yes ☒No
Indicate by check mark whether the
registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding
12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing
requirements for the past 90 days. ☒ Yes☐
No
Indicate by check mark whether the
registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§
232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).
☒Yes☐
No
Indicate by check mark whether the
registrant is a large accelerated filer, an accelerated filer, a non- accelerated filer, or a smaller reporting company. See the definitions
of “large accelerated filer”, “accelerated filer”, “non-accelerated filer”, “smaller reporting
company” and “emerging growth” in Rule 12b-2 of the Exchange Act.
Large Accelerated filer ☐ Accelerated filer ☐
Non-accelerated filer ☒ Smaller reporting company ☒
Emerging growth company ☒
If an emerging growth company, indicate
by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial
accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☒
Indicate by check mark whether the
registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over
financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C.7262(b)) by the registered public accounting firm that prepared
or issued its audit report. ☐ Yes ☒No
Indicate by check mark whether the
registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). ☐
Yes ☒ No
As of June 30, 2022, the last business
day of the Registrant’s most recently completed second fiscal quarter, the market value of our common stock held by non-affiliates
was $42,823,720 which is based on the average bid and ask price of such common equity, as of the last practical business day of the registrant’s
most recently completed second fiscal quarter of $1.73.
Indicate the number of shares outstanding
of each of the registrant’s classes of common stock as of the latest practicable date.
Class Outstanding at March 30, 2023
Documents incorporated by reference: None
TABLE OF CONTENTS
GENERAL INFORMATION
PART I
Item 1. Business 1
Item 1A. Risk Factors 13
Item 1B. Unresolved Staff Comments 27
Item 2. Properties 27
Item 3. Legal Proceedings 27
Item 4. Mine Safety Disclosures 27
PART II
Item 6. Reserved 31
Item 8. Financial Statements and Supplementary Data 40
Item 9A. Controls and Procedures 40
Item 9B. Other Information 40
Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspection 40
PART III
Item 10. Directors, Executive Officers and Corporate Governance 41
Item 11. Executive Compensation 45
Item 14. Principal Accounting Fees and Services 56
PART IV
Item 15. Exhibits and Financial Statement Schedules 57
SIGNATURES 59
i
FORWARD-LOOKING STATEMENTS
Certain statements discussed
in Item 1 (Business), Item 1A (Risk Factors), Item 3 (Legal Proceedings), Item 7 (Management’s Discussion and Analysis of Financial
Condition and Results of Operations), Item 7A (Quantitative and Qualitative Disclosures About Market Risk) and elsewhere in this Annual
Report on Form 10-K as well as in other materials and oral statements that the Company releases from time to time to the public constitute
“forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking
statements concerning management’s expectations, strategic objectives, business prospects, anticipated economic performance and
financial condition and other similar matters involve significant known and unknown risks, uncertainties and other important factors that
could cause the actual results, performance or achievements of results to differ materially from any future results, performance or achievements
discussed or implied by such forward-looking statements. Such risks, uncertainties and other important factors are discussed in Item 1A
(Risk Factors) and Item 7 Management’s Discussion and Analysis of Financial Condition and Results of Operations. In addition, these
statements constitute the Company’s cautionary statements under the Private Securities Litigation Reform Act of 1995. It should
be understood that it is not possible to predict or identify all such factors. Consequently, the following should not be considered to
be a complete discussion of all potential risks or uncertainties. The words “anticipate,” “estimate,” “expect,”
“project,” “intend,” “believe,” “plan,” “target,” “forecast” and
similar expressions are intended to identify forward-looking statements. Forward-looking statements speak only as of the date of the document
in which they are made. The Company disclaims any obligation or undertaking to provide any updates or revisions to any forward-looking
statement to reflect any change in the Company’s expectations or any change in events, conditions or circumstances on which the
forward-looking statement is based. It is advisable, however, to consult any further disclosures the Company makes on related subjects
in its Quarterly Reports on Form 10-Q and Current Reports on Form 8-K filed with the Securities and Exchange Commission.
Emerging Growth Company
Status
We are an “emerging growth
company,” as defined in the Jumpstart Our Business Startups Act enacted in April 2012, and, for as long as we continue to be an
“emerging growth company,” we may choose to take advantage of exemptions from various reporting requirements applicable to
other public companies including, but not limited to, not being required to comply with the auditor attestation requirements of Section
404 of the Sarbanes-Oxley Act of 2002, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy
statements, and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval
of any golden parachute payments not previously approved. We will remain an “emerging growth company” until the earliest of
(i) the last day of the fiscal year in which we have total annual gross revenues of $1 billion or more; (ii) the last day of the fiscal
year following the fifth anniversary of the date of the first sale of our common equity securities pursuant to an effective registration
statement; (iii) the date on which we have issued more than $1 billion in non-convertible debt during the prior three year period; and
(iv) the date on which we are deemed to be a “large accelerated filer.” We may take advantage of the extended transition period
until the first to occur of the date we (i) are no longer an “emerging growth company” or (ii) affirmatively and irrevocably
opt out of the extended transition period. Consequently, our financial statements may not be comparable to companies that comply with
public company effective dates.
ii
PART I
Item 1. Business Overview
authID Inc. (together with
its subsidiaries, the “Company”, “authID”, “we” or “our”) is a leading provider of secure,
authentication solutions delivered by our easy to integrate VerifiedTM platform. Our Verified
platform delivers Human Factor AuthenticationTM (“HFA”) that binds strong passwordless authentication with biometric
identity, which offers our customers a streamlined path to zero trust architecture. Verified FIDO2 passwordless authentication is certified
by the FIDO Alliance to be compliant and interoperable with FIDO specifications.
The explosive growth in online
and mobile commerce, telemedicine, remote working and digital activities of all descriptions is self-evident to everyone who lived through
the Covid 19 pandemic since 2020. Yet this has been coupled with a rampant rise in identity theft, phishing attacks, spear-phishing, password
vulnerabilities, account takeovers and benefits fraud. Cyberattacks that are the result of compromised credentials are significant impediments
to the operations and growth of any business or organization, and dealing with the risks and consequences of these criminal activities
has created significant friction in time, cost and lost opportunity. Consider all the outdated methods that organizations have implemented
in order to prevent fraud. The requests to receive and enter one-time passwords, that can be easily hijacked. The vulnerable security
questions you get asked – whether on-line or when reaching out to a call center – what was your first pet’s name? who
was your best friend in high school? These steps all add up to friction, making it difficult for consumers to login, transact and execute
daily tasks, with little added protection from fraud. Surely there is a better way to address these challenges. authID believes there
is.
authID provides secure, biometric,
identity verification, and strong passwordless and biometric authentication for both consumer and workforce applications. We maintain
our globally accessible, cloud-based Verified platform for our enterprise customers to enable their users to easily verify and authenticate
their identity through a mobile device or desktop, without requiring dedicated hardware, or authentication apps. We can help our customers
establish a proven identity, creating a root of trust that ensures the highest level of assurance for our phishing resistant, passwordless
login and step-up authentication products. Our patented technology enables participants to consent to transactions using their biometric
information with a digitally signed authentication response, embedding the underlying transaction data and each user’s identity
attributes within every electronic transaction message processed through our platform.
Digital transformation
across all market segments requires trusted identity. Our Verified platform offers innovative solutions that are flexible, fast and easy
to integrate and offer seamless user experiences. authID’s products help advance digital transformation efforts without the fear
of identity fraud, while delivering frictionless user experiences. We believe that it is also essential that electronic transactions have
an audit trail, proving that the identity of the individual was duly authenticated. Our platform provides biometric and multi-factor identity
software, which are intended to establish, authenticate and verify identity across a wide range of use cases and electronic transactions.
authID’s
products focus on the broad requirement for enabling frictionless commerce by allowing an entity to instantly “Recognise Your Customer”
or employees. Organizations of all descriptions require cost-effective and secure means of growing their business while mitigating identity
fraud. We aim to offer our enterprise customers products that can be integrated easily into each of their business and organizational
operations, in order to facilitate their adoption and enhance the end user customer or employee experience.
Our management
believes that some of the advantages of our Verified Platform approach are the ability to leverage the platform to support a variety of
vertical markets and the adaptability of the platform to the requirements of new markets and new products. Verified is a cost-effective,
secure, and configurable mobile solution. Our target markets include banking, fintech, healthcare and other disrupters of traditional
commerce, small and medium sized businesses, and system integrators working with government and Fortune 1000 enterprises. At its core,
the Company’s offering, combining its proprietary and acquired biometric and artificial intelligence technologies (or AI), is intended
to facilitate frictionless commerce, whether in the physical or digital world. The Company intends to continue its investment in developing,
patenting and acquiring the various elements necessary to enhance the platform, including our use of artificial intelligence in proprietary
software, which are intended to allow us to achieve our goals.
authID is dedicated
to developing advanced methods of protecting consumer privacy and deploying ethical and socially responsible AI. We believe that a proactive
commitment to ethical AI presents a strong business opportunity for authID and will enable us to bring more accurate products to market
more quickly and with less risk to better serve our global user base. Our methods to achieve ethical AI include engaging the users of
our products with informed consent, prioritizing the security of our user’s personal information, considering and avoiding potential
bias in our algorithms, and monitoring of algorithm performance in our applications.
On May 4, 2022,
the Board of Directors of authID (the “Board” or the “Board of Directors”) approved a plan to exit from certain
non-core activities comprising the MultiPay correspondent bank payments services in Colombia and the Cards Plus cards manufacturing and
printing business in South Africa (“Cards Plus business”). On August 29, 2022 the Company executed and completed the sale
of the Cards Plus business. As of December 31, 2022 and 2021, Cards Plus Pty Ltd., MultiPay S.A.S., and IDGS S.A.S assets are presented
as assets held for sale on the Company’s Consolidated Balance Sheets and their operations presented as discontinued operations in
the Consolidated Statements of Operations as they met the criteria for discontinued operations under applicable accounting guidance.
1
The Company
was incorporated in the State of Delaware on September 21, 2011, and changed our name from Ipsidy Inc. to authID Inc. on July 18, 2022.
Our Common Stock
is traded on the Nasdaq Capital Market under the trading symbol “AUID”. Our corporate headquarters is located at 1385 S. Colorado
Blvd, Denver, CO 80222 and our main phone number is (516) 274-8700. We maintain a website at www.authid.ai. The information contained
on, or that can be accessed through, our websites is not incorporated by reference into this prospectus and is intended for informational
purposes only.
Global Market Opportunity
The drive towards
digital transformation since 2020 and the COVID-19 pandemic as well as the rampant growth in fraud that exploits human vulnerability have
contributed significantly to several market trends driving growth and demand for stronger, more secure identity verification and authentication
solutions and services such as those authID provides. The accelerated pace of digital transformation at the enterprise level has been
driven largely by the increased demands for online goods and sharing-economy services by consumers. The shift to working from home, and
the remote IT challenges this lifestyle change presents is also driving opportunities for strong workforce identity and application access
authentication. Today, even as more companies started return to work in the office, data show that millions of workers will continue to
work remotely and hybrid, a long-term shift that will require enhanced security across many industry sectors.
Unfortunately,
the increase in remote work and digital, non-face-to-face commerce has also resulted in increased fraud, phishing scams and cyber security
risks. These trends, as well as increased regulation mandates by governments, whether Federal, State, local or international, are key
drivers of the need for improved processes to verify and authenticate identities.
Digital Transformation
Digital transformation, or
the integration of digital technology into all areas of a business, is fundamentally changing how organizations operate and deliver value
to customers. The global disruption of the last two years dramatically increased the need for organizations to be more agile to meet changing
markets, evolving technology and consumer demands. According to IBM research, more than 60% of surveyed executives are using this period
of change to rapidly advance their enterprise’s transformation (IBM Institute for Business Value “Digital Transformation Report”
2021). A McKinsey Global Survey of executives found that companies have accelerated the digitization of their customer and supply-chain
interactions and of their internal operations by three to four years (McKinsey, October 2020). According to Statista, spending on digital
transformation will grow from $1.8 trillion in 2022 to $3.4 trillion by 2026. Statista also forecasts that as much as 65% of the world’s
gross domestic product will be digitalized by 2022 (Statista “Spending on digital transformation technologies and services worldwide
from 2017 to 2026” Nov, 2022).
Digital and
mobile technologies have significantly changed people’s lives in a remarkably short time, including how we work, shop, socialize
and bank. Escalating increases in mobile application downloads for digital goods and services by even the most reluctant consumers, dramatically
altered service delivery across broad market segments, creating lasting effects that we believe are likely to stay.
Enterprises
that were able to, scrambled to reduce reliance on physical outlets and to drive customers to remote digital channels offering seamless
and secure user experiences. Electronic services—from mobile banking to online grocery shopping to tele-medicine—have increased
multifold since 2020.
The Increase in Identity Fraud and Social Engineering
Attacks
The increased demand for online
services, remote working and digital convenience, has created another challenge for organizations– the need to improve cybersecurity
measures. We believe that criminals have never been more active in using stolen data or credential-stuffing attacks in attempts to infiltrate
corporate networks.
Today,
legacy methods of authenticating identity online including passwords and one-time pin codes, or knowledge-based questions no longer create
a safe digital world. Nearly every day, we read about significant data breaches at large organizations including Twilio, Cisco, Intuit,
and recently PayPal. All of them have one thing in common. The hackers all used social engineering attacks that exploited human behavior
and, in particular, vulnerable, legacy MFA technology. As quickly as Chief Technology and Information Officers, and Identity Access Management
Architects supplement passwords with phishable, one-time passwords or clunky push MFA apps, hackers are finding new ways to exploit security’s
‘human’ element. In the 2022 Verizon Data Breach Investigation Report, the human element was identified as the root cause
of 82% of 4,000 data breaches studied. Juniper Research forecasts that the total number of exposed records from data breaches will grow
by 33% over the next four years, reaching 27.5 billion in 2027.
2
So, after 60 years of passwords,
we believe the market is in the midst of a fundamental evolution in the science of authentication, with a renewed push to replace these
hated and insecure credentials with cryptographic FIDO2 passkeys, or a FIDO token bound to a device. According to Research and Markets,
the market for Passwordless Authentication is projected to grow over the next 10 years at a compound annual growth rate (“CAGR”)
of more than 16%, to almost $54 billion by 2030, from approximately $13 billion today. North America is expected to dominate the global
passwordless authentication market, currently accounting for at least 38% of the worldwide market. Further, with the data indicating that
banking and healthcare are dominating the shift to passwordless authentication, we feel confident that we are targeting the right market
segments.
Passwords
are not only ripe for compromise. They also cost organizations time and money. Estimates indicate that an organization with 15,000 employees
can lose annually up to $4 million in productivity, with employees spending over 12 hours per year on remembering, searching for and
resetting passwords. Organizations also allocate significant IT resources to manage and store passwords. Forrester Research has stated
that the average help desk labor cost for a single password reset is about $70. (Forrester Research “Best Practices: Selecting,
Deploying, And Managing Enterprise Password Managers” 2018) Forrester Research determined that large organizations spend up
to $1 million per year on staffing and infrastructure to handle password resets alone.
MarketsandMarkets, the B2B
research firm, projects that the global digital identity solutions market will grow from $27.9 billion in 2022 to $70.7 billion by 2027,
at a five-year CAGR of 20.4%. The company attributes this significant growth to the increase in identity-related frauds and data breaches,
as well as compliance with existing and upcoming regulations. The firm further predicts that the market for digital identity and document
verification services, a subset of the digital identity market, offers significant potential for growth opportunities, with revenues to
rise from $9.9 billion in 2022 to $18.6 billion by 2027 (MarketsandMarkets “Digital Identity Solutions Market- Global Forecast
to 2027” 2022 and “Identity Verification Market Global Forecast to 2027” 2022).
The Drive for Zero Trust Security
The term ‘Zero
Trust’ first coined in 2010, by Forrester analyst John Kindervag, declares that all network traffic is untrusted and that any request
to access any resource must be done securely. (Forrester Research “Build Security Into Your Network’s DNA: The Zero Trust
Network Architecture”, 2010). Zero Trust requires that all users, both inside or outside the organization’s network, be authenticated
before being allowed to access applications and data.
In 2021, as
the rate of cybercrime, digital fraud and ransomware spiraled upward, the Biden Administration issued an executive order (the “Biden
Order”) calling on the U.S. government to institute “bold changes and significant investments” in security measures
to better insulate federal networks from attack. This was followed by the White House Office of Management and Budget in October 2021
defining a “zero trust” strategy, outlining the security architecture required to overhaul federal cybersecurity practices.
In January 2022, the Administration gave federal agencies until the end of the fiscal year 2024 to “achieve specific zero trust
security goals.”
The Zero Trust
approach will likely further drive nationwide adoption of multi-factor authentication (MFA), the requirement of additional verification
factors, so users cannot log in with just a username and password. Solutions for achieving zero trust are not likely to include legacy
MFA options like vulnerable one-time pin codes or easy-to-discover, knowledge-based questions like “What was the make of your first
car?” The Biden Order specifically stated that “agency systems must discontinue support for authentication methods that fail
to resist phishing, including protocols that register phone numbers for SMS or voice calls, supply one-time codes, or receive push notifications”
Attacks on these legacy methods have proven enterprises will need stronger authentication alternatives to establish trust and defend against
highly sophisticated cybercriminal networks.
The Biden Order is expected
to drive deployment of upgraded security methods by both the federal government and private sector businesses that contract with the government.
We may also expect to see a change from security vendors and enterprise organizations across a range of market segments, as they look
to the Biden Order for guidance. In the post-COVID-19 scenario, the global zero trust security market size is projected to grow from $
27.4 billion in 2022 to $ 60.7 billion by 2027, recording a CAGR of 17.3% from 2022 to 2027 (MarketsandMarkets, “Zero-Trust Security
Market Global Forecast to 2027” ). Furthermore, in a recent survey conducted by Okta, “The State of Zero Trust Security 2022”
they predicted that zero trust option rates passed a critical threshold in 2022. The Okta survey found that more than half of the organizations
surveyed (55%) have a Zero Trust initiative in place, and the vast majority (97%) plan to have one in the coming 12 to 18 months.
Remote Working
Over the last
three years, the pandemic’s stay-at-home mandates accelerated the transition to remote and hybrid work across many industries. Today,
even as more companies started return to work in the office, data show that millions of workers will continue to work remotely and hybrid.
3
While remote, decentralized
teams and hybrid work environments have become common, remote work can also increase opportunities for hackers to infiltrate corporate
networks. Enterprise IT organizations must now address new IT requirements and cyber challenges generated in the work from home environment.
Studies have also shown that employees are more likely be distracted when working from home and more susceptible to phishing scams. According
to Equifax, cyber- attacks are much more likely to occur through mundane errors like a user choosing an easy-to-guess password or not
changing the default password on something like a router.
To meet the
increased enterprise security and mobility needs of this expanded remote workforce, IT decision makers are reassessing their data protection
strategies in an effort to secure these remote workers and protect company assets. While IT continues to drive password hygiene through
security training sessions, we believe legacy tools like one-time pin codes and knowledge-based authentication are no longer effective
in mitigating risks.
The result
is increased demand for next-generation biometric authentication technology and a greater urgency to transform quickly. According to Ranjit
Atwal, Senior Research Director at Gartner, “Through 2024, organizations will be forced to bring forward digital business transformation
plans by at least five years. Those plans will have to adapt to a post-COVID-19 world that involves permanently higher adoption of remote
work and digital touchpoints
The FIDO Alliance – The Mission To Eliminate Passwords
The reliance
on passwords has long been acknowledged as highly frustrating for users, costly for organizations to maintain and reset quickly, as well
as one of the weakest security practices for user authentication. The reuse of the same passwords by individuals across multiple sites,
the massive data breaches targeting user credentials, and widespread phishing efforts by hackers to entice users to ‘reveal’
passwords create security risks for every organization.
The Fast Identity Online (“FIDO”)
Alliance was formed in 2012 to address the security risks to enterprises and the problems individual users face in creating and remembering
multiple usernames and passwords. FIDO compliant solutions eliminate passwords by using the combination of biometric verification and
device authentication via cryptographic security, thereby speeding up and securing user login. FIDO Alliance members include global leaders
and household names in technology and across enterprise software, payments, banking, telecom, ecommerce, identity, government, and healthcare
(https://fidoalliance.org/members/). This cross-industry coalition works jointly to develop interoperable authentication standards that
reduce reliance on passwords with authentication that is more secure, private, and easier to use.
In 2022, three
of the world’s largest tech companies – Apple, Microsoft, and Google (Alphabet) – each pledged passwordless initiatives
and lauded FIDO2 standards that enable passkey technology. As members of the FIDO Alliance, we also have been working towards the same
goal. We believe these initiatives enhance prospects for authID’s products, as it indicates the industry is moving to a passwordless
future, in which our unphishable Human Factor Authentication could play an integral part.
FIDO, however,
has some shortcomings, and this is where we see a tremendous opportunity for authID. FIDO authentication is still vulnerable to first
and second-party fraud, and an enterprise still does not know with certainty ‘who is behind that device’. In short –
device authentication by itself simply does not provide an indisputable audit trail of “Who” made a purchase, or “Who”
transferred funds.
Our Verified
platform solves this problem by offering adaptive authentication by combining “Something You Have – your FIDO2 device”
with “Something You Are – your Verified Selfie”. Together device biometrics coupled with cloud biometrics eliminate
passwords, while delivering the highest identity assurance, secured by a seamless user experience.
Identity Verification Impact Across Sectors
Financial services,
ecommerce, the sharing economy, and healthcare businesses are confronted by the challenges of identifying their customers, patients
and benefits recipients with ease and certainty in the digital world. Organizations across all sectors need to control access to
their data and technology systems by their employees. Governments around the world are imposing new data privacy and authentication
regulations, which also impose a “call to action” for many of these businesses and organizations. authID’s
approach is to offer our products to enterprises and organizations for their customers in a Customer Identity & Access
Management (“CIAM”) model as well as for their employees in a workforce model.
4
Financial Services & Fintech
Financial services
institutions are facing a range of digital transformation challenges and a growth in the embrace of non-traditional fin-tech providers,
such as non-bank lending companies, peer-to-peer mobile payment apps and the rapid emergence of cryptocurrencies, NFT’s and other
digital assets exchanges. Key to this effort is providing enhanced digital customer experience while balancing the need for high assurance
identity authentication to prevent fraud and account take-over throughout the customer journey,
Convenience, however, traditionally
opposes stronger identity assurance – the easier it is to open or access an account, the less safeguards there may be to prevent
fraud. Javelin Strategy & Research found that in 2021 identity fraud losses in the US financial services industry exceeded $52 billion.
(Javelin Strategy & Research “2022 Identity Fraud Report” 2022). The study reported that identity fraud losses due to
the use of a consumer’s personal information amounted to $24 billion and impacted 15 million U.S. consumers. Identity fraud scams
that involved direct contact with victims by criminals, to steal passwords and other personally identifiable information totaled $28 billion
and affected 27 million U.S. consumers.
LexisNexis
found that the cost of fraud for U.S. financial services and lending firms has increased, with every $1 of fraud loss now costing U.S.
financial services firms $4, up 25% from 2019. Their study also found that fraudsters followed consumer’s pandemic shift towards
mobile transactions, with more than half of surveyed financial services firms reporting a 10% or greater increase in fraud in the mobile
channel (“LexisNexis® True Cost of FraudTM Study: Financial Services & Lending”, 2021). And with 40% of all
fraudulent activity related to account takeover reported to occur within a day after the attack, the need for strong customer authentication
is critical.
Experts recommend that efforts
to combat this fraud must focus on moving consumers from static passwords to safer authentication methods. According to Gartner, their
clients are increasingly seeking “passwordless” authentication methods such as FIDO2 Strong Authentication to improve user
experience and enhance security by eliminating centrally stored passwords—a key target for cyber criminals (Gartner Research Ibid).
Goode Intelligence believes that mobile biometrics are key to securely effecting this transformation and forecasts that over $5.8 trillion
of mobile biometric payments will be made annually and over three billion biometric payment users by 2026 (Goode Intelligence “Mobile
Biometrics for Financial Services; Market and Technology Analysis, Adoption Strategies and Forecasts 2021-2026”2021).
Healthcare
Since 2020, remote healthcare
services have expanded exponentially - virtual urgent-care visits spiked by 683% between March and April 2020, while virtual, nonurgent
care visits grew by an unprecedented 4,345% (Journal of the American Medical Informatics Association “COVID-19 transforms health
care through telemedicine: Evidence from the field” 2020). ResearchAndMarkets predicts that the global telemedicine market will
increase from $ 91 billion in 2022 to over $380 billion by 2030. (ResearchAndMarkets “Telemedicine Market Research Report 2022 to
2030”. 2022).
Unfortunately, with this shift
to remote care, a record of weak authentication practices such as shared passwords, and a trove of rich personal data, the healthcare
market is believed to be even more susceptible to identity fraud. Further, IBM reported that the healthcare sector continued to be the
highest data breach cost industry for the 12th year in a row, with the average cost of a breach increasing to $10.10 million in 2022,
an increase of 9.4% over 2021(IBM Security “Cost of Data Breach Report 2022” 2022). In
2021, health data breaches impacted more than 40 million people, and over 550 organizations reported such violations to the US Department
of Health and Human Services (Health IT Security 2021).
Medical identity
theft has an annual economic impact of around $41 billion a year and the value of stolen medical information is 10 times the value of
stolen credit cards. Identity thieves can use compromised medical records to acquire medical treatment, receive elective surgery, and
even fill prescriptions using the victim’s personal details. In one study, 20 percent of victims indicated they got the wrong diagnosis
or treatment, or that their care was delayed because there was confusion about what was true in their records due to identity theft. In
addition, because there are currently no regulatory consumer protections in place that limit the financial liabilities for medical identity
fraud, the average out-of-pocket cost to victims is $13,500 (Medical Identity Fraud Alliance).
Privacy Regulations (Ethical AI)
All business,
governmental and other sectors of society are impacted by the need for organizations to comply with increasing data privacy and authentication
regulations. The European Union has led the way with its General Data Protection Regulation, or GDPR, widely considered the gold standard
of data privacy regulation, and other jurisdictions around the world are scrambling to catch up. The United States has been slow and has
only limited regulation at the federal level, which applies only to specific industries such as the Health Insurance Portability and Accountability
Act, or HIPAA. It is therefore falling to the States and local authorities to adopt data privacy requirements such as the California Consumer
Privacy Act or CCP and Illinois’ Biometric Information Privacy Act or BIPA, which are being cloned by other jurisdictions. We believe
that this growing trend will impose an urgency on organizations of all descriptions to improve their data security and privacy processes,
and we believe that biometric identity verification will be a key part of the solution.
5
We are dedicated
to developing advanced methods of protecting consumer privacy and deploying ethical and socially responsible AI. Our products are critical
to onboarding consumers globally into the digital economy, while better securing their assets and privacy.
We believe
that a proactive commitment to ethical AI presents a strong business opportunity for authID and will enable us to bring more accurate
products to market more quickly and with less risk to better serve our global user base. Our methods to achieve ethical AI include engaging
the users of our products with informed consent, prioritizing the security of our user’s personal information, considering and avoiding
potential bias in our algorithms, and monitoring of algorithm performance in our applications.
Our Solutions and Products
We have established
our Verified platform with internally developed software as well as acquired and licensed technology, which provide the following services:
(1) biometric capture and matching (e.g. for faces,); (2) remote document collection and authentication; (3) multi-factor / human factor
authentication and passwordless login; and (4) step-up verification for electronic transactions (e.g. for high value payment transactions).
VerifiedTM Platform Solutions
authID’s
customers can leverage our Verified Platform by using a simple RESTful API integration. In 2022, with the release of our Verified 3.0
platform, we also make certain services available through OpenID Connect (OIDC) Protocols and our CloudConnect integrations to identity
access management (IAM) and financial services technology vendors. The product suite includes a range of developer integration
tools and documentation that help our customers and CloudConnect partners easily configure their identity and transaction authentication
solutions. Our platform is designed to support a wide variety of identity and electronic transactions across a broad range of verticals.
Our technical implementation team assists our customers and systems integrators to configure the API calls to our platform, and biometric
identity authentication services to meet a specific commercial, geographic or market need. We can thereby provide the next level of unphishable
authentication, transaction security, control and identity assurance for everyday transactions. The Company offers the following Verified
platform capabilities:
Using public-key cryptography united
with “one-touch” device-based biometrics and/or security keys, HFA also enables convenient and secure compliance with European
Union-wide PSD2 strong customer authentication requirements. HFA enables consumers to use biometric authentication with any FIDO2 registered
device and HFA can help organizations comply with applicable privacy laws.
6
Other Identity Products
Growth Strategy
To achieve our goals of increasing
our product penetration in the identity authentication market, the following plans comprise our growth strategy. authID intends to expand
our focus on channel partners, by signing payment processors, system integrators and additional software suppliers. The Company also intends
to increase its investment in developing, patenting and acquiring the various elements necessary to enhance our Verified platform, which
are intended to allow us to achieve our growth goals.
Channel Strategy
We intend to
expand upon our channel strategy in order to bring our products to a broad market in an efficient and cost-effective way. We have signed
and are pursuing channel partners that play a key role in their respective verticals. We are also pursuing additional strategic partners,
including payment processors, system integrators and software suppliers.
These channel
partners provide access to their wide-ranging enterprise customer portfolios, including new fintech disruptors, merchant services, ecommerce
and sharing economy businesses, all of whom we believe could benefit from the use of our identity verification and authentication software
products. By entering into agreements with such channel partners and leveraging their relationships, we believe we can expand our footprint
much more rapidly and cost effectively, as compared to pursuing direct sales efforts with each customer. We continue to maintain a small,
high-touch, strategic sales team to identify new use cases and drive expansion and standardization on authID within our partners’
customer portfolios.
Innovation
As banking,
fintech, healthcare providers, traditional and online retailers, continue to drive digital transformation across their channels, we aim
to be at the forefront by developing new software products that leverage our platform and core competencies in biometric identity authentication.
Our focus on innovation, is intended to add value to and retain our existing customers, as well as attract new customers. authID intends
to build on its patented and patent pending solutions by using machine learning to enhance the artificial intelligence capabilities of
our Verified software and platform. Our mission is to make the authID biometric Verified platform the fastest and most accurate in the
market, and then to continually improve our platform to maintain our leading position.
Consumer frustration
with passwords, along with phishing attacks, social engineering and data breaches have driven the need to eliminate passwords and accelerate
adoption of multifactor security across all channels. Today there are more than 5 billion smartphones, laptops and tablets around the
world that can be used as secure authentication devices to access online services and authorize transactions. These trends are driving
the need for a simple, secure, and fast way to manage device registration and deregistration. By combining our patent pending methods
for single message authentication, authorization, and audit, and for device registration through strong identity verification, authID
has created an Identity Recovery (IDR) software product that puts device management in the control of the account owner. By eliminating
the need for users to contact a support center, this product helps our enterprise customers reduce their systems and personnel costs for
supporting users attempting to recover their identity or register a new device for authentication.
7
We are a member of the FIDO
Alliance, the leading international organization comprising global leaders in technology that help establish best practices for FIDO authentication
deployment. FIDO compliant solutions eliminate passwords by using the combination of biometric verification and device authentication
via cryptographic security, thereby speeding up and securing user login. Our Verified FIDO2 passwordless
authentication branded HFA is certified by the FIDO Alliance to be compliant and interoperable with FIDO specifications.
In November
2021, the Company received a US patent for Systems and Methods Using a Primary Account Number to Represent Identity Attributes (the
’777 Patent”). The ’777 Patent is for a method that enables various attributes of the individual, to be securely linked
to a Primary Account Number (PAN) to authenticate the user’s identity. The PAN of a user may then be used for identifying a user,
without any sensitive data being released, as well as used to provide access, such as accessing a bank account, or other payment method
of the user. The PAN has become the most ubiquitous way of processing credit card and other payment transactions, which can be sent over
established communications networks between banks and merchants anywhere in the world. Using this invention, identity authentication transactions
can be authorized via the individual’s biometrics, such as the user’s unique facial features and routed over the same networks
in the same way as payment transactions.
In May 2022,
the Company received a US patent for “A Method and System for Transaction Authorization Based on a Parallel Autonomous Channel
Multi-User and Multi-Factor Authentication” (the “’299 Patent”). The ’299 Patent protects a core component
of authID’s intellectual property relating to its Verified identity verification platform. The patent comprises a method that enables
an account holder to authorize a transaction, and at the same time a third-party identity verifier (such as authID) to validate the identity
of the account holder, for example through a personal code or biometrics, and confirm the account holder’s consent for the transaction.
By orchestrating authentication transactions, authID’s method combines explicit consent for the transaction with identity verification,
and creates a permanent record of both, for all parties, secured with a unique digital signature.
Select Acquisitions
As we have
done in the past, we intend to selectively pursue acquisitions that will help us achieve our strategic goals, enhance our technology capabilities
and accelerate growth. We believe pursuing these types of acquisitions will increase our ability to work with existing customers, add
new customers, enter new markets, develop new services and enhance our processing platform capabilities. However, we have no commitments
with respect to any such acquisitions at this time.
Marketing and Sales
The Company
will primarily target these market segments: 1) fintech and other disrupters of traditional commerce, 2) businesses requiring zero-trust
authentication for their workforce and 3) Fortune 1000 enterprises via channel and OEM partnerships established with some of the largest
identity access management providers (IAM), privileged access management companies (PAM), risk engines, payment providers, and adjacent
software providers. To serve these segments, we have begun to offer turn-key solutions via authID’s Verified CloudConnect program,
supporting industry leading IAM, banking and ecommerce platforms to allow our software to be easily deployed with low-code or even no-code
implementations.
Our branding
and messaging will focus on the fact that all three segments understand the critical requirement to deliver unphishable authentication
without friction. The Company’s marketing will emphasize the high return on investment that any business whether for their workforce
or consumer applications can achieve if they replace password models with passwordless, biometric authentication software. We intend to
draw prospects to authID by our ability to empower them to fight synthetic identities, account takeovers, phishing attacks while achieving
their digital transformation goals. The contracts we seek will be of a recurring nature where we receive an annual fee for every active
user (who logs into an application, changes their account profile, or attempts a high value transaction).
In order to achieve these goals
and thereby drive sales and new revenue, the Company continues to focus on our sales activities, as well as invest in innovative technologies.
Revenue Model
Verified software licenses
The Company
provides its new Verified platform services based on a subscription model, with tiered fees per enrolled user Verified Workforce) or active
user (Verified Consumer), comprising a periodic subscription and where applicable a per transaction for proof transaction and the number
of proof transactions required per year (for example the number of times a consumer is required to present proof of identity).
8
Competition
authID offers
its VerifiedTM Identity Authentication platform allowing the Company to on-board customers who wish to deploy our services and solutions
in order to eliminate passwords and know with biometric certainty the user who is engaging with their systems. authID’s solutions
include the ability to verify the identity of a user, via remote identity verification, then enable device and transaction authentication
using both device and cloud biometrics and, all digitally signed by the user’s identity. The Company’s platform allows our
customers’ users to engage with the Verified platform using commodity, consumer grade mobile or desktop devices via a web-browser
or corresponding Android or iOS smartphone app.
The Company’s
proprietary, patented Verified platform allows our customers to establish trust in identity, authenticate and verify an identity without
a password but with both device and biometric certainty, and not with phishable passwords or one-time pin codes. authID.ai’s Verified
platform has several identity verification and authentication products each facing different competitors and incumbent technologies we
can replace.
For onboarding
users, employees or customers remotely, Verified delivers seamless identity verification with quick, online identity document verification
and facial biometric matching of a selfie to the identity credential photo with iBeta-certified liveness confirmation. Our FIDO2 strong
customer authentication and passwordless login product leverages strong identity verification during device authenticator registration
to create a digital chain of trust between biometrically verified individuals, their accounts, and their devices. Our FIDO2 authentication
service also eliminates the risks and costs of legacy passwords and phishable MFA such as one-time pin codes. Rooted to a trusted identity
obtained during the identity verification and onboarding process, our Verified biometric multi-factor authentication offers high-assurance,
biometric, cloud-based, multi-factor authentication to secure high-risk transactions.
In reviewing
the competitors that exist for the Company’s current and planned platform products relating to the three main elements of identity
management: the establishing of identity, use of identity through device-based biometric authentication, and use of identity through cloud-based
biometric verification, the Company considers a number of factors. authID’s platform utilizes an Identity as a Service (IDaaS) approach
which combines the three elements into a single fast, secure, and fully automated, platform. authID believes that this full stack platform
approach is exceptional in that it offers documentary identity verification, FIDO device authentication, and cloud based, biometric, multi-factor
verification covering digital account access and transaction confirmation use cases for both consumer and workforce applications. The
competitive landscape includes several companies that mainly address only one element, with some addressing multiple elements independently
without a seamless integration between them.
In looking
further at our competition, the Company does not consider providers which are major conglomerates with vertically integrated cybersecurity
companies, due to the vast array of services which they offer. Furthermore, some of the competitors which do offer solutions for digital
use cases, are major legacy providers offering hardware heavy solutions principally for governmental users. These include Idemia, Thales,
and Supercom. This is in contrast to authID’s Identity authentication platform approach which is based on offering app and browser-based
software products which are usable on mobile and desktop computing devices without additional hardware requirements.
To further
breakdown the competitive landscape into companies that provide identity proofing we consider the following competitors: Jumio, Au10Tix,
OnFido, Mitek, Trulioo, ID.me, Veriff, and Acuant. Companies that provide only a single solution may be seeking to combine with authentication
and biometric verification technology providers to expand their ID proofing solutions’ capabilities. authID offers Identity Verification,
which is used once at enrollment, whereas our authentication service is used over and over in a recurring revenue model. In appropriate
cases we may decide to cooperate with these entities and yield the one-time revenue to gain the recurring authentication revenue.
Another aspect
of the competitive landscape is device-based authentication products using the FIDO2 passwordless standard. Companies that are believed
to be competing with authID in this area are: HYPR, Strongkey, Daon, Trusona, Callsign, Duo and Transmit Security.
authID believes
that the added security of combining integrated cloud biometric authentication with device based FIDO2 authentication with integrated
cloud biometric authentication meets the Zero Trust mandates for unphishable authentication that provides both device and identity signals
of a user. Further the simplicity of looking at your phone to “trust your selfie” should compete well against these incumbents,
and offer a more adoptable, ubiquitous, and cost-effective solution without dedicated hardware.
Finally, looking
at the competitive landscape for cloud-based biometric identity authentication applications the companies that are believed to be competing
with authID in this area are Jumio, Aware, Acuant, Au10Tix, and 1Kosmos.
There are new
entrants into each of these markets continually. Each competitor may have a different offering or approach to solve similar problems,
which overlap with those of the Company. Some competitors also include manufacturers who provide systems, or platform solutions to third
party operators and, therefore, do not directly compete with the Company, which operates its own systems.
9
Governmental Regulations
The Company does not need
or require any approval from government authorities or agencies in order to operate its regular business and operations. However, it
is possible that any proposed expansion to the Company’s business and operations in the future would require government
approvals.
Due to the
security applications and biometric technology associated with the Company’s products and platforms, the activities and operations
of the Company are subject to license restrictions and other regulations, such as (without limitation) export controls and other security
regulation by government agencies. Expansion of the Company’s activities in payment processing may in due course require government
licensing in different jurisdictions and may subject it to additional regulation and oversight.