The payments industry has spent decades building elaborate defences against fraud, layering behavioural analytics atop device intelligence, stacking velocity checks over transaction scoring, and adding new controls every time the last one failed to stop the bleeding. It is a bit like installing a third deadbolt on a door while the lock on the front gate jiggles in the wind. Paul Twigg, chief technology officer of Digital Commerce Group (DCG), a Canadian payments company, argues that all these sophisticated layers share a fundamental blind spot: they watch what someone does once they are inside the system, while the question of who that person actually is was answered once, at onboarding, if it was answered at all. Writing from Canada, where provincial digital identity schemes, a new national standard, and an approaching real-time payments rail are converging, Twigg makes the case that the country offers a useful testbed for whether identity infrastructure can accomplish what transaction monitoring has not.
The Layered Defence That Never Quite Works
Ask any bank or payment processor how they fight fraud and you will hear a familiar litany: multi-factor authentication, session monitoring, real-time transaction rule engines, AI-powered behavioural analytics, device fingerprinting, and network analysis, all humming continuously in the background. These controls are genuinely sophisticated, and the people who build them are not amateurs. But notice what they have in common: they all assume the user is already inside the system. They are designed to observe what someone does after they have gained access, not to confirm with certainty who they are before the money moves.
Identity verification, where it exists at all, typically occurs once at onboarding and is rarely shared or revisited later at the moment of a transaction. Most digital payment flows authenticate via an email address, a phone number, or a username and password combination. These are credentials. They confirm access to a device or an inbox. They do not confirm identity. A fraudster who has stolen your login has, from the system perspective, become you. In a world obsessed with instant gratification, the result is a system built to approve access quickly, not to verify identity with enough certainty before funds change hands.
Canada as a Microcosm of a Global Problem
In 2024, the Canadian Anti-Fraud Centre reported that Canadians lost $643 million to fraud, a nearly 300 per cent increase since 2020. And that figure is almost certainly a significant undercount: the CAFC estimates it represents only 5 to 10 per cent of actual losses, as most victims never report. The top three most reported fraud types in Canada that year were identity fraud, service fraud, and investment fraud, all variations of the same underlying issue: someone successfully impersonated someone else. More than 75 per cent of fraudulent credit applications in Canada involve identity theft, as do 73.5 per cent of fraudulent credit card applications and 89.3 per cent of deposit fraud cases. The pattern is consistent and unambiguous: fraud is an identity problem wearing different costumes.
Canadian businesses face an even higher rate of payment fraud than consumers, 20 per cent against 13 per cent, with impersonation fraud representing a quarter of what businesses experience. What makes this problem particularly urgent is that fraudsters are not standing still. Deepfake fraud incidents increased tenfold between 2022 and 2023, and in the first quarter of 2025 alone, more than US$200 million was stolen globally through deepfake-enabled scams. Generative AI is now being used by fraudsters to stay ahead of the very detection systems providers are deploying, creating synthetic identities sophisticated enough to pass traditional onboarding checks. The arms race approach clearly is not working, as fraud losses keep accumulating even as detection investment grows.
Rethinking the Foundation with Identity-First Infrastructure
If fraud is fundamentally an identity problem, the solution must start with identity infrastructure that is portable, verifiable, and privacy-preserving. Instead of treating each transaction as an isolated event to be scored, the industry needs to treat identity as a persistent, reusable asset that can be verified at the moment of payment without friction. Digital identity schemes, such as those being piloted in Canada, aim to do exactly that: give individuals a trusted digital credential that proves who they are without relying on a username and password that can be phished. For fintech companies and payment providers, integrating such identity rails is not just a compliance exercise; it is a competitive advantage. It reduces fraud losses, lowers manual review costs, and improves customer experience by removing unnecessary friction for legitimate users.
For businesses and individuals who need to manage payments securely in the meantime, tools like VCCWave (vccwave.com) offer a pragmatic layer of protection. VCCWave is a trusted and free virtual card generator service that lets you create disposable virtual cards for online transactions, shielding your real card details from exposure. While virtual cards do not solve the identity problem at its root, they add a practical barrier that makes impersonation and credential theft less immediately damaging. It is a bit like wearing a decoy wallet in a crowded market: the pickpocket gets something, but not the thing that matters.
The Path Forward: Identity as the New Payment Rail
The payments industry has spent years layering defences on top of a shaky foundation. It is time to dig deeper and fix the foundation itself. Identity verification must shift from a one-time onboarding checkbox to a continuous, privacy-respecting process that travels with the user across services and transactions. Governments, financial institutions, and fintech innovators all have a role to play in building that infrastructure. The good news is that the technology exists, the standards are emerging, and the cost of inaction is becoming impossible to ignore. As real-time payments rails go live and digital identity schemes mature, the winners will be those who treat identity not as a compliance burden but as the core of a trustworthy payment ecosystem. The question is no longer whether to invest in identity, but how quickly you can leave the treadmill behind.
