Blog

This is a transcription of our Interview with Rick Song, CEO at Persona.

You can watch the original video interview here or tune in to the podcast episode here

or via iTunes, Spotify and other podcast apps by searching "Risk Management Show"

Boris: Hello ladies and gentlemen and welcome to out interview with Rick Song.

Rick is a CEO and co-founder at Persona which is a identity infrastructure company for real-time verification and protection. 

Noticing a fundamental problem in the identity verification space such as manual verification of identities leaving personally identifiable information at risk of identity theft and fraud, Rick created Persona in 2018 to address the long-standing issue. 

And with the general population increasingly using the internet to manage all aspects of their lives, it’s more important than ever to protect customers from identity theft and fraud especially as one data breach can cost massive financial and reputational damage to a brand. 

Rick, thank you for coming to our interview today.
Rick: Yeah, I'm really excited to be here and tell you a bit more about Persona and what we've been up to.

Boris: Absolutely. With your background, I believe we can have a really thoughtful conversation about identity fraud. Rick, can you tell us a short story about your unique path in the identity management space? We interviewed many companies in this space including Jumio, Trulioo to name a few, why there was a need for your solution?

Rick: Well, I can start off with a little bit about my background. So prior to Persona, I was the engineer at Square for a about half a decade. And during that time there really spent a lot of time focusing on identity verification and all of the challenges around identity. But at Square, I think it was a very, very unique opportunity at that business as well, because for Square, we didn't focus on Identity from a single lens.

We saw from many different purviews, anywhere from a KYC compliance perspective for onboarding merchants for payment processing trust in safety for Caviar, where we are effectively onboarding couriers for food delivery and even fraud prevention as we moved into lending through Square capital.

And I think one core thing that we really found was that there are a lot of one size fits all type of approaches, where people were promising with this database verification, with this form of identity verification that this would be the silver bullet towards solving the Identity challenge.

I think a lot of tools out there, which are really more focused on in the identity space around access management, authentication, log in, especially around digital identities, but what we really found kind of a lack of within the industry, it was around Identity infrastructure for real personal information, about who we are in the physical world.

In particular that would be anything from collecting sensitive personal information, verifying the individual, make sure they are who they say they are, governing that data, orchestrating it to make real time decisions about whether someone should have access to a service or not.

And I think one thing that we really found was that this one size fits all approach, this belief that there's a single way to really verify individuals was an anachronism. It was really falling out of a practice, especially because for every single use case there are just different requirements. This balance of conversion, fraud, the demographic you're trying to target, the type of people that you are trying to authenticate and verify. And only than we're starting to see that even on the individual level.

For example, if you're a recent immigrant who doesn't have an SSN, if you are someone whos Identity has been leaked 10 times, but the verification flow that you should go through to make sure that you both are protected, but at the same time still able to be yourself online, should be different.

So what we're really seeing is one this trend towards tailoring the experience for each use case in every individual kind of a business. And the second is to actually even personalizing that experience for the individual themselves. 

So for Persona, what we really found, our core belief is that they're not a one size fits all, but rather what we offer to companies are our building blocks to enable them to mix and match and build ideal identity experience for their customers that really allows them to tailor it to their own business and personalize it to every individual going through it and enables them to collect a variety of information to make sure their making the best decisions in the fastest way possible.

Boris: So you probably collect a lot of data in your process, how is it compliant with privacy regulations such as the GDPR, TCPA and others?

Rick: Honestly, I think there's been a huge evolution in the regulatory climate and a very positive one. Much of the world now is to realize the importance and the criticality of the data that so many of these organizations are collecting.

And for us, we also believe that the challenge around managing this data is more complex than ever. As you mentioned before GDPR has incredibly strict and onerous kind of requirements for how business has to manage this data.

So one unique aspect of our Persona is that the not only are we helping businesses verify individuals, we're also helping them stay compliant. Many of our customers actually trust us as their central repository for all of the personal information collected and leverage our platform to make decisions.

So that way all of the personal information never really touches their infrastructure whatsoever. The ability to do that means is that we have a huge amount of emphasis on making sure that we are storing the data in a proper privacy centric and compliant way for all of our customers. We make sure that we enable them to set up retention policies, to wipe this data whenever they need it. And also even to comply with a variety of regulations, for example, the Illinois biometric law to the numerous retention requirements for so many different states and countries.

Boris: Rick, I would like to hear your personal opinion, what is the commonly held belief in the Identity verification field or the biggest misconception that you strongly disagree with.

Rick: The biggest misconception is that this all in one slash one size fits all approach is the right way to really tackle this problem. And what I mean by this is I think more and more today, we are seeing folks kind of layer on many, many different forms of identity verification and all which I think are powerful in their own rights, but really stifling for the end user, oftentimes causing additional friction or leading to additional drop off or just too much noise to actually make the right assessment. And what we're really lacking is this idea of almost personalization for the individual really take into account who the individual is and adapting the entire experience around the individual themselves.

So I think, rather than these like kitchen sink based all in one type of approaches, we believe that the future of identity verification will actually be much more personal

So depending if your data has been breached versus if your recent immigrants, the entire experience adapts to you, to make sure that you can have a tailored experience that makes the most sense for the exact flow you're trying to go through your business use case and your individual own risk preferences and the tolerances that you may have.

And I really think that will be the future of Identity, there's no longer going to be the silver bullet type of approaches. Today we oftentimes see documents, IDs, selfies, biometrics as kind of a new form of identity verification, but with how quickly technology is evolving, things like DeepFakes or otherwise.

What we believe that this basically will continue to evolve and adapt and what more businesses need than ever before is kind of the entire platform of building blocks that enables them to constantly stay up to date and seamlessly be able to adapt as Identity ecosystem and landscape evolves.

Boris: So for example, if we take a life of a risk manager, if there is one thing that they should start doing right now that they are not doing, what would that be?

Risk: I think more so than ever, they need to start accounting for essentially Dynamic Risk, enabling every individual to have that tailored experience depending on what they're seeing through the flow.

I think today, what we're seeing a lot of is every single individual go through the exact same experience and in the final step businesses make a final decision.

But we're actually seeing a lot of these innovative companies really taking the approach where depending on every single action the individual takes, putting them through different experiences to both maximize conversion and minimize fraud.

And for us, I think that that's really the number one thing that we believe that risk managers really need to start thinking about not only the final decision, but rather tailoring the experience throughout the entire flow to the individual.

Boris: And if we formulate this question another way around, what should they stop doing right now that they are doing currently from your point of view?

Rick: I think it's fundamentally treating everybody customers the same, putting every one of them through the exact same experience since the idea of one size fits all really will not be the future.

How I oftentimes like to more humanize this problem would be, when you sign up for a new online service today, whether I am a Brad Pitt or George Clooney, versus if I’m Risk Song, just a relatively unknown individual. I'm going through the exact same experience as them.

And that's insane given that I'm relatively unknown, little of my personal information is out there. You really can't construct a deep fake of me, at least yet with the available information out there.

Whereas for someone like Brad Pitt so much is out there, so much about them and there is real risk and the simplicity of actually taking over of such an identity. It's really critical that that flow takes time to account and make sure that like for someone with a lower risk is high risk identies are both protected while at the same time we're going through the most seamless experience possible

Boris: You are definitely a young startup and I wonder how do you find your clients? What is your main process? Is it outbound, inbound, the word of mouth or else?

Rick: I mean, I think in the earliest day is of course it's outbound, right? Like no one has ever heard of us in our first couple of customers, but what's been really exciting for us as a business, these days is almost all inbound. Word of mouth has been a huge thing, as well as referrals. We're incredibly grateful for the partners that we work with and the amazing feedback they've given us. And I think oftentimes one of the things that many of our customers consistently highlight about us as a business is that we offer it more as a partner than a vendor. We deeply understand the kind of challenges that they're going through, understand their business. Don't treat them as if, you know, again, they're this one size fits all business because we also don't believe Identity to be one size fits all, and really treat them as if understanding exactly what the requirements around there business to build and taylor our platform to their business.

So I think that's caused a tremendous spike of an inbound volume for us, which has been really exciting to be quite honest with you, we're trying our best to keep up with customer demand.

Boris: So maybe without dropping the names, it will be interesting to know what you or your team have recently achieved that you are really proud of.

Rick: The things I'm most proud of is actually how diverse the use cases and the types of businesses that we work with from Outdoorsy to Postmates, from Rippling to HipCamp, we work with so many businesses in so many kind of different verticals and all of whom who face really, unique challenges. And each one of them really battle test our system to make sure that not only are we solving their problem, but solving the best possible way to build a system that's so dynamic and making sure that all of the building blocks they are, can really work together in a seamless way that can be adapted to the business experience and still also tailored to the individual.

I think that's really challenging. And frankly, for us, we're really proud of the platform that we've built.

Boris: I'm running Global Risk Community a social platform for risk managers, and I always see that people sign up using funny names and probably I can see that they are not the ones that they pretend to be. So can you explain why every business needs and Identity verification services, especially now after we are emerge after the COVID era, can evry every business afford this servers, for example we as a small business almost have to deal with almost 50 new accounts everyday.

Can we afford such solution like yours?

Rick: I would say there's a couple of things. First of all COVID has absolutely accelerated the number of transactions moving online and just pushed the digital economic or the digital economy forward and the digital transformation forward in a very, very rapid pace.

And I think as part of this digital transformation, we're seeing, you know, more offline transactions move online. And with that, the notion of like who you are offline maters more so than ever before who you are behind the screen. I think historically we've oftentimes thought about Identity as purely kind of a authentication mechanism, making sure that, you know, you can kind of have access to a service, but today, you know, if you're placing a stock trade, versus if you're signing up to be a courier, if you are finding your next home to visiting, or even like take getting an online degree for all of these different use cases, these aren't ones where it's about, Oh, I'm like this digital identity.

It's more so than ever about who am I behind the screen? Am I this individual? And I think for all of these business's identity is going to be incredibly important.

I mean, for us, we have definitely seen this transfer of information happen firsthand, given the importance and the prevalence of need to know who people are behind the screen. One thing that I think really also distinguishes Persona is our emphasis on automation. And I think we think about automation, both from the perspective of its more privacy centric.

If you are on Persona, there's not some human in a foreign country, looking at your Identity, analyzing and trying to make this manual decision of, are you who you say you are instead, everything's is passing through the machine.

We put a lot of emphasis on making sure that this decisioning process is both seamless, but also not bias to make sure that anyone has access through the entire experience. The second piece is also by embracing automation, we can enable more businesses than before to get out, to gain access to these amazing services. So, for smaller businesses, ones who can't afford to build an entire team to actually verify identities, our automated system enables them to get access at a far lower price.

And, you know, one thing I think that's really exciting about us and in particular for us who is trying to really forward this digital transformation of Identity online, we are actually the first solution out there with a fully free solution for 500, three Identity verifications for any business out there. So if you're doing less than 500 a month, you can sign up for us and yeah, but you can actually get started immediately. And for many start-ups, this is a huge kind of a boon for them given that now they can really start embracing and making sure that the individuals on our platform are authentic with as minimal amounts of effort.

So yeah, for your business, absolutely. I mean, consider signing up. It's pretty

Boris: Fantastic. So let's find finalize, if someone who is listening to this interview, you would like to walk away with one or two takeaways, what that would be from your point of view.

Rick: Well, I think that one Persona is the first platform that really adapts to your business, not the other way around and enables you to treat every customer in a personal and individual as if they are individuals in a personalized sense.

Whereas today I think most of the ecosystems much more about, Hey, here's this process and this is a one size fits all. We have a lot of different random features, but we're going to put everyone through the same thing. In Persona, it's the first time it really enables businesses to tailor it to their business.

And the second is we are the most friendly for any new business out there.

If you're a startup and you want to get started without having to incur a huge financial costs, Persona is free 500 for the verifications every single month. If you have less than 500 of users signing up, get started right now and you'll have access to some of the most advanced time verification techniques that businesses like Brex like Square, like Postmates are using today to verify couriers, verify lenders and verify you start ups as well.

Boris: What are the major trends in identity verification space and what we'll we expect from you guys in the future?

Rick: Honestly, I think one of the biggest trends is the complex interplay between a lot of these new regulations, like GDPR CCPA, like a lot more of these privacy regulations and how to continue to preserve privacy while at the same time, making sure individuals are who they say they are.

I think that that trend is going to be increasingly important because a lot of forms of ID verification can be privacy evasive. So how do you ensure you embrace automation to make sure that every individual's personal information is protected and secure?

So for us, I think that's going to be a really critical trend as for us, we don't just help businesses verify individuals.

We also help them govern this information and use it in a responsible way. And I think that for a lot of the identity verification to be space we're really going to see these to kind of collide. And I think done right, it can be a huge benefit for businesses to manage both the verification and the governance of personal information.

And I think the second thing that we are really seeing as the overall trend for identity verification as a whole is the rise of AI, especially around like anywhere from DeepFakes to a more complex fraud means that there's not going to be kind of a silver bullet any more, like biometrics document verification is just no longer going be sufficient.

What we believe actually is going to the future is kind of very multi-factor, multifaceted approach towards how to actually allow an individual be who they say they are. And this would be a combination of both active techniques. Many of these active techniques could be things like verifying a phone number, verifying information against public available records, checking a document or a biometric.

And combining that with a lot of past behavioral signals like is this person behaving in a risky manner or are they coming from a risky network, has this device been flagged before and enabling businesses to not just think about Identity from a single perspective, but rather 360 degree view of who is this individual and what are the risks that we're taking them on.

So I think this is going to be really one of the more exciting trends for us of this evolution from silver bullet based approach from the evolution of SSN, documents, everything else to really kind of like a very holistic type of identity and making sure that individuals are who they say are from as many different perspectives as possible.

Boris: That where all my questions, maybe if I forgot something that you have something to add?

Rick: Nothing off the top of my mind, but I thank you so much for taking the time to speak with us. It's been a really exciting journey for us, and I'm very grateful for the opportunity to share it with you.

Boris: Thank you. I wish your company high growth and hope to hear from you guys in the future.