This glossary explains key terminology used across Financial Services, focusing on the data, regulation, identity verification, credit reporting, fraud prevention, and model-governance concepts central to the Credit Bureaus & Identity/Fraud Services Practice. It helps executives and practitioners interpret industry controls, standards, services, and performance measures.
0–9 A B C D E F G H I J K L M N O P Q R S T U V W X Z
| 0–9 | |
| 2FA | Two-Factor Authentication: An authentication method requiring evidence from two different factor categories, such as a password and a registered device. It reduces the likelihood that stolen credentials alone will enable account takeover. |
| A | |
| AAL | Authenticator Assurance Level: A NIST classification describing the strength of an authentication process and the confidence that a claimant controls the authenticators bound to an account. Higher levels require stronger controls against credential theft and impersonation. |
| AAMVA | American Association of Motor Vehicle Administrators: A North American association that develops standards and operates networks supporting driver’s-license and identification-card data exchange and verification. Its specifications are important to document authentication and identity proofing. |
| AAN | Adverse Action Notice: A notice explaining a credit denial or other unfavorable decision and identifying relevant consumer-reporting information. Accurate notices are important for regulatory compliance, explainability, and consumers’ ability to correct disputed data. |
| ABIS | Automated Biometric Identification System: A system that searches biometric samples, potentially across multiple modalities, against enrolled records to establish or investigate identity. It is used where one-to-many identification is required rather than simple one-to-one verification. |
| ACAMS | Association of Certified Anti-Money Laundering Specialists: A professional association providing education and credentials for financial-crime compliance practitioners. Its frameworks and training are frequently encountered by identity, customer-screening, and fraud-service teams. |
| ACDV | Automated Consumer Dispute Verification: The standardized electronic form and workflow used to send consumer credit-report disputes to data furnishers for investigation. Timely and accurate responses are central to dispute resolution and credit-file integrity. |
| ACFE | Association of Certified Fraud Examiners: A professional organization for fraud investigation, prevention, and examination. Its methods and credentialing are relevant to teams designing fraud controls or investigating identity-related losses. |
| AdES | Advanced Electronic Signature: An electronic signature meeting eIDAS requirements for uniquely linking the signature to the signer, identifying the signer, and detecting later changes. It provides stronger identity and integrity evidence than a basic electronic signature. |
| AFIS | Automated Fingerprint Identification System: A biometric system that compares fingerprints against stored records for identification or verification. It supports high-volume matching in government identity, criminal-history, and identity-proofing environments. |
| AML | Anti-Money Laundering: The laws, controls, and analytical processes used to prevent financial systems from being used to conceal illicit proceeds. Identity verification, beneficial-ownership checks, screening, and fraud intelligence often support these controls. |
| AMLD | Anti-Money Laundering Directive: A European Union legislative instrument establishing requirements for customer due diligence, beneficial-ownership transparency, suspicious-activity controls, and related safeguards. Numbered directives and successor regulations shape identity and screening services offered in Europe. |
| AOF | Account Opening Fraud: Fraud committed during the creation of a financial account using fabricated, manipulated, or stolen identity information. Detection typically combines identity evidence, bureau data, device intelligence, and behavioral signals. |
| APCER | Attack Presentation Classification Error Rate: A biometric presentation-attack metric measuring the proportion of attack presentations incorrectly classified as genuine. It helps evaluate whether liveness and spoof-detection controls stop masks, photographs, replays, or other artifacts. |
| ATO | Account Takeover: Unauthorized control of an existing account through stolen credentials, social engineering, device compromise, or manipulated recovery processes. Prevention depends on authentication, anomaly detection, identity intelligence, and effective step-up controls. |
| AUC | Area Under the Curve: A summary measure of a model’s ability to separate positive and negative outcomes across decision thresholds, usually referring to the receiver operating characteristic curve. It is widely used to compare credit-risk and fraud models. |
| AUD | Automated Universal Dataform: An electronic form used by credit-data furnishers to add, change, or delete information in consumer files outside regular reporting cycles. It supports corrections arising from disputes, portfolio changes, and data-quality remediation. |
| AUROC | Area Under the Receiver Operating Characteristic Curve: A model-performance statistic showing how well a score ranks positive cases above negative cases across all thresholds. It is commonly monitored during fraud-model validation and credit-score development. |
| AVS | Address Verification Service: A control that compares a submitted address with an address held by an authoritative or account-related data source. Results can support identity proofing and flag inconsistencies associated with application or transaction fraud. |
| B | |
| BAC | Basic Access Control: A protocol used to establish an encrypted session with an electronic passport chip after reading access data from the document. It helps prevent unauthorized skimming of chip contents during document verification. |
| BIPA | Biometric Information Privacy Act: An Illinois law governing the collection, retention, disclosure, and destruction of biometric identifiers and information. It materially affects consent, vendor management, data handling, and litigation risk for biometric identity services. |
| BOI | Beneficial Ownership Information: Information identifying the individuals who ultimately own or control a legal entity. It is used in business verification, customer due diligence, sanctions screening, and efforts to identify shell companies. |
| BPCER | Bona Fide Presentation Classification Error Rate: A biometric testing metric measuring the proportion of genuine presentations incorrectly classified as attacks. High values can create customer friction and reduce completion rates even when spoof detection is effective. |
| BSA | Bank Secrecy Act: The principal U.S. statutory framework requiring financial institutions to maintain records and controls that help detect and report money laundering and other financial crime. Identity and verification services support several associated customer-identification obligations. |
| C | |
| CAMS | Certified Anti-Money Laundering Specialist: A professional credential covering financial-crime risks, customer due diligence, investigations, and compliance programs. It is commonly held by specialists overseeing identity, screening, and transaction-risk controls. |
| CASS | Coding Accuracy Support System: A U.S. Postal Service certification program for software that standardizes and validates address information. Certified address processing improves match rates, delivery quality, identity resolution, and fraud screening. |
| CBSV | Consent Based Social Security Number Verification: A U.S. Social Security Administration service that, with the individual’s consent, verifies whether a submitted name and Social Security number match agency records. It provides an authoritative identity signal but does not establish that the applicant controls the identity. |
| CCPA | California Consumer Privacy Act: A California privacy law granting consumers rights over personal information and imposing disclosure, access, deletion, and data-use obligations on covered businesses. It affects identity-data sourcing, consumer requests, and service-provider contracts. |
| CDD | Customer Due Diligence: The process of identifying customers, understanding their ownership and risk profile, and applying appropriate ongoing monitoring. Reliable personal and business identity data is foundational to effective due diligence. |
| CDIA | Consumer Data Industry Association: A U.S. trade association representing consumer-reporting agencies and related data companies. It maintains important industry resources for credit-data furnishing, dispute handling, compliance, and data quality. |
| CFCS | Certified Financial Crime Specialist: A professional credential addressing fraud, money laundering, sanctions, cyber-enabled crime, corruption, and investigations. It is relevant to practitioners working across converged identity and financial-crime functions. |
| CFE | Certified Fraud Examiner: A professional credential covering fraud prevention, investigation, financial transactions, and legal issues. It signals specialized competence for fraud-management and investigative roles. |
| CFPB | Consumer Financial Protection Bureau: The U.S. federal agency responsible for enforcing consumer financial law and supervising major consumer-reporting companies. Its examinations, rules, enforcement actions, and complaint data materially influence bureau operations. |
| CFT | Countering the Financing of Terrorism: Controls intended to prevent funds and financial services from supporting terrorist organizations or activities. Customer identification, sanctions screening, entity resolution, and network analysis contribute to these controls. |
| CIC | Credit Information Company: A regulated organization that collects, processes, and distributes credit information, particularly in jurisdictions using this statutory term for private credit bureaus. Licensing, permissible-purpose, security, and dispute obligations typically apply. |
| CIP | Customer Identification Program: A U.S. regulatory requirement for covered financial institutions to obtain and verify specified identifying information when opening accounts. External identity services often supply documentary and non-documentary verification evidence. |
| CIPP | Certified Information Privacy Professional: A professional credential covering privacy law, governance, and data-protection practices, with jurisdiction-specific concentrations. It is relevant where consumer reporting and identity products process sensitive personal data at scale. |
| COPPA | Children’s Online Privacy Protection Act: A U.S. law governing online collection of personal information from children under 13. Age-assurance and identity services supporting child-directed products must account for parental consent and data-minimization requirements. |
| CPRA | California Privacy Rights Act: A California law that amended and expanded the state’s consumer privacy framework, including protections for sensitive personal information and additional regulatory oversight. It affects profiling, data sharing, retention, and consumer-rights operations. |
| CRA | Consumer Reporting Agency: The U.S. legal term for an entity that assembles or evaluates consumer information to provide consumer reports to third parties. Such entities are subject to accuracy, permissible-purpose, disclosure, dispute, and security obligations. |
| CRA | Credit Reference Agency: The term commonly used in the United Kingdom and other markets for an organization that collects and supplies credit and identity information. These agencies support lending decisions, affordability checks, identity verification, and fraud prevention. |
| CRB | Credit Reference Bureau: A private organization that compiles borrower credit histories and provides reports or scores to authorized users, particularly in African and Asian markets. Bureau coverage and data quality materially affect financial inclusion and underwriting. |
| CRRG | Credit Reporting Resource Guide: The principal U.S. industry guide for reporting consumer credit information using the Metro 2 format. It defines field usage and account-status conventions that support consistent bureau data. |
| CSCA | Country Signing Certification Authority: The national trust anchor that certifies document signers for electronic passports and related travel documents. Its certificates enable verification that chip data was signed by an authorized issuing state. |
| CSI | Characteristic Stability Index: A measure of how the distribution of an individual model variable changes between populations or periods. It helps identify feature drift that could weaken credit or fraud-model performance. |
| CSP | Credential Service Provider: An entity that establishes a subscriber’s identity and binds authenticators or credentials to that identity under the NIST digital-identity model. Its controls determine the reliability of downstream authentication assertions. |
| CTA | Corporate Transparency Act: A U.S. law establishing beneficial-ownership reporting requirements for many legal entities, subject to statutory exemptions and implementing rules. Its data and requirements are relevant to business-identity and ownership verification. |
| CTAP | Client to Authenticator Protocol: A FIDO protocol enabling browsers and operating systems to communicate with external or platform authenticators. It supports phishing-resistant authentication using security keys, devices, and passkeys. |
| D | |
| D-U-N-S | Data Universal Numbering System: Dun & Bradstreet’s proprietary nine-digit identifier for business entities and locations. It is used in commercial identity resolution, supplier verification, credit files, and entity-data matching. |
| DET | Detection Error Tradeoff: A curve comparing false rejection and false acceptance rates across decision thresholds. It is commonly used to assess biometric and fraud-detection systems where security and customer friction must be balanced. |
| DIACC | Digital ID and Authentication Council of Canada: A nonprofit coalition developing trust frameworks and interoperability guidance for Canadian digital identity. Its Pan-Canadian framework informs identity assurance, privacy, and ecosystem governance. |
| DID | Decentralized Identifier: A standards-based identifier designed to be created and controlled independently of a centralized identity registry. It can support privacy-preserving digital credentials and verifiable relationships between holders, issuers, and verifiers. |
| DMF | Death Master File: A U.S. Social Security Administration dataset containing reported deaths associated with Social Security numbers. Authorized users employ it to suppress deceased records and detect identity misuse, although coverage is not complete. |
| DOB | Date of Birth: A core personal identifier used in record matching, knowledge-based checks, credit files, and identity proofing. Because it is widely exposed and not secret, it should not be treated as strong authentication evidence by itself. |
| DOFD | Date of First Delinquency: The date on which an account first became delinquent and was never subsequently brought current before charge-off or collection. It is critical for calculating how long adverse information may remain on a U.S. consumer report. |
| DOLA | Date of Last Activity: A credit-file field indicating the latest qualifying activity recorded on an account. Its interpretation requires care because it is not interchangeable with the date governing the reporting period for delinquent information. |
| DPA | Data Protection Act: A statutory framework governing personal-data processing, with the term most often referring to national laws such as the United Kingdom’s Data Protection Act 2018. It shapes lawful processing, individual rights, security, and regulatory accountability. |
| DPF | Data Privacy Framework: A cross-border privacy mechanism under which eligible U.S. organizations can certify adherence to principles supporting transfers from participating jurisdictions. Identity and bureau-data providers must align certified processing with applicable notice, choice, security, and recourse obligations. |
| DPIA | Data Protection Impact Assessment: A structured assessment of privacy risks arising from high-risk personal-data processing. It is particularly relevant to biometrics, large-scale profiling, identity matching, and automated decision systems. |
| DPPA | Driver’s Privacy Protection Act: A U.S. federal law restricting disclosure and use of personal information held by state motor-vehicle departments. Identity services using motor-vehicle records must establish a lawful permitted purpose and appropriate controls. |
| DPV | Delivery Point Validation: A U.S. Postal Service process that confirms whether an address corresponds to a recognized mail-delivery point. It improves address quality and helps distinguish typographical errors from potentially fabricated identity data. |
| DSAR | Data Subject Access Request: A request by an individual to access personal data and related processing information under applicable privacy law. Large data providers require controlled search, identity verification, redaction, and fulfillment processes to handle these requests. |
| DTC | Digital Travel Credential: An ICAO concept for digitally representing passport data so that identity and travel checks can be performed securely before or during a journey. It relies on authoritative issuance and cryptographic verification. |
| E | |
| EAC | Extended Access Control: A security mechanism for electronic travel documents that provides stronger terminal authentication and protects access to sensitive biometrics. It supplements basic chip-access controls in participating jurisdictions. |
| eCBSV | Electronic Consent Based Social Security Number Verification: An electronic U.S. Social Security Administration service allowing permitted entities to verify whether a name, date of birth, and Social Security number match agency records with the individual’s consent. It supplies an authoritative input to identity proofing and synthetic-identity controls. |
| ECOA | Equal Credit Opportunity Act: A U.S. law prohibiting discrimination in credit transactions on specified protected bases. Credit-data and model providers must support fair, explainable decisions and accurate reasons for adverse action. |
| EDD | Enhanced Due Diligence: Additional investigation and monitoring applied to customers, owners, or transactions presenting elevated financial-crime risk. It may involve deeper identity checks, source-of-funds evidence, ownership research, and adverse-media review. |
| EER | Equal Error Rate: The operating point at which false acceptance and false rejection rates are equal. It provides a compact benchmark for comparing biometric systems, although production thresholds normally reflect business-specific loss and friction tolerances. |
| eID | Electronic Identification: A digital means of establishing or asserting the identity of a person or organization. It can be government-issued, private-sector-issued, federated, or credential-based and may support remote onboarding and authentication. |
| eIDAS | Electronic Identification, Authentication and Trust Services: The European Union framework for electronic identification and regulated trust services, including signatures, seals, timestamps, and certificates. It establishes assurance and recognition requirements for cross-border digital transactions. |
| EIDV | Electronic Identity Verification: Remote verification of identity data against digital records, authoritative sources, documents, biometrics, or devices. It enables scalable onboarding while requiring controls for consent, matching accuracy, and impersonation risk. |
| EIN | Employer Identification Number: A U.S. federal tax identifier assigned to businesses and other entities. It is an important input to business-identity resolution but should be corroborated because possession alone does not prove ownership or authority. |
| eKYC | Electronic Know Your Customer: A digital process for identifying and verifying customers without relying entirely on in-person review. It combines data, documents, biometrics, screening, and orchestration to automate onboarding and risk decisions. |
| e-OSCAR | Online Solution for Complete and Accurate Reporting: The U.S. web-based system through which consumer-reporting agencies and data furnishers exchange disputes and off-cycle data corrections. It is a core component of consumer credit-dispute operations. |
| E-SIGN | Electronic Signatures in Global and National Commerce Act: A U.S. federal law supporting the legal validity of electronic records and signatures when statutory conditions are met. Reliable identity, consent, attribution, and record-retention controls underpin compliant electronic transactions. |
| ETSI | European Telecommunications Standards Institute: A standards organization that publishes technical requirements for electronic signatures, seals, certificates, and trust-service providers. Its specifications are central to implementing regulated European trust services. |
| EWS | Early Warning Services: A U.S. consumer-reporting and risk-services company specializing in deposit-account information, identity verification, and fraud prevention. Financial institutions use its shared intelligence during account opening and ongoing risk management. |
| F | |
| FACTA | Fair and Accurate Credit Transactions Act of 2003: A U.S. law amending the Fair Credit Reporting Act to strengthen identity-theft protections, consumer access, fraud alerts, data disposal, and credit-report accuracy. It underpins several operational obligations for consumer-reporting agencies. |
| FAL | Federation Assurance Level: A NIST classification describing protections applied to assertions passed between an identity provider and a relying party. It addresses risks such as assertion injection, disclosure, replay, and unauthorized presentation. |
| FAR | False Acceptance Rate: The proportion of unauthorized or nonmatching attempts incorrectly accepted by an authentication or biometric system. It is a core security metric when setting matching thresholds and evaluating impersonation risk. |
| FATF | Financial Action Task Force: An intergovernmental body that develops global standards for combating money laundering, terrorist financing, and proliferation financing. Its recommendations influence customer identification, beneficial-ownership, digital-identity, and risk-based control requirements worldwide. |
| FCA | Financial Conduct Authority: The United Kingdom regulator responsible for conduct oversight of financial markets and regulated firms, including authorization of credit reference agencies. Its rules and guidance affect data access, consumer treatment, and financial-crime controls. |
| FCRA | Fair Credit Reporting Act: The principal U.S. law governing consumer reports and consumer-reporting agencies. It establishes permissible purposes, accuracy duties, disclosure rights, dispute processes, adverse-action requirements, and obligations for data furnishers and report users. |
| FFIEC | Federal Financial Institutions Examination Council: A U.S. interagency body that promotes consistent supervisory standards for financial institutions. Its authentication, cybersecurity, outsourcing, and customer-risk guidance influences identity and fraud controls used by regulated clients. |
| FICO | Fair Isaac Corporation: The company whose branded credit scores are widely distributed with consumer bureau data and used in lending decisions. Different score versions, bureau inputs, and industry models can produce different results for the same consumer. |
| FIDO | Fast IDentity Online: An industry initiative and standards family for passwordless and phishing-resistant authentication using public-key cryptography. It reduces reliance on shared secrets and limits exposure of reusable credentials. |
| FIDO2 | Fast IDentity Online 2: A set of authentication standards combining Web Authentication with the client-to-authenticator protocol. It enables security keys, device-bound credentials, and passkeys to authenticate users without transmitting reusable passwords. |
| FinCEN | Financial Crimes Enforcement Network: A bureau of the U.S. Department of the Treasury that administers and enforces major anti-money-laundering requirements. Its rules affect customer identification, beneficial-ownership information, suspicious-activity reporting, and information sharing. |
| FIU | Financial Intelligence Unit: A national authority that receives, analyzes, and disseminates financial intelligence concerning suspected money laundering and related crime. Identity resolution and accurate entity data help link reports, accounts, and counterparties. |
| FMR | False Match Rate: The proportion of biometric comparisons between different individuals that incorrectly produce a match. It is distinct from the false acceptance rate, which measures errors at the overall transaction or decision level. |
| FNMR | False Non-Match Rate: The proportion of biometric comparisons involving the same individual that incorrectly produce a non-match. It is an important measure of user friction and demographic performance differences. |
| FNR | False Negative Rate: The proportion of genuinely positive cases, such as confirmed fraud, that a model fails to identify. Excessive values increase undetected losses even if customer-friction metrics appear favorable. |
| FPD | First Payment Default: Failure to make the first scheduled payment on a newly opened credit account. It is often treated as an early fraud or severe credit-risk signal and used to evaluate application-screening performance. |
| FPF | First-Party Fraud: Deliberate misrepresentation or abuse by the person who opens or controls an account, rather than by an external identity thief. Examples include misstated application information, bust-out behavior, and intentional nonpayment. |
| FPR | False Positive Rate: The proportion of legitimate cases incorrectly classified as suspicious or fraudulent. It directly affects manual-review volumes, customer abandonment, operating cost, and adverse customer outcomes. |
| FRAML | Fraud and Anti-Money Laundering: An integrated approach that combines traditionally separate fraud and money-laundering data, analytics, and workflows. Shared identity intelligence can reveal patterns that isolated monitoring systems miss. |
| FRM | Fraud Risk Management: The governance, prevention, detection, investigation, measurement, and remediation processes used to control fraud exposure. Effective programs balance loss reduction, regulatory obligations, operational cost, and customer experience. |
| FRR | False Rejection Rate: The proportion of legitimate authentication or identity-verification attempts incorrectly rejected. It is a key measure of customer friction and should be analyzed alongside fraud losses and false acceptance. |
| FRTE | Face Recognition Technology Evaluation: A NIST evaluation program that measures face-recognition algorithm performance across verification, identification, image-quality, demographic, and presentation-related conditions. Results inform vendor selection and threshold design. |
| FTC | Federal Trade Commission: A U.S. federal agency responsible for consumer protection and competition enforcement. It enforces identity-theft, data-security, privacy, and consumer-reporting requirements within its jurisdiction. |
| G | |
| GDPR | General Data Protection Regulation: The European Union regulation governing the processing of personal data and protecting individual rights. It has major implications for identity matching, automated profiling, biometrics, data minimization, retention, and cross-border transfers. |
| GLBA | Gramm-Leach-Bliley Act: A U.S. law imposing privacy, information-sharing, and safeguarding obligations on covered financial institutions. Consumer-data and identity-service providers may be directly covered or contractually required to support client compliance. |
| GLEIF | Global Legal Entity Identifier Foundation: The nonprofit organization overseeing the global legal-entity identifier system and its data-quality framework. Its reference data supports consistent identification of organizations and their ownership relationships. |
| GPG 45 | Good Practice Guide 45: United Kingdom government guidance for proving and verifying a person’s identity. It describes how evidence, validation, activity history, fraud checks, and identity verification combine to achieve confidence profiles. |
| H | |
| HLR | Home Location Register: A mobile-network database containing subscriber and service information associated with telephone numbers. Derived checks can help assess number validity, network status, porting, and indicators associated with identity or account fraud. |
| HOTP | HMAC-Based One-Time Password: A standards-based password generated from a shared secret and an incrementing counter using a hash-based message authentication code. It provides a changing authentication value but still requires secure secret management and phishing controls. |
| I | |
| IAFCI | International Association of Financial Crimes Investigators: A professional association supporting collaboration and training among financial-crime investigators. Its membership spans financial institutions, law enforcement, payment firms, and fraud-service providers. |
| IAL | Identity Assurance Level: A NIST classification describing confidence that a claimed real-world identity has been appropriately resolved, validated, and verified. It helps organizations align proofing rigor with transaction and account risk. |
| IAPMR | Impostor Attack Presentation Match Rate: A biometric metric measuring the proportion of impostor attack presentations that both evade presentation-attack detection and match the targeted identity. It captures a particularly consequential end-to-end spoofing failure. |
| ICAO | International Civil Aviation Organization: A United Nations agency that establishes global specifications for machine-readable passports and other travel documents. Its standards underpin document layouts, chip data, cryptographic signatures, and automated inspection. |
| ICO | Information Commissioner’s Office: The United Kingdom authority responsible for enforcing data-protection, freedom-of-information, and related information-rights laws. Its guidance and enforcement are particularly relevant to credit-reference, identity, and biometric-data processing. |
| ID&V | Identity and Verification: The process of collecting identity information and checking it against reliable evidence or data sources. The term commonly covers documentary, database, biometric, and risk-based checks used during onboarding. |
| IdP | Identity Provider: A service that authenticates a user and issues identity assertions to relying applications. Its proofing, authentication, federation, and account-recovery controls determine the trustworthiness of those assertions. |
| IDSP | Identity Service Provider: An organization providing identity proofing, verification, authentication, credential, or attribute services. The term is used in digital-identity trust frameworks and procurement standards, particularly in the United Kingdom. |
| IDT | Identity Theft: Unauthorized use of another person’s identifying information to obtain value, access accounts, or commit other offenses. Credit monitoring, fraud alerts, file corrections, and identity-recovery services help mitigate its effects. |
| IDV | Identity Verification: The process of determining whether a person or organization is who it claims to be. Effective verification evaluates identity evidence, source reliability, match quality, fraud signals, and control over the asserted identity. |
| IMEI | International Mobile Equipment Identity: A unique identifier assigned to mobile-device hardware. Device-intelligence services use it, where available and lawful, to recognize devices, detect anomalies, and identify suspicious reuse patterns. |
| IMSI | International Mobile Subscriber Identity: A unique identifier associated with a mobile subscriber’s network identity and stored on the subscriber module. Changes or inconsistencies can provide signals for SIM-swap and account-takeover detection. |
| IP PIN | Identity Protection Personal Identification Number: A six-digit number issued by the U.S. Internal Revenue Service to help prevent fraudulent federal tax returns using a taxpayer’s identity. It demonstrates the use of an additional identity-bound secret for fraud prevention. |
| ISO/IEC 18013-5 | International Organization for Standardization/International Electrotechnical Commission 18013-5, Personal Identification — ISO-Compliant Driving Licence — Part 5: Mobile Driving Licence Application: The international standard defining data structures and interfaces for mobile driving licences. It supports selective disclosure and cryptographic verification of digital identity attributes. |
| ISO/IEC 29115 | International Organization for Standardization/International Electrotechnical Commission 29115, Entity Authentication Assurance Framework: An international framework for specifying levels of assurance for entity authentication. It provides a common basis for evaluating authentication threats, controls, and confidence. |
| ISO/IEC 30107-3 | International Organization for Standardization/International Electrotechnical Commission 30107-3, Biometric Presentation Attack Detection — Part 3: Testing and Reporting: The international standard defining principles and metrics for testing biometric presentation-attack detection. It enables more consistent evaluation of liveness and spoof-resistance claims. |
| ITIN | Individual Taxpayer Identification Number: A U.S. tax-processing number issued to certain individuals who are not eligible for a Social Security number. Identity systems must distinguish it from other identifier types and validate its format and context appropriately. |
| ITRC | Identity Theft Resource Center: A U.S. nonprofit organization providing identity-crime victim assistance, research, and education. Its reports and case experience offer insight into fraud methods and recovery challenges. |
| ITVA | Identity Theft Victim Assistance: An industry program and operating approach for coordinating the correction of consumer records affected by identity theft. It helps reduce the burden on victims dealing with multiple creditors and reporting agencies. |
| IV | Information Value: A scorecard-development measure of how strongly a variable separates outcomes such as good and bad accounts. It is often used with weight-of-evidence transformations for variable screening and monitoring. |
| IVES | Income Verification Express Service: A U.S. Internal Revenue Service service through which authorized participants obtain tax-return transcript information with taxpayer consent. It supports income verification while requiring strict authorization and data-handling controls. |
| J | |
| JWT | JSON Web Token: A compact format for transmitting digitally signed or encrypted claims between systems. Identity platforms use it for authentication and authorization assertions, making signing, validation, expiration, and key management critical. |
| K | |
| KBA | Knowledge-Based Authentication: An identity check based on answers to questions derived from personal or account information. Static and broadly available data have weakened its effectiveness, so higher-risk uses require stronger complementary controls. |
| KS | Kolmogorov-Smirnov Statistic: A measure of the maximum separation between cumulative score distributions for two outcome groups. Credit and fraud analysts use it to assess rank-ordering power and select operating cutoffs. |
| KYB | Know Your Business: The process of verifying a legal entity, its registration, operating status, ownership, controllers, and risk indicators. It combines registry, tax, bureau, sanctions, and beneficial-ownership data. |
| KYC | Know Your Customer: The policies and procedures used to identify customers, verify their identities, understand risk, and maintain appropriate records. Reliable identity evidence is essential to preventing impersonation and meeting financial-crime obligations. |
| KYT | Know Your Transaction: The analysis of transaction parties, attributes, context, and patterns to identify fraud or financial-crime risk. It complements customer identity checks by evaluating actual behavior after onboarding. |
| L | |
| LADMF | Limited Access Death Master File: The restricted version of the U.S. death-data file available to certified users that meet statutory security requirements. It is used for deceased-person suppression, identity validation, and fraud detection. |
| LDS | Logical Data Structure: The ICAO-defined organization of data stored on an electronic travel-document chip. Consistent data groups enable systems to read, authenticate, and compare biographic, document, and biometric information. |
| LEI | Legal Entity Identifier: A globally standardized 20-character identifier for legal entities participating in financial transactions. Associated reference and ownership data support entity resolution, counterparty verification, and regulatory reporting. |
| LOA | Level of Assurance: A general measure of confidence in an identity, credential, or authentication event. Some frameworks retain this combined concept, while newer NIST guidance separates identity, authenticator, and federation assurance. |
| M | |
| mDL | Mobile Driving Licence: A digitally signed driving credential held on a mobile device and presented under defined standards. It can provide verified identity attributes with selective disclosure rather than exposing the entire physical document. |
| MFA | Multi-Factor Authentication: Authentication requiring evidence from at least two distinct factor categories, such as knowledge, possession, or inherence. It is a primary defense against credential theft, although implementation quality determines resistance to phishing and recovery abuse. |
| MLRO | Money Laundering Reporting Officer: The designated officer responsible in many jurisdictions for overseeing anti-money-laundering compliance and external reporting. This role often governs identity, screening, investigation, and suspicious-activity processes. |
| MNO | Mobile Network Operator: A company operating a cellular network and maintaining subscriber, number, device, and network-status data. Authorized signals from operators can strengthen phone-ownership and SIM-swap risk assessments. |
| MOP | Manner of Payment: A coded representation of an account’s payment status or delinquency history in credit-reporting data. Correct coding is important to file accuracy, score calculation, and dispute resolution. |
| MRTD | Machine Readable Travel Document: A passport, visa, or related travel document designed for automated reading under ICAO specifications. Standardized zones and, where present, chips support document validation and identity matching. |
| MRZ | Machine Readable Zone: The standardized area on a passport or identity document containing encoded biographic and document data. Optical extraction enables consistency checks and can provide access information for reading an electronic chip. |
| MVNO | Mobile Virtual Network Operator: A mobile service provider that uses another operator’s network infrastructure. Identifying the underlying carrier and service type can improve phone-risk and subscriber-verification analysis. |
| N | |
| NAF | New Account Fraud: Fraud involving the opening of a new account with stolen, synthetic, manipulated, or deliberately misstated identity information. It is a core use case for bureau attributes, consortium data, document checks, and identity-risk scores. |
| NAICS | North American Industry Classification System: A standardized system for classifying business establishments by economic activity. Business-information providers use these codes to normalize entity profiles and support peer, risk, and fraud analysis. |
| NCAP | National Consumer Assistance Plan: A U.S. credit-reporting industry initiative that introduced enhanced data-quality and consumer-assistance requirements, including standards for certain public records and furnished data. It changed bureau and furnisher operating practices. |
| NCOA | National Change of Address: A U.S. Postal Service dataset and associated matching process reflecting address changes submitted by postal customers. Authorized use supports address updating, identity resolution, and returned-mail reduction. |
| NCRA | Nationwide Consumer Reporting Agency: A U.S. statutory category covering consumer-reporting agencies that maintain nationwide files on consumers. Additional duties apply to disclosures, fraud alerts, freezes, identity-theft records, and centralized consumer access. |
| NCTUE | National Consumer Telecom & Utilities Exchange: A U.S. member-owned exchange of telecommunications, pay-television, and utility account information. Members use its data for identity verification, account-opening risk, and payment-performance assessment. |
| NFC | Near Field Communication: A short-range wireless technology used by mobile devices to read compatible identity-document chips and exchange credentials. Chip reading can provide stronger evidence than an image alone because signed document data can be validated. |
| NFIQ | NIST Fingerprint Image Quality: A standardized approach and software for predicting the utility of fingerprint images for automated matching. Quality scores help manage recapture decisions and interpret biometric performance. |
| NIST | National Institute of Standards and Technology: A U.S. federal agency that develops widely adopted standards and guidance for digital identity, biometrics, cybersecurity, privacy, and cryptography. Its publications frequently shape identity-service requirements and procurement criteria. |
| NIST SP 800-63 | National Institute of Standards and Technology Special Publication 800-63, Digital Identity Guidelines: A publication suite defining risk-based requirements for identity proofing, authentication, authenticator management, and federation. It is a leading reference for designing and evaluating remote digital-identity systems. |
| NPI | Nonpublic Personal Information: Personally identifiable financial information collected or derived by a financial institution in connection with providing a financial product or service. U.S. privacy and safeguarding rules restrict its disclosure and require appropriate protection. |
| NTIS | National Technical Information Service: A U.S. government agency that administers access and certification for the Limited Access Death Master File. Certified users must maintain specified security controls and undergo periodic review. |
| O | |
| OAIC | Office of the Australian Information Commissioner: Australia’s federal privacy and information-rights regulator. It oversees privacy requirements for credit reporting, access and correction, data security, and handling of personal information. |
| OCR | Optical Character Recognition: Technology that converts text in document images into machine-readable data. Identity-document workflows use it to extract fields for validation, cross-checking, and tampering analysis. |
| OFAC | Office of Foreign Assets Control: The U.S. Treasury office administering economic and trade sanctions. Identity and entity-resolution services support screening against sanctioned persons, organizations, vessels, and jurisdictions. |
| OIDC | OpenID Connect: An identity layer built on the OAuth 2.0 authorization framework that allows clients to verify users and obtain identity claims. It is widely used for federated login and interoperable digital-identity services. |
| OIDF | OpenID Foundation: A nonprofit standards organization developing interoperable identity and authorization specifications. Its work includes federated login, financial-grade interfaces, shared signals, and digital-credential protocols. |
| OOB | Out-of-Band Authentication: Authentication using a communications channel separate from the primary interaction channel. Its effectiveness depends on the independence and security of that channel, particularly against SIM swaps and social engineering. |
| OOW | Out-of-Wallet: A description of identity questions derived from records presumed not to be readily available in a person’s physical wallet. Data breaches and public-record availability have reduced the reliability of many such questions. |
| OTP | One-Time Password: A code valid for a single authentication event or short period. It is stronger than a reusable password but may remain vulnerable to phishing, interception, malware, and account-recovery attacks. |
| P | |
| PACE | Password Authenticated Connection Establishment: A cryptographic protocol used to establish a secure connection with certain electronic identity and travel-document chips. It provides stronger protection against eavesdropping and unauthorized chip access than older mechanisms. |
| PAD | Presentation Attack Detection: Technology and processes designed to detect attempts to deceive a biometric sensor using artifacts or manipulated presentations. It is central to remote liveness checks and document-holder verification. |
| PCR | Public Credit Registry: A credit-information database operated by a central bank or other public authority. Registries support supervisory, financial-stability, and credit-risk objectives and may coexist with private credit bureaus. |
| PD | Probability of Default: The estimated likelihood that a borrower will default within a specified horizon. Bureau scores may rank this risk or be calibrated to an explicit probability used in credit decisions and portfolio management. |
| PEP | Politically Exposed Person: An individual entrusted with a prominent public function who may present elevated corruption or money-laundering risk, together with relevant family members and close associates under applicable rules. Identification generally triggers risk-based review rather than automatic rejection. |
| PII | Personally Identifiable Information: Information that identifies or can reasonably be linked to an individual. Identity and credit-data providers require strong controls over collection, matching, access, retention, sharing, and breach response. |
| PIN | Personal Identification Number: A numeric secret used to authenticate a person or protect access to an account, device, or credential. Security depends on controlled attempts, secure storage, and resistance to observation and social engineering. |
| PIV | Personal Identity Verification: The U.S. federal standard and credential framework for securely identifying employees and contractors. It combines identity proofing, smart-card credentials, certificates, and interoperable authentication. |
| PKD | Public Key Directory: An ICAO repository used by participating states to exchange certificates and revocation information for electronic travel documents. Access enables automated validation of passport-chip signatures across issuing countries. |
| PKI | Public Key Infrastructure: The policies, roles, certificates, keys, and technical systems used to establish cryptographic trust. It underpins signed identity documents, digital credentials, trust services, and strong authentication. |
| POA | Proof of Address: Evidence used to confirm a person’s or organization’s claimed residential or business address. Sources may include authoritative databases, account records, official correspondence, or validated documents. |
| POI | Proof of Identity: Documentary, digital, biometric, or authoritative evidence used to substantiate a claimed identity. Its reliability depends on the issuing source, validation controls, possession, and binding to the applicant. |
| POI | Proof of Income: Evidence used to substantiate an applicant’s earnings, such as payroll data, tax records, bank transactions, or employer verification. Automated verification services seek to improve speed, accuracy, and resistance to altered documents. |
| PSI | Population Stability Index: A measure comparing score or variable distributions between a reference population and a later population. It is widely used to detect portfolio shifts and model drift in credit and fraud analytics. |
| Q | |
| QES | Qualified Electronic Signature: The highest-assurance electronic-signature category under eIDAS, created with a qualified device and based on a qualified certificate. It has the equivalent legal effect of a handwritten signature across the European Union. |
| QTSP | Qualified Trust Service Provider: A supervised provider authorized under eIDAS to deliver qualified electronic signatures, seals, timestamps, certificates, or related trust services. Qualification requires conformity assessment and ongoing regulatory oversight. |
| R | |
| RBA | Risk-Based Authentication: An approach that adjusts authentication requirements using contextual risk signals such as device, location, behavior, identity history, and transaction characteristics. Higher-risk events can be challenged, reviewed, or blocked. |
| RBP | Risk-Based Pricing: The practice of setting credit terms based on the assessed risk of the applicant or account. When consumer-report information materially contributes to less favorable terms, U.S. notice requirements may apply. |
| RBPN | Risk-Based Pricing Notice: A U.S. notice provided in specified circumstances when consumer-report information results in materially less favorable credit terms. Bureau data and score disclosures must be correctly incorporated into the notice process. |
| RCA | Relatives and Close Associates: Family members and close associates whose connections to a politically exposed person may create related corruption or financial-crime risk. Screening services use relationship data to identify these links while managing false positives. |
| RFID | Radio-Frequency Identification: Technology that uses radio waves to read data stored on a tag or chip. Contactless identity and travel documents use compatible technology, requiring access controls and cryptographic validation to protect data and authenticity. |
| ROC | Receiver Operating Characteristic: A curve plotting true positive performance against false positive performance across model thresholds. It helps compare models and understand the tradeoff between fraud capture and legitimate-customer impact. |
| RP | Relying Party: An organization or application that relies on an identity credential, authentication result, or federation assertion to make an access or transaction decision. It remains responsible for determining whether the assurance is sufficient for its risk. |
| S | |
| SAML | Security Assertion Markup Language: An XML-based standard for exchanging authentication and authorization assertions between identity providers and service providers. It is widely used for federated access and requires careful certificate, assertion, and session controls. |
| SAR | Subject Access Request: A request by an individual to obtain personal data and processing information under data-protection law. Identity verification is necessary to prevent unauthorized disclosure while avoiding disproportionate barriers to exercising the right. |
| SAR | Suspicious Activity Report: A confidential report filed with a financial intelligence authority when activity may involve money laundering, fraud, or other specified crime. Accurate identity, account, and relationship data improve investigative usefulness. |
| SBFE | Small Business Financial Exchange: A U.S. nonprofit trade association and data exchange through which participating lenders contribute small-business credit-performance information. Approved vendors use the data to support commercial credit and fraud-risk products. |
| SCA | Strong Customer Authentication: A European requirement for authentication based on at least two independent elements from knowledge, possession, and inherence categories. It affects digital onboarding, account access, and payment-related identity controls. |
| SCIM | System for Cross-domain Identity Management: A standard protocol and schema for automating user and group provisioning between identity systems. Accurate lifecycle synchronization reduces orphaned accounts and inconsistent identity attributes. |
| SDN | Specially Designated Nationals and Blocked Persons: The principal U.S. sanctions list containing individuals, entities, vessels, and other designated parties whose property is blocked or restricted. Effective screening requires strong name matching, identifiers, ownership analysis, and disposition workflows. |
| SHAKEN | Signature-based Handling of Asserted information using toKENs: The governance and certificate framework paired with STIR to attest caller identity information in internet-based telephone networks. It helps receiving providers assess whether caller-ID information was legitimately asserted. |
| SHAP | SHapley Additive exPlanations: A model-explanation method assigning each feature a contribution to an individual prediction. It can support model validation and reason analysis for complex credit or fraud models, subject to careful interpretation. |
| SIF | Synthetic Identity Fraud: Fraud using an identity assembled from fabricated information, real identifiers, or a combination of both. It can evade traditional identity checks by gradually building apparently legitimate credit or account history. |
| SIM | Subscriber Identity Module: The physical or embedded component that stores credentials used to identify a subscriber to a mobile network. Unauthorized transfer of service to another module is a major account-takeover risk. |
| SOD | Document Security Object: A digitally signed object on an electronic travel-document chip containing hashes of protected data groups. Verifying it helps establish that chip data is authentic and has not been altered. |
| SPI | Sensitive Personal Information: A protected category of personal information that may include government identifiers, account credentials, precise location, biometrics, and other high-risk data. Applicable privacy laws may impose additional use, disclosure, and consumer-choice requirements. |
| SSA | Social Security Administration: The U.S. federal agency responsible for Social Security numbers and associated verification and death-record services. Its data can provide authoritative matching signals within legally permitted identity workflows. |
| SSN | Social Security Number: A U.S. government identifier widely used in credit files, taxation, and identity matching. Because it is frequently exposed and can be misused, it should be validated and combined with other evidence rather than treated as a secret. |
| SSNVS | Social Security Number Verification Service: A U.S. Social Security Administration service that allows registered employers and authorized third parties to verify employee names and Social Security numbers for wage-reporting purposes. Its authorized use is narrower than general-purpose identity verification. |
| STIR | Secure Telephone Identity Revisited: A technical standards framework for signing and verifying caller identity information in internet-based telephone networks. Combined with SHAKEN governance, it helps combat spoofed caller ID and related impersonation fraud. |
| STR | Suspicious Transaction Report: A report submitted to a financial intelligence authority when a transaction or attempted transaction raises financial-crime concerns. This term is used in many jurisdictions outside the United States. |
| T | |
| TAR | True Accept Rate: The proportion of genuine biometric or authentication attempts correctly accepted at a chosen threshold. It is evaluated with false-match and false-rejection measures to understand security and usability. |
| TIN | Taxpayer Identification Number: A general category of identifier used by tax authorities for individuals or entities. Identity systems must recognize the applicable subtype, issuer, format, and permitted verification method. |
| TNR | True Negative Rate: The proportion of legitimate or nonfraudulent cases correctly classified as negative. It indicates how effectively a control avoids unnecessary alerts and customer friction. |
| TOTP | Time-Based One-Time Password: A temporary authentication code generated from a shared secret and the current time. It is widely used for multifactor authentication but can still be intercepted through phishing or compromised endpoints. |
| TPF | Third-Party Fraud: Fraud committed by an external actor using another person’s identity, account, or credentials without authorization. It contrasts with deliberate abuse by the genuine applicant or account holder. |
| TPR | True Positive Rate: The proportion of confirmed positive cases, such as fraud, correctly identified by a model or rule. It is also called sensitivity or recall and must be considered alongside false positives. |
| U | |
| U2F | Universal 2nd Factor: A FIDO protocol enabling a hardware authenticator to provide a phishing-resistant second factor using public-key cryptography. It was an important predecessor to the broader passwordless standards now in use. |
| UAF | Universal Authentication Framework: A FIDO specification supporting passwordless authentication through device-based cryptographic credentials and local user verification. Biometric data remains on the device rather than being transmitted to the relying service. |
| UBO | Ultimate Beneficial Owner: The natural person who ultimately owns or controls a legal entity, even when ownership passes through intermediaries. Identifying this person is central to business verification, sanctions compliance, and financial-crime risk assessment. |
| UDAAP | Unfair, Deceptive, or Abusive Acts or Practices: A U.S. consumer-protection standard applied to conduct that causes unfair harm, misleads consumers, or abusively interferes with consumer understanding or choice. Data accuracy, dispute handling, disclosures, and opaque automated decisions can create exposure. |
| UETA | Uniform Electronic Transactions Act: A model U.S. state law recognizing electronic records and signatures when parties agree to transact electronically. Identity attribution, consent, record integrity, and retention remain important implementation considerations. |
| UK DIATF | United Kingdom Digital Identity and Attributes Trust Framework: The United Kingdom framework establishing rules for digital identity, attribute, orchestration, and related service providers. It addresses governance, privacy, security, interoperability, fraud management, and certification. |
| USPS | United States Postal Service: The U.S. postal authority and source of address-standardization, delivery-point, and change-of-address services. Its data and certifications support address quality and identity-resolution workflows. |
| V | |
| VAT ID | Value-Added Tax Identification Number: A tax identifier assigned to businesses registered for value-added tax in applicable jurisdictions. Checking its format and registry status can support cross-border business verification. |
| VC | Verifiable Credential: A tamper-evident digital credential whose authorship and integrity can be cryptographically verified. It allows trusted issuers to provide identity attributes that holders can present to verifiers. |
| VIZ | Visual Inspection Zone: The human-readable portion of an identity or travel document containing biographic and document information. Verification systems compare it with machine-readable and chip data to identify inconsistencies or alteration. |
| VOE | Verification of Employment: Confirmation of an individual’s current or historical employment using employer, payroll, or authorized third-party data. It supports credit decisions, income assessment, and identity corroboration. |
| VOI | Verification of Income: Confirmation of an applicant’s earnings using payroll, tax, bank-transaction, employer, or other reliable data. Automated services reduce dependence on easily altered documents while requiring consent and source-quality controls. |
| VOIE | Verification of Income and Employment: A combined service confirming both employment status and earnings from authorized data sources. It is used in underwriting, account servicing, tenant screening, and benefit eligibility workflows. |
| W | |
| W3C | World Wide Web Consortium: The international standards organization responsible for foundational web specifications, including decentralized identifiers, verifiable credentials, and Web Authentication. Its standards support interoperable digital-identity ecosystems. |
| WebAuthn | Web Authentication: A W3C standard enabling web applications to use public-key credentials for strong, phishing-resistant authentication. It supports security keys, platform authenticators, biometrics used locally on devices, and passkeys. |
| WOE | Weight of Evidence: A transformation expressing how strongly each category or range of a variable is associated with one outcome relative to another. It is widely used in interpretable credit scorecards and stability monitoring. |
| X | |
| XAI | Explainable Artificial Intelligence: Methods and governance practices intended to make complex model behavior understandable to developers, validators, decision-makers, regulators, and affected individuals. Explainability is important when models influence credit outcomes, identity challenges, or fraud interventions. |
| Z | |
| ZKP | Zero-Knowledge Proof: A cryptographic method allowing one party to prove that a statement is true without revealing the underlying secret or unnecessary data. It can support privacy-preserving identity and attribute verification. |