Website
Short description
The company is now scanning people’s IDs using Persona
Why I think this tool should be removed
Section on Privacy Guides
Financial Services
Related threads:
(Separate thread for discussing the YouTube video linked in this Site Development > Tool Suggestions thread)
So.. Alternatives? Halocard?
Yeah, this should be removed ASAP.
Yeah I view this as unacceptable, we need to look at removing this now @team
I’m not necessarily arguing against, but there’s a larger discussion to be had regarding this category of KYC-compliant private payment tools:
Privacy.com was never an anonymous payment service. It was a tool meant to keep your payment information private from vendors specifically. And to be clear, it does still do that - using Privacy.com, I can make card purchases without giving any personal information. But Privacy.com is a legal business beholden to KYC laws, and thus collects & retains PII.
Even Halocard may require biometric KYC verification (through Sumsub, not Persona), as Ed describes in the Halocard thread:
…using AI to detect fraud, extracting facial features to match your selfie against your ID, and the liveness check where you blink or smile appear in every single providers’ privacy policy in one form or another because that’s how modern identity verification is evolving…
So the larger question to ask: is Persona a particularly evil KYC provider? Is there a privacy-friendly KYC provider? Does any private payment tool that requires KYC compliance have a place in PG recommendations?
@ed-halocard may have some input. Obviously take it with a grain of salt because they are direct competitors but he seems to have done a lot of research and actually interacts with the KYC and banking industry.
I personally also hate these KYC platforms. But all of them are quite bad (and often not so secure).
Problem is that banks went online, governments force banks to verify identity and governments in many countries do not have way to proof identity online for commercial purposes. This just let to some crazy opportunity for all kinds of shitty companies that offer identity verification services.
Must be said that Perona seems to be a rather bad and questionable choice here.
I’ve thought about this a little more. I believe this is, at its core, a question of threat models. A few thoughts to hopefully spur some more discussion:
____
For those who live under a high-risk model, who fear targeted attacks or government persecution, any tool that uses ID verification is unconscionable. These users need anonymity, to minimize total PII exposure.
There are also users with much more forgiving threat models. Many are only focued on mitigating surveillance captialism, preventing megacorpo overlords from monitoring you & building a targeting ad profile
_____
Private purchases are insanely difficult
The only truly private currency is crypto. But crypto isnt mainstream. Relying on crypto alone closes off much of today’s market
For brick-and-morter stores, cash is king. Close to anomymous & untrackable. This is a strong option when possible
Most purchases today are in online stores that don’t accept crypto. You need credit, debit, or some online payment service. And you need to provide enough PII to verify the payment: name, address, etc
___
Without these KYC payment tools, there is not really a way to make clearnet purchases without disclosing PII directly to every vendor you do business with.
The cost of using them is to provide a TON of PII to the tool directly & allowing it to be stored and processed by a questionable, opaque third-party KYC service.
Is this a worthwhile value proposition?
Disclaimer: I’m the founder of a virtual card platform, so weight this post accordingly.
I think they may have been using third party verification providers as a fall-back for a few years now. See this thread from Feb 2025.
There is unfortunately no other way to do it. The ID requirements within US financial regulations are concrete. If you issue a card on behalf of a bank, you must verify every customer using either:
- a non-documentary method i.e. Running your SSN against a database/credit bureau and verifying existing banking data (this is where Plaid comes in), or
- a documentary method i.e Scanning your identity document
If you can’t fulfil the obligations using a non-documentary method, or that check was done some time ago, a documentary check may be required.
It’s important to note, the regulations don’t strictly require a selfie or liveness check (where the biometric data comes in). This is a fraud control used to confirm the person making the request is the one on the identity document. Without it, anyone could just submit a photo of a stolen ID and verify on someone else’s behalf, which would be… in a word… undesirable.
We also require identity verification, albeit with a different vendor, and none of them are outstanding. They all largely face the same threat from AI producing near flawless, falsified digital images (deepfakes). The only way to stay ahead is to constantly evolve how their own AI algorithms identify genuine vs fake applications based on biometric data.
Agree wholeheartedly.
If your objective is private payments to protect your primary card details and personal information online, the convenience of having virtual debit or credit cards that work everywhere you need them has to, unfortunately, be traded off with the legal requirement to verify your identity.
If your objective is anonymous payments then gift cards, crypto (monero) and cash are the best options, however they’re less convenient and/or not accepted ubiquitously.
For those interested, I’ve added some commentary to Louis’ video here:
You’re right, obviously, that identity verification is legally required. But that’s not really my problem with virtual cards. My problem is the lack of transparency in tracking of every purchase afterward, which your description of the trade-off leaves out. Removal of this tracking is what Monero and cash give you.
While sometimes I want anonymous payments, the vast majority of the time I just want private payments. Payments where my data isn’t disclosed beyond the merchant.
While Monero and cash can be used for anonymous payments (with significant effort on top of them), they are also the best ways to do private payments. I don’t like how you frame Monero as for anonymous payments and virtual cards as for private payments, when Monero is the way to do private payments and virtual cards are only private if you understand and intend who sees your data. I don’t think most people intend for every purchase to be tracked and analyzed.
Virtual cards do more to provide pseudonymity from your merchant than privacy. The virtual card company and its bank see every transaction, tied to your verified ID. Of course, card networks and payment processors see every transaction with a regular card too. So for tracking, virtual cards are a side grade against regular cards. They hide your details from the merchant, but add the virtual card company as another party. I’m not saying privacy or merchants isn’t important, this is a marketing issue.
Yes, I know, convenience, acceptance. But introducing anonymity here is just muddying the water. Anonymity is not a more extreme form of privacy. Anonymity could be where you’re disclosing your data freely but your identity is concealed. That’s anonymity and not privacy.
Cash does not always provide anonymity. A local florist who knows you still knows your identity when you buy flowers in cash, therefore you’re not anonymous. But no bank or payment processor learns about the purchase. The only party that sees it is the florist, the one you intend to see it, so it’s private.
This is not a critique of virtual cards. I don’t think virtual card companies can improve the privacy of their services beyond minimizing their data collection, due to regulations. It’s a critique of your marketing in this post. By marketing I mean you calling virtual cards private payments. I made a separate post about accurate marketing for payment masking services, inspired by this comment. but that’s about the websites.
Going back to the discussion in terms of our website here, I feel like we are fairly clear about this, and so no change to our recommendations is needed.
I am not sure Persona is significantly worse than IDology (used by MySudo) or Sumsub (used by Halocard), enough to warrant removal of Privacy.com on that basis alone.
Disclosure: I am MySudo, and we also offers virtual cards.
We’re in the same boat with Ed on the core issue: if you issue Virtual cards through a regulated bank, identity verification is mandatory under US CIP/KYC rules. Jonah is right that MySudo uses IDology, no vendor in this space is perfect, and I think Ed explained the regulatory constraints well.
As others have already said, different threat models need different tools, where we’d offer an additional angle is that Virtual Cards are only one piece of the picture. Most of the data that merchants and brokers collect and sell isn’t your payment information, it is your name, phone number and email address. Those are what get linked across breaches and data brokers.
MySudo is built around compartmentalization: separate “Sudo” profiles for separate use cases We want to empower users with choice that was silently stripped from them from right under their nose.
Some or our users use Virtual Cards, others never touch them because their threat model requires they stay anonymous. e.g. We have a cohorts of journalists who’s threat model requires anonymity, at the other end of the spectrum we have realestate agents who are just tired of handing out their personal cell number to every random person they interact with. And in case you are wondering “how we know” this, we do not and cannot read your communications, we simply have people from these industries reach out to use with lots of questions as they evaluate our product for their use case.
If your threat model calls for no ID verification at all, then a KYC-based tool isn’t for you, and that’s a perfectly reasonable conclusion. But if you’re mainly trying to shrink or compartmentalise your exposure to merchants and data brokers, we’d welcome you to check us out and tell us where we fall short. Happy to answer questions here.