Utah's digital ID push: who pays when identity data leaks

Utah has formed a consortium on digital identity, Payments Dive reported, building on a state law that puts people, not governments, in control of their identity data. The state's goal is an ID system where leaked personal details are close to useless for fraud. This article looks at where identity data sits in a payment, who carries the loss when it is misused today, and what a credential-based ID could change.

What Utah is doing

Earlier this year Utah passed what it calls the first digital ID bill of rights. The law created a state-endorsed identity program meant to let people govern their own identity data. Bramwell, Utah's chief privacy officer and head of the Utah Office of Data Privacy, said the law is a template for that model, according to Payments Dive.

Utah worked in a set order. It wrote the policy framework first, before launching any product. With the framework passed, officials are now working on the technology. Bramwell said the different approaches other states have taken gave Utah lessons, and he hopes states meet in the middle, with Utah bringing governance and others bringing technology. Per the Transportation Security Administration, 21 states and Puerto Rico now issue digital IDs.

How identity data moves with the money

Payments Dive made the link to payments directly: personal details are often bound up with transactions, above all in e-commerce. It helps to follow one online purchase. The shopper types a name, a delivery address, an email and card details. The merchant passes the card data to its acquirer, the bank that handles card payments for the merchant. The acquirer sends it through the card network to the issuer, the bank that gave the shopper the card. The issuer decides whether to approve.

At each step, identity data travels next to the payment data. The merchant stores some of it. A payment processor may store more. A fintech app linked to the account may hold a copy too. A growing number of fintechs want to use this data to personalize services, Payments Dive noted. Every extra copy is another place it can leak from.

Who carries the loss today

When stolen identity data is used for fraud, the cost rarely stays with the company that leaked it. It lands where the fraudster uses it. A criminal who has a person's details can try to open a new account, pass a password reset, or answer security questions. Each of those paths ends with a different loser.

On a card, an unauthorised purchase usually becomes a chargeback, a forced reversal that pulls money back from the merchant through the acquirer. The merchant often absorbs the loss and the fee. If a criminal opens a new loan or card in the victim's name, the lender that approved it holds the bad debt, and the victim spends time cleaning up the record. If the criminal tricks the victim into sending money, the victim may carry the loss alone. The weak point in all three cases is the same: knowing someone's data is treated as proof of being that person.

• Merchant: absorbs many card fraud chargebacks.
• Lender or issuer: carries accounts opened with stolen identities.
• Customer: may carry losses from scams where they approved the payment.

Can a credential make stolen data useless?

Utah's stated aim targets that weak point. Bramwell said Utah wants a system where breached data is close to worthless for fraud or impersonation, because a criminal would not hold the ID credentials. In his words, the goal is that "even when your personal data has been breached, it can't be used to impersonate you and commit fraud".

The mechanism matters. Today, a name, birth date and address act like a password that cannot be changed. A credential is different: it is something the person holds, such as a digital ID on a phone, that can prove identity without handing over the raw data each time. If banks and merchants checked the credential instead of the data, a leaked file would open fewer doors, and fewer losses would flow to merchants and lenders. That only works if the parties that carry the losses accept the credential. Utah has not yet built the technology, so this is a design goal, not a working system.

Rules and what to watch

Bramwell said 168 million different digital identities are used across U.S. platforms with no shared governance rules, which is why states need a framework. He also questioned the value of a digital ID that does not forbid surveillance pricing that harms the holder, or tracking of each use. Those are consumer protection rules, but they shape payments too: they decide what a merchant or fintech may do with the data it sees at checkout.

Several things are worth watching. First, whether other states join Utah's consortium and adopt its governance model. Second, whether banks and card issuers accept state credentials when opening accounts or approving risky payments. Third, how the rules on data use sit next to fintechs' plans to personalize services.

Sources

• Payments Dive, 19 Oct 2026

Written by AI from the sources above and published automatically: before release, a script confirms every figure against the sources and checks for copied text. No editor reviews it. Treat it as background reading, not financial advice.