PHACKS | Car Hire

Authentication and verification of customers is a fundamental aspect of the car hire business. Identifying a customer is the first step in the car hire process for managing major risks to the high value assets – cars – and to validate payments by the customer. 

International car hire companies require to be able to validate in real time to an authority: 

• The identity of the driver; 
• The driving licence and that it belongs to the driver; 
• Points, fines or convictions associated with the driving licence; 
• The driver’s independent insurance, if they choose this; 
• Ownership of the payment method used for reservations. 

There are risks also regarding other car hire partners, insurance, SOS, car repair shops, etc. The spectrum of identity-related risks and fraud is wide for car hire companies, including the following: 

• Identity validation and verification against authoritative sources in real time to mitigate identity fraud risks. 
• Driving licence validation and verification: in certain countries a driving licence is paper based and cannot be validated. Other ways to validate data validation are needed. 
• Confirmation of the payment itself, as well as the verification of the ownership of the payment method against the customer’s identity – given the obligation that car hire and pickup require a valid identity and the provision of the credit card used for the (online) reservation that belongs to the car hirer.  The hirer and the driver should normally be the same, the only exception being corporate bookings, where the driver should be verified as a company employee.   
• Insurance fraud: car hire companies responding to insurance company car hire requests for its customers, face a high risk of indirect fraud and abuse by the insurance company customers. The insurance company sends the customer to the car hire company which in turn provides a car even when this customer has previously misused cars and violated terms and conditions, in which case the customer is blacklisted and is not allowed to hire cars.  The car hire company needs the ability to validate the identity of the insurance company’s customer as part of the car hire booking process; this would help the insurance company manage its risks too, particularly for the PSD2 regulation. 

For example, in several countries, the driver is required to go online and obtain a certificate, valid for a month or so, which confirms this information.  However, many people don’t do this.  Instead, they pressure the car hire person on the desk at the airport and threaten to go to another company.  The desk staff have no choice in reality, so they sign up the customer and hire the car to them.  This undermines the whole purpose of the scheme, fails to address risks to the car hire company, causes costs and delays at the desk, and upsets other customers in the queue.  It also gives a bad image to other potential customers and undermines the company’s reputation.  It results in stolen and damaged hire cars, and it leaks personal data.   

In the case of car hire, the customer would enrol with the car hire company for an account and a KYC check is carried out to confirm the identity and proof of address (for payment purposes).  They also enrol the claimed attributes from their driving licence using optical character recognition, which can be validated with the driving licence authority using PHACKS ZKP – no data is shared.  If the driving licence is invalid, it will fail and it is then up to the user to get a new driving licence from the authority and then re-enrol. If the driving licence is valid, then ZKP validation checks on important data attributes can be completed.   

If the data validation checks are successful, then any additional data required by the car hire company could be sent directly and securely to the company.  This could include a photo, the driving licence number, permitted classes of vehicles and any points/fines/court rulings that affect the car hire lease or insurance.  The information on the token is valid at the time it issued, which would normally be when the booking is made.  An update is done when the car is collected, at the desk.  If, at any point, the authority’s regulated data for the user’s driving licence changes or the driving licence is revoked, then a notification could be sent immediately to the car hire company, so they know the exact status at all times but in a privacy preserving way with no exposure of personal data.  The same could potentially be done to validate insurance. 

Another requirement is to add geo-authentication to identify and prove when a person hires a car in one country then crosses into another.  If this is part of the contract, then there is no problem.  But in many cases, particularly with tourists, they cross borders without necessarily knowing that their terms have changed, and they may no longer be authorised for the car, or insured. If this were addressed by the companies, using PHACKS data validation, then the user could be warned approaching a border and given the option to remain in the country or to amend their hire contract so that they could legally and safely drive in the second country.  All without exposing personal data. 

There may be the potential to extend this to address EU Payment Service Directive 2 compliant payments in car hire business process, which would help to increase trust between all parties and reduce the threat of criminal activity.  A project could potentially provide additional functionality to increase benefits to all parties.  

Other use cases for car hire to integrate with PHACKS include:  

• Utilising the ZKP token for online car reservation and using the same token to collect the car at the pickup location via an app that recognises the token without the need to re-identify the customer and verify the payment method. 
• Utilising ZKP identification of a customer between partners such as insurance and car hire companies to verify whether an insurance customer has been blacklisted by the car hire company without revealing the identity of this customer at an early stage to the car hire company. 

Realising Value through PHACKS 

PHACKS can help to deliver significant improvements that dramatically reduce risks and costs for car hire companies, particularly in relation to fraud, theft, damage and the uninsured use of their cars.  A collaborative community of car hire companies using PHACKS could help to reduces fraud, theft and damage even further. 

How to Participate in PHACKS

If you are inerested in getting involved, please visit our How to Participate page or Contact Us.