Pillar 04 Regulatory Attribute Proof
The layer that proves KYC / AML / regulatory attributes via selective disclosure.
City of Portland: An impostor used a password-reset link to enter a contractor's supplier account and had a construction payment sent elsewhere (US DOJ and others)
Nothing checks a new bank account against the supplier's registered contact before paying
ZUU: A transfer instruction from someone posing as an executive in the company's business chat was paid out to an outside account the same day (company disclosure, special investigation)
Nothing checks, before paying, that an instruction really came from that executive
City of Baltimore: A fake contact posing as a supplier's employee was added to the supplier's account, and its bank account was switched (city Inspector General report)
Nothing checks a new contact or a bank change with the supplier's registered contact
City of Liberty, Texas: A lookalike vendor domain sent a request for the exact amount owed, and the city paid it (city statement)
No check, before paying, that the request really came from that vendor is visible
Orion S.A.: An employee was targeted by a criminal scheme, and multiple wire transfers went to outside accounts (US SEC filings)
Wire controls the company believed adequate as designed did not operate, and nothing ties each transfer to a verified request
Hatena: A call from fake police led to remote control of the head of accounting's PC, and funds left through internal fund moves (company disclosure, special investigation committee)
Nothing checks transfers and fund moves against a documented reason before executing them
Sourcenext: A member-information API was abused, and up to 22.52 million member records may have been taken (Sourcenext announcement)
No layer checks the volume and purpose of each call as it runs
Denmark CPR: One private company's lawful lookup access was abused to pull names, addresses and CPR numbers for about 8.8 million people (Danish digitalisation ministry)
the access was lawful, but nothing checked each lookup's targets against what was permitted
North Korean IT workers: they won contracts in Japan by posing as local enablers, using ID images the enablers supplied (joint advisory by seven agencies in Japan, the US, Australia and Germany; Japan's first laptop farm dismantled)
the ID was genuine, but nothing tied its holder to the person doing the work before the work was handed over
Revolut: It kept handing over customer data for months, answering disclosure requests that arrived through Italy's state-certified email network (PEC; Italian prosecutors investigating)
the state certifies delivery, but nothing verifies the requester's authority before the data goes out
IDScan.net: More than 153 million scanned driver's licenses handed over at counters were being sold on the dark web
the check ends in a moment, the image does not
AnonyMousKIT: AI voice agents posing as 'Apple Support' extracted unlock passcodes from stolen-iPhone owners
being able to state the passcode is treated as proof of ownership
Expired Visa EMV contactless cards were shown to pass at checkout
the expiry the terminal reads is never collated against the issuer's signed record
FCA fines Starling Bank £29m: since 2017, the automated sanctions screening had been matching customers against only a fraction of the list
the screening ran
Speechify verified voice-cloning consent with a single checkbox
CFA asks the FTC and state AGs to investigate
A7A5: a ruble-backed stablecoin moved $110B under sanctions
fully traceable on-chain, yet nothing proves or blocks a sender's sanctions status at transaction time (CertiK / Elliptic)
Sumsub: a malicious attachment let attackers into an identity-verification vendor's support environment, where client end-users' names and contact details sat readable and unnoticed for about 18 months (company disclosure)
No layer checks where data held for identity checks lingers outside the core, and who can read it
Change Healthcare: a breach of a single Citrix account without MFA halted a third of US medical-claims processing for weeks
with no layer separating "knows the password" from "is the legitimate authorized party," stolen credentials were indistinguishable from legitimate access (UnitedHealth Group congressional testimony)
Hong Kong deepfake meeting fraud (Arup): trusting a pre-recorded video call that faked the UK CFO and colleagues, a finance employee sent about HK$200 million in 15 transfers (Hong Kong government LegCo reply, Arup confirmation)
Nothing confirms a payment instruction through a channel other than the one it came in on
IDMerit: about a billion records apparently used for identity checks were reported found in a password-less database, IDMerit denied it, and whose data it was remains unsettled (Cybernews report, IDMerit denial)
No layer can show, from records, whose custody the data was in
NHO Hokkaido hospitals: some hard drives from retired electronic medical record systems, sent out for destruction, were never shredded and were won at online auction (NHO Hokkaido Medical Center, Hokkaido Cancer Center)
No layer lets the client confirm, drive by drive, that what it sent was destroyed
Generated Without Consent or Age Verification
The Provenance Gap Behind the Grok Deepfake Controversy
70,000 Government IDs Leaked to Prove Age
Discord's Third-Party Verification Vendor Breach
Phantom Carbon Credits
When an Environmental Attribute Is Issued Without Independent Verification of Its Underlying Data (Operation Greenwashing)
AOG Technics: over 60,000 aircraft engine parts circulated with forged airworthiness certificates
the provenance of the certificates asserting airworthiness is not independently verified before receipt (SFO)
Polaris Holdings / Booking.com: the bank account that receives a hotel's sales was switched to a third party's inside the legitimate admin screen, and one hotel lost about ¥9 million (company disclosure)
nothing has someone else confirm a payout-account change before money moves
Tools to defeat eKYC face checks were on sale on Telegram: a virtual camera slips recorded or synthetic video into bank and exchange liveness checks (MIT Technology Review investigation)
No layer checks that the video came from a real camera, live
The Inspections Were Recorded as 'Complete'
But Never Performed. On the Boeing 787, the Existence of a Record Was Mistaken for Proof of the Act
OnlyFake
AI-Generated IDs Bypass Exchange KYC
Tampered Certification Test Data Behind Type Designation
Product Regulatory-Conformance Attributes Asserted Without Independent Verification on the Path to Shipment
Unqualified Engineers Placed Under National-License Claims
Regulatory Attributes Asserted Without Independent Verification at the Point of Assignment
Wirecard: forged bank balance confirmations asserted €1.9B that didn't exist
a financial attribute disclosed without independent verification
The Coinbase KYC Insider Breach
When Regulation-Mandated Storage of Raw PII Becomes the Breach Surface
Google API Keys Remain Usable for 23 Minutes After Deletion
Independent Verification Gap in Credential Revocation Attributes