Bots Overtake Fraudsters as Digital Identity’s Main Threat, Says Persona CEO

Digital identity has always been a thorny challenge.

However, in today’s world, the enigma of who is who when it comes to security-critical operations like commerce, banking and payments, has grown more complex and the challenges arguably more unimaginable.

The problem is the greatest threat to digital identity is being driven not from human fraudsters, but from bots.

“The core question now isn’t just whether something is a bot or a human,” Persona CEO and co-founder Rick Song said during a discussion hosted by PYMNTS CEO Karen Webster. “It’s who is behind the bot?”

The problem isn’t new, but artificial intelligence amplifies it.

“What AI has done is accelerate a problem that’s already existed on the internet for a long time,” Song said. “How do I prevent a bad actor from having access again and again?”

By 2030, 90% of internet traffic is expected to be generated by bots. This shift will likely demand new identity paradigms.

“How are you identifying AI bots that are not malicious?” Webster asked Song. “Because not all of them are, even though we tend to characterize them as all being bad.”

In the age of agentic AI, that distinction is becoming more difficult and more crucial to determine.

“It’s about whether the host site wants that AI bot to get access,” Song said.

As the battle to manage AI traffic, reduce fraud and personalize services accelerates, identity has emerged as among the most important variables in the equation. However, the future of identity may not lie in individual credentials and could ultimately be determined by how well proxies are managed.

The issue is that fraudsters use the same digital disguises as legitimate users: proxy servers, masked IP addresses and spoofed user agents. The tools that publishers, platforms and retailers rely on today, such as IP logging or browser fingerprinting, are proving to be inadequate.

“The reality today is that without asking the user to do something more, there is no way to distinguish between a bot and a legitimate user,” Song said.

Yet no consumer wants to go through biometric scans or show a government ID just to read an article, both of which create friction and can lead to a lack of privacy.

For its own part, Persona’s goal, then, is to make identity seamless.

“The goal is to immediately just know, yes, this is this person — without revealing your face, birthdate or name,” Song said. “That’d be a huge transformative thing for the next generation of the internet.”

In publishing, for instance, this might enable a real human user to be reliably identified anonymously so that advertisers can serve relevant content without violating privacy or wasting impressions on bots.

“It’s an eyeball that you can serve an ad to,” Webster said.

Behind this seamless experience is a three-layer architecture: orchestration, verification and data management. To verify, platforms like Persona can support everything from government IDs and biometric scans to integrating emerging digital credentials like mobile driver’s licenses (MDLs), CPASS or European Union digital wallets.

At the same time, orchestration is key for its ability to aggregate and integrate disparate identity signals into a single, usable framework, while, perhaps most crucially, management of personal data needs to be prioritized.

Before the emergence of PCI compliance, eCommerce was a minefield, Song said, drawing an analogy from his background in payments.

“My dad thought buying something online was the most irresponsible thing,” he said.

But what changed wasn’t how payments were made; it was the centralized management of card data by trusted intermediaries like Stripe, Square and Adyen. Similarly, Persona aspires to be the identity layer that companies offload risk to.

“It’s so hard to manage personal information,” Song said. “We create that core infrastructure.”

Today, Persona is focused on high-assurance use cases — those that justify friction.

“If it was as invisible as just a token, I don’t think there’s any question of buy-in,” Song said.

The goal is not to create yet another digital identity, but rather to act as the infrastructure that accepts and unifies the ones already in use.

But building trust among consumers is still a challenge.

“Consumers have learned to trust the issuer, the card networks,” Webster said. “When your identity is stolen, that’s a whole different matter.”

Song proposed an idea borrowed from the same credit card analogy: a proxy identity.

“Although we feel comfortable with our credit card numbers, I think we all still feel very uncomfortable about our bank accounts,” he said. “We’re looking for a digital ID that acts as a proxy — something that, if it gets hijacked, can be reissued.”

So, what happens when we combine proxy identities with agentic AI models that shop, book travel or negotiate on our behalf?

Song said he envisions a future where identity is not just a gatekeeper but a participant in the transaction. Commerce itself may transform from search-driven to goal-driven. The agent takes over, and a verified identity ensures the transaction is trustworthy and attributable.

“Instead of planning a vacation step-by-step, you might just say, ‘Find me a hot beach for seven days,’” Song said.

But 2025 may be less about new AI advances and more about the societal reaction to AI’s rise.

“I actually think the story this year will be how society and governments react — trying to slow things down,” Song said.

He predicted a coming wave of data protectionism and digital ID fragmentation, as governments push for local data residency and build their own digital identity schemes.

“In many ways, identity is maybe a decade behind the same evolution in payments,” he said.

For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.

The post Bots Overtake Fraudsters as Digital Identity’s Main Threat, Says Persona CEO appeared first on PYMNTS.com.