Should we really need iris authentication to prevent AI fraud at banks?

World has announced a World ID product for financial institutions. The goal is to prevent AI from impersonating people during bank transactions or video calls by verifying that a user is a real human and proving under whose authority an AI agent is acting.

I’m very interested in identity verification technologies, so I’ve been looking into this, and the direction itself makes sense.

Voice phishing and account takeovers are already a headache, so if AI deepfakes become more sophisticated, I don’t think banks can rely on existing authentication methods for much longer.

Especially as AI agents start handling payments or financial tasks on our behalf, it seems crucial to verify whose authorization that AI actually has.

Korea already has authentication systems like financial certificates or joint certificates. While the process can be complicated, they were designed as security measures to prevent these kinds of problems. However, if we start delegating those certificates to AI agents, that could introduce a whole new set of issues.

There’s one thing that bothers me about this.

Why do we absolutely need biometric data like iris scans to prove we’re human?

World emphasizes cryptographic proof methods that reduce personal data exposure during the authentication process. However, some people are uncomfortable with the fact that biometric data is handled during the initial registration, and even if it’s technically secure, it eventually boils down to whether you trust the underlying operational structure.

Besides, not every financial transaction needs the same level of authentication, right?

If they demand the same authentication for small payments as they do for large transfers, it’s going to be annoying depending on the importance of the transaction.

I agree that we need strong authentication to prevent AI impersonation, but I’m not yet convinced that it must be based on biometrics like iris scans.

In an era where AI handles even our financial tasks, should banks aggressively adopt biometric-based identity verification like iris scanning? Or is it better to prioritize existing authentication methods and personal data protection?