How can a business personalize a digital experience without collecting unnecessary customer data, and who is responsible when an AI agent acts on a shopper’s behalf?
In this episode of Business Tech Perspectives, I speak with Sapphire Samiullah, Product Lead at Pion, about why digital identity is moving from a specialist check at registration or checkout into the infrastructure behind customer trust, loyalty and fraud prevention. Pion supports verified offers across 10 consumer groups in over 100 countries, including students, graduates and workers in eligible professions.
Sapphire explains how a reusable verification status can reduce repeated data collection. A customer who has already proved eligibility can enter a phone number on a participating brand’s site, allowing Pion to return a simple verified status. The brand receives the result it needs, while the customer avoids sharing the same supporting information again. She also describes why adding SMS-based multi-factor authentication made students feel safer rather than creating the expected friction.
We discuss the measures that connect identity systems to business results. Registration and verification conversion rates reveal whether people can complete the process. Method, channel and market comparisons expose weak points. Pion also tracks activation, defined here as a verified user issuing a first discount code within 24 hours, to connect successful verification with customer action.
The conversation then turns to agentic shopping. Existing fraud controls often assume a human is behind each request. An AI agent introduces another test: is it authorized to make this purchase for this person at this moment? Sapphire discusses the need for standards around delegated authority, consent and agent credentials as automated purchasing becomes more common.
Privacy and inclusion remain central. Pion asks for the minimum information required, tells users why it needs each field and encourages people to redact irrelevant details from submitted documents. Multiple verification routes, including human review, can also prevent automated systems from excluding apprentices or others without standard records.
Can companies build identity systems that recognize both human customers and authorized AI agents while preserving consent, inclusion and trust?
[00:00:00] It's not your fault that your agentic AI systems are acting outside of compliance. There are just too many data sets to guardrail them all. But with Denodo, you can now organize your hundreds of data sources into one layer and govern your agents with a single approach. Try it now with Denodo by visiting denodo.com to learn more.
[00:00:26] What happens when the person making a purchase is no longer a person at all, but an AI agent that is acting on someone's behalf? Well, as companies race to personalize digital experiences, identity verification is moving far beyond a check, a registration or a checkout. Now, it's becoming part of the infrastructure behind trust, loyalty, fraud prevention and customer growth.
[00:00:56] So today on Business Tech Perspectives, I've got a guest joining me from a company called Pion. And she works across verification methods and fraud prevention for a platform that supports 10 verified consumer groups in over 100 countries. And together, we will discuss why identity data now matters across product, marketing and engineering.
[00:01:20] And we'll also explore how brands can measure whether verification creates business value and why AI commerce introduces a quite a difficult new question. And that is, how can a business know whether an agent has permission to act? Lots to talk about today. So let me officially introduce you to my guest right now. So thank you for joining me on the show today.
[00:01:46] Can you tell everyone listening a little about who you are and what you do? Of course. Well, thanks so much for having me, Neil. So my name is Sapphire Sammy Uler and I work for Pion. Pion is a verified audience marketing platform. We help brands run and promote offer programs. We help them verify and reach new audiences. And we make sure the whole time they can keep ownership of that customer data and user experience. Pion actually verifies users across 10 different consumer groups.
[00:02:16] So we're quite student-focused. We're probably best known for our student beans brand. But we also verify graduates, key workers and, as I say, many other more. We operate in over 100 countries and we've verified millions of users. So brands can safely run exclusive discounts to drive customer loyalty and grow their businesses. Incredibly cool. A bit about me, I've actually been working in the business for five and a half years now. I've actually worked probably across almost every one of our products from the user-facing marketplace.
[00:02:44] But now actually with a key focus on our verification solutions. So right now I look after fraud prevention as well as the verification methodology itself. So that's how someone actually goes around, proving if they belong to the consumer group that they say they do. I see that, yeah, the verification tech part of the business is quite critical to the growth strategy. We need to be able to support different verification methods for different user groups across different countries.
[00:03:09] So that comes with its own concerns around different regulations and privacy across all those different markets. And it's quite exciting because obviously with the advent of AI in this new world, we are having to ensure we're constantly kind of innovating in this space to stay ahead. 100%. I think with the arrival of AI and more importantly, agentic AI and agents, et cetera, the identities you are going to be assessing might not be human identities too.
[00:03:36] But for people listening, hearing about this for the first time or this topic really, why is digital identity becoming part of an ordinary business infrastructure rather than just a specialist verification function? Yeah, it's a really interesting question. I think digital identity previously used to sit at just one moment in the journey. So that would have been like checkout or maybe account creation. And that would have meant a user would have had to prove who they were to just unlock one specific thing.
[00:04:03] I feel like now businesses are trying to personalize experiences from the very first interaction, right? So they need to understand identity in order to do that. And it becomes a key differentiator for brands as well. They might want different messaging for different consumer groups in our case. They might want different journeys. So it's really important to understand identity from that kind of first point of interaction. I think that means that now like identity verification is not just a narrow specialist team,
[00:04:30] but it's a really like integral part of core infrastructure. It might be something that different departments all rely on. So that could be product, marketing, engineering, all of that. They need to make sure they're joined up and understanding their customers to provide the best products for their companies. I think for our brands, it touches a lot of the commercial decisions that our clients make. So clients might come to us to run a loyalty program. They actually want to understand the user's consumer group identity because they want to drive loyalty for their own products for different eligible users.
[00:04:59] And so that's part of potentially our clients' growth strategies and how they also create trust for the users that are using their services too. For us, I mean, in Pion, we know that brands don't come to us just to like do that sign up compliance check. It's more about understanding the consumer identity so that our clients can know when to target those users, how to price offers, for example. We might boost an offer for certain consumer groups at key seasonal times.
[00:05:27] And as I say, it's a real part of that kind of brand loyalty program. And I think it would be a great idea to bring a, I don't know, a real world example in here. You don't have to mention any names, but I think it would bring to life if you've got an example where better identity data maybe improved a customer experience as well as reducing fraud. Are there any stories or use cases you can share there that would just really bring that to life? Actually, yeah, for sure.
[00:05:51] So a good example is one of the ways we approach giving brands their own branded verification experience. So what happens is a brand can actually use our verification technology on their site so they can embed it. If a user has come to us and maybe they've signed up and verified as a student, let's say, through our own marketplace, we hang on to that verification status of that user, typically for up to a year before that user needs to re-verify with us.
[00:06:17] What happens is if that user then goes to the brand website and actually tries to transact with the brand or maybe wants to sign up and uses that brand's verification technology on their site, what happens is the user can just input their phone number and essentially the brand does a lookup so that we actually can provide that brand the simple label that, yes, this person is verified. It means the user doesn't have to give that brand again all their user information, eligibility criteria, all of that. So it's essentially a database lookup.
[00:06:45] And it means for the user it's a lot easier, it's simpler, it has fewer data points that we're trying to collect every time that user goes through this purchase journey. It also improves the kind of UX. So it's more likely that user is going to then transact on the brand site, so it makes the brands happy themselves. And interestingly, it feels more secure from the user perspective because they're not having to give their data over and over again to different brands as well as ourselves as verification providers.
[00:07:11] So it's kind of a nice benefit of us sort of having this database lookup to provide like a clear frictionless sign-up journey for the users. And it means that the brands themselves have a more improved conversion rate opportunity with that experience as well. What I found really interesting about this is we actually introduced sort of SMS-based multi-factor authentication. And I interviewed a bunch of students before we did this to make sure that that would go down well. And I found that they actually really liked the idea.
[00:07:41] So they told me that actually giving a phone number and having this MFA check made them feel that their data was more secure. It made them trust us more as a verification provider. And they were quite happy. It's quite a common pattern these days, isn't it, having to provide a phone number? So it didn't add the friction that we potentially thought it might. And in the end, it's enabled us to do this sort of database lookup using phone numbers. So it's actually had a win-win for both users and brands. It's incredibly cool.
[00:08:07] And I'm curious, for people listening, especially if we've got leaders listening, are there any business measures that show whether an identity system is creating real value rather than simply adding that additional compliance step? I mean, you went out there and spoke to the students, a great example of proving that actually they wanted it. And it was providing them with value and additional trust. But anything else that you can add to that around what business measures can be put in place? Absolutely. I think there's so many different data points you can look at.
[00:08:35] There's probably a few key ones that I'd look at together, maybe not just as a single number. For us, we look at things like the registration and verification conversion rate, you know, how successful is that sign-up journey? We break this down. We look at kind of different verification methods, success rates. And we look at, you know, how that varies by different channels of sign-up applications and different markets. And obviously, this helps us identify any bugs in our flow, but also how successful our verification services are.
[00:09:01] I think a critical one about understanding the true value that provides is we also look at what we call the activation rate. So that's, in our case, a user who actually goes on to issue their first code within 24 hours of actually verifying with us. So this, for us, helps translate to key business value. So we're not just looking at does the user sign-up? Because realistically, one of our main metrics is actually ensuring users who sign-up with us go ahead and actually issue a discount code. We look at things like the time frame it takes for them to do that.
[00:09:31] So we want them to do this within 24 hours. But we will also analyze, you know, the different cohorts that take longer. We'll analyze how long it takes to verify different users by different methods. So there's quite a few different data points. We'll look at the cost per verification method as well. I mean, some more secure verification methods are unfortunately more expensive, but it's just about balancing out what makes sense based on a brand's appetite for risk, essentially. The fraud rate is an interesting one. So, you know, we do know that certain users who try to sign up may be fraudulent.
[00:10:01] It's very difficult to know if you're blocking someone who's legitimate. It's easier to know if you're blocking someone who then maybe turns out to act suspiciously or suggest behavior that might indicate code misuse, things like that. So we do keep an eye on these sorts of metrics as well. And I think that helps us understand, you know, how well our verification methods are performing. So I think it's a whole combination of using those factors together, not relying just on one signal. But I think the key thing really is about just understanding the downstream impact.
[00:10:29] So that activation rate, you're in theory, we could look at something like transaction rate because that's when, as a brand, we would actually get revenue from our clients that we work with because we work on a commission-based model. However, that is also somewhat out of our control because a lot of that takes place on the brand sites themselves when a user is actually going through a purchase journey. So for us, I think focusing on something like the activation rate when they go from registration through verification into actually issuing a code, that's all within our control.
[00:10:58] And it's something that we can, yeah, keep an eye on and help improve more easily. Also, and I was also, I wanted to bring up, we mentioned AI at the very beginning and AI systems or AI agents are now acting on behalf of people. So what new questions arise when proving who or what is making a request?
[00:11:19] And one of the reasons I wanted to bring this up, I was looking at it on Reddit a few nights ago and there's a subreddit of a guy that had created an agent and he pasted his whole prompt to go out there, scour the whole internet and apply for any free samples that any company is offering. And it was literally going across the internet. This guy was getting 100 items a day coming through the post. So it's showing that there's a different problem arising from this, but I'm curious what you're seeing here. Actually, super interesting.
[00:11:46] I think it's a big question within kind of retail and e-commerce as an industry at the moment. We've got the rise of agentic shopping. Like you say, when an AI agent essentially is acting on behalf of a human to make a purchase decision and actually transact for someone. When I'm looking at fraud prevention at the moment, I'm looking at things like, is this a legitimate user? Are they a bad actor? Maybe they're a bot, signals that I'd rely on, things like device fingerprint, IP, a bunch of different session patterns.
[00:12:14] All of this is built on the assumption that it's still a person at the end of the line making those actions. With agentic shopping, we've now got AI agents actually initiating requests on someone's behalf. So there's a whole new layer. It's not only is this the right person, it's is this agent authorized to actually make this purchase decision on behalf of a user at this moment in time? Which is a whole sort of delegation and consent problem that's very intrinsically linked to proving identity and consumer group.
[00:12:43] I think typically, you know, verification systems are still focusing on the first part of things. You know, is someone actually a human? This agentic shopping delegation question is a big challenge. I'm not sure I have the answer, to be honest. It honestly makes me think of some things we've seen in the news recently. I mean, we've seen different AI hacks going on. We had the hugging face example where OpenAI's agents were completing a task and went about it that wasn't the intention of the users, such as hacking another company.
[00:13:11] In the e-commerce world, you know, brands may actually have a responsibility to ensure that purchase decisions are being made with the right intent, even by AI agents. So sort of digital identity verification checks probably will need to consider this in the future. Again, not sure of the answer. I think we're going to need clear standards for proving kind of delegated authority. There's a few interesting things going on at the moment. I've sort of heard about Visa's trusted agent protocol, which actually is something about agent identity credentials that can be proved.
[00:13:40] So there are kind of things in the industry that are being developed at the moment. For us, as I say, it's a really interesting one because, you know, we may get students who are wanting their AI agents to make purchases, you know, and find the best discount around. We also might want them, the students might want those AI agents to sort of combine their student status with, say, a loyalty card or a discount scheme that they're part of. And brands will need a way to make sure that that agent is, again, acting with the right authorization.
[00:14:08] So, yeah, it's maybe a combination of additional delegation checks, different trusted verification layers. And it's interesting the example you gave because really brands may feel a pressure to actually focus on pricing even more than they do now. You know, if an AI agent is scouring the net for the best deal around, you know, human may not find the right one, whereas actually an AI agent is more likely to. Yeah, 100% with you.
[00:14:33] And what's interesting, I think, is on one side of everything we're talking about here, we've got cutting edge technology, agentic AI shopping. And on the other side, many leaders and organizations listening will have a whole heap of technical debt that they wish would go away. So I'm curious from that side of things, where does fragmented data, legacy systems or differing national rules, how do all these things make identity implementation difficult? Do you have any challenges there? Yeah, it's a really great point.
[00:15:02] I think companies may now need to prioritize addressing tech debt in order to enable AI internally. I mean, there's so much within that. I mean, let's think about implementation across different national rules. So as I say, we've got this sort of SMS-based multifactor authentication that we go through now. SMS compliance varies wildly by market. So every country will have a different kind of SMS sender regulation requirement. It can be very time consuming to go ahead and set up the right sender IDs to make sure that, you know, your text message is going through.
[00:15:31] For us, it's really critical that we are able to manage this because that SMS journey is a key part of our verification process. Rules can change really quickly across different countries as well. I think Spain actually recently this week changed their regulations. So all SMSs must go through this kind of regulation review and they no longer support long code international numbers. So there's a few changes coming up soon. I think it's a quite quickly evolving area.
[00:15:58] So for us, this is, as I say, been quite an interesting one to learn about and go through. We've also got things like the EU wallet. So there's the EU digital identity wallet, which has come out. Member states are actually legally required to offer people at least one government-backed digital ID by the end of this year, which is kind of wild. So it means people will be able to hold digital ID cards and they can combine things like their diplomas, their identity details within one digital ID card. And this can be used across different borders in the EU.
[00:16:29] But it also has an impact on businesses. So businesses will start having to accept this digital ID wallet. And many businesses will have legacy infrastructure that is slow to change, but hard to move. For us, it's an interesting one. And we work, as I say, with lots of different consumer groups, not just students. So we can verify users through the NHS. We verify key workers, first responders, things like that.
[00:16:53] But when we're looking at working with large established organizations, they themselves can be hard to change. So from my side, looking at how we can integrate with them as a sort of database lookup opportunity, for example, there's some natural difficulties when working with slightly legacy systems. And large government bodies in particular. I think the other key thing is about internal data structure. So, you know, AI is only as good as the data hygiene underneath it.
[00:17:23] I think that, like I say, companies will need to start addressing tech debt. Because in order to use AI effectively, you've got to have quite clear systems. You need to have data that is clean and talks to each other. You need to be able to integrate things in a consistent way. You also need consistent processes. You need people training. People need to understand how they're meant to be using AI. And I think all of this is quite critical to be able to use AI effectively as a business.
[00:17:52] So all of that will require this sort of data hygiene and training that does take time. So I think a lot of businesses will be investing in this at the moment. We certainly are. And I think, yeah, overall, there's just there's quite a lot to consider in that whole area. And trying to get legacy systems updated to enable AI is going to be pretty key. Yeah. And speaking of freaky, I think another situation that often comes up is personalization and not drifting into the creepy territory.
[00:18:21] Because very often, as customers, we almost want personalization. We're used to it in everything from Spotify, Netflix to Amazon, et cetera. We're surrounded by it. But it can feel intrusive and creepy if you get it wrong. And many customers want privacy and control instead. So how do you get all these interests reconciled in practice? Is that a daily challenge as well? I actually don't think that those two things are as opposed as they're necessarily framed.
[00:18:49] I think that tension often comes from businesses trying to collect more information than they really need, not necessarily from the fact that they're personalizing their services. I mean, at Pion, our approach is privacy by design. So we will only ask for the least amount of information needed in order to confirm someone's eligibility. I think good internal discipline for any company is asking, like, why do you need this every time a new data field gets added to a flow? For us, we will also signpost that to our users. So, for example, when we're capturing a mobile phone number, we'll always have a little,
[00:19:19] why do we need this kind of little tooltip for our customers when they go through that flow? And consent from users needs to be quite specific. You know, people need to be aware of why this data is being collected, what it's going to be used for. And if you provide that information, they're a lot more comfortable giving their data over there. In our manual version, one thing we do is actually suggest that users redact irrelevant information. So people do submit various different document types, but we always suggest, hey, just redact the information that you think is not relevant.
[00:19:47] We clearly state the key fields we need and users can, yeah, black out, as I say, redact, you know, unnecessary fields. And we're trying to really make users feel at ease and showcase the fact we're not actually trying to collect unnecessary data there. And I think that done well, privacy and personalization work together. So if a business is really clear on what it's holding, why and how long, the users are more likely to trust that business as well and will be more likely to share their information. A bit like what I said earlier around how students were happy to share their phone number with me
[00:20:15] because they felt it actually added a layer of privacy and security. So I think that you can personalize experiences even with like smaller data sets. Sometimes it's easy to get bogged down in really complex personalization algorithms. I'm sure, you know, social media companies will obviously have incredibly complex personalization algorithms, but many businesses don't need that complex personalization. And you can actually provide a really tailored experience with fewer data points.
[00:20:41] And just expanding on some of what we're talking about here and deliver that message, how can identity checks also protect people without excluding customers who might have limited data documentation or all that digital confidence that many have by default online now and they don't have that digital confidence or multiple devices, etc. Anything you can add around that? Yeah, absolutely. I think this is really critical to our world in particular
[00:21:08] because a lot of share of who we verify our students, apprentices, you know, young people who maybe don't have a long credit history. They may not even have a passport or a long digital footprint. Apprentices is a good example because, you know, it's harder to verify an apprentice because they don't have the same kind of institutional database we can just look up to or there's fewer authoritative places we can check against anyway. So I think for companies, yeah, it's important to make sure your verification path
[00:21:35] doesn't just rely on one kind of government-based signal or, you know, one verification method because otherwise you'd be excluding certain groups. For us, I mean, the way we've got around this is to offer multiple legitimate paths to the same kind of verification outcome. You know, we have things like manual verification where a real human actually reviews documents in order to ensure we're not excluding people. So someone like an apprentice can actually provide documentation that we will manually review and make sure would be acceptable and fits our eligibility criteria.
[00:22:03] I think a human can still look at these edge cases in a way that a purely automated system can't. So I think it's really important to make sure that systems are built with this understanding that not everyone has access to the same standardized documentation. There is obviously a trade-off because, you know, certain methods will be more secure than others, but I think it's worth it for businesses to just take that kind of inclusive approach. So for us, as I say, we offer this kind of multi-layered verification approach
[00:22:29] and I think that's, yeah, kind of the best way at the moment of being inclusive. One of the things I try and do every day on this podcast is zoom in on an area that people maybe don't associate with technology or have no idea what goes on when they're clicking on certain websites or being verified. And I, for one, have learned so much today around how you're doing things differently around digital identity
[00:22:52] and bringing audience verification, data ownership and marketing all together on one powerful platform. And for anybody listening that would like to find out more information, go further down this rabbit hole. Where should they go? Yeah, so the best place to visit is wearepion.com. If you're interested in youth marketing too, you can actually download our recent Pion 100 report there, which shows how 16 to 24-year-olds rank the top 100 brands.
[00:23:19] And if you have any questions, please feel free to connect with me directly on LinkedIn. That's Safar Sammy Euler at LinkedIn. Awesome. Well, I'll have links to everything you mentioned, including that research there. And again, for business leaders, you're trusted by, I think, 3,500 plus brands at the moment, connected brands to 10 verified customer groups from over 100 territories. And I know we've got people listening all around the world. So wherever you are listening, please check out the show notes, check out the links and some of that research.
[00:23:46] And it would be great to keep this conversation going. But thank you for bringing it all to life and giving us a sneak peek under the hood at what goes on here. So thank you so much. My pleasure. Thanks, Neil. Appreciate your time. I think Safar left us with a very useful principle today. Collect only the information needed to reach clear verification outcome. Then explain why each field is required.
[00:24:10] And this approach can support personalization without turning every customer interaction into a demand for even more additional data. And it also makes room for people who lack standard documentation by offering several legitimate routes to the same result, including human reviews for unusual cases. So the next test will be harder, though.
[00:24:35] As AI agents search, compare and buy on our behalf, companies must distinguish a person, a bot and an authorized delegate without adding needless friction. But over to you, where should responsibility sit when an agent makes a decision that its owner didn't intend? I know there's a big story at Target earlier this year, the US supermarket.
[00:24:59] They had a big stance saying, if your agent buys something for us automatically and it was an accident, well, that is on you. So I've already started to see a few headlines. So can standards for consent and delegated authority develop quickly enough to keep digital commerce trustworthy? Love to hear your thoughts on this. If you go over to techtalksnetwork.com, there'll be a blog post associated with this episode.
[00:25:24] I'll put links in there how you can get hold of Sapphire and talk about more about anything that we've discussed today. But that is it for today. So big thank you to my guest. Even bigger thank you for each and every one of you for listening. Speak to you again soon. Bye for now.