On October 18, 2026, World made World ID for Zoom available worldwide through the Zoom Marketplace and launched a World ID suite for banks at Money20/20, with Bain Capital, OpenExchange, Outtake, Pantera Capital and VanEck Funds as design partners. A blue "Human Badge" appears on a Zoom tile only after an Orb-enrolled person proves with a live selfie that the account belongs to a real, unique human. Deepfakes have already moved real money, including a $25.6 million wire at Arup, and this is the first time biometric proof of personhood has shipped into mainstream meeting software and been pitched to banks in the same week.
What launched, and why now
The bundle covers three products: the World ID app, World ID for Zoom, and World ID for Agents, which runs on a toolkit called AgentKit. Tools for Humanity CEO Alex Blania unveiled the banking package on stage with Mesh CEO Bam Azizi, per Biometric Update.
Zoom is the distribution story. The partnership was announced in April with VanEck Funds in a limited beta; the integration is now installable by any enterprise admin. Banking is earlier: five design partners, no named bank, and Orb devices planned for partner offices so employees can enroll on site. The commercial context is a funding round, not revenue. The World Foundation raised $52.5 million in July through a one-year locked token sale led by Pantera Capital, and two of those investors are now design partners. World says more than 18 million people hold a Proof of Human across 160 countries; WLD traded near $0.49, about 96% below its high, per CryptoPotato.
Two curves crossed in 2026. Cloudflare Radar data shared by CEO Matthew Prince on June 3 put bots at 57.5% of HTML page requests against 42.5% from humans, the first time automation held the majority, per NBC News. Imperva's 2026 report, counting API calls too, puts automation above 53% of all web traffic in 2025, up from 51%, and says financial services absorbed 24% of bot attacks and 46% of account takeover incidents, per Imperva.
The second curve is the cost of impersonation. In early 2024 an Arup employee in Hong Kong wired about $25.6 million after a video call in which every other participant was a deepfake. FinCEN warned banks in November 2024 that synthetic media was passing identity checks at account opening. Deloitte, cited by World, forecasts $40 billion a year in U.S. AI-enabled fraud losses by 2027, up from $12.3 billion in 2023.
Blania's framing is that agents make this structural. "We would need a proof-of-human, and such a technology would turn out to be kind of the gate for almost any transaction on the internet," he said. JPMorgan and Amazon now block bots outright, and Cloudflare shipped an agent identity tool in August.
How the Human Badge works
Enrollment is a one-time physical event. An Orb photographs eyes and face, derives an iris code, sends the encrypted package to the user's device, and deletes the images. Orbs sit at fixed locations, including the New York Stock Exchange, per World.
At meeting time three things must line up: the Orb record, a live selfie from the World ID app, and the video feed. When they do, the badge appears next to that person's name for everyone in the call. Zoom receives no personal information, and the badge is a yes/no signal, not a data payload. Any participant can request a check mid-call, and hosts will soon be able to require one in the waiting room, per World.
The badge is not mandatory and World does not set policy. That keeps it deployable where most external participants have never enrolled, but it also means the badge is only as useful as the policy behind it.
Three proofs, and a power of attorney for agents
Three credentials come with the banking suite, and they are not interchangeable. Proof of Human requires an Orb visit and establishes uniqueness, one credential per person. Proof of Presence is a phone liveness check with no Orb requirement. Proof of Attributes reads an NFC passport or national ID and proves one fact, such as age, without disclosing the document.
Banks are told to use them for wire approval, account-opening checks, and account recovery that resists takeover, all places where the current control is often a callback to a number that a deepfake plus SIM swap can defeat.
AgentKit adds delegation. A user attaches proofs to an agent, which presents a delegated Proof of Human to a counterparty. Chief Product Officer Tiago Sada compared it to a power of attorney and said each user can delegate to one trusted agent. World's example is an agent shopping mortgage refinancing: each bank can verify a real human stands behind the request without receiving documents.
The plumbing under the badge
The suite runs on World ID 4.0, published for comment in December 2025 and shipped in April 2026. It turns a World ID from one long-lived secret into an account in an on-chain registry that can authorize multiple authenticators, rotate keys, and recover access. Recovery at launch runs through Orb biometrics, a deliberate trade: the convenient path depends on the vendor.
Uniqueness comes from nullifiers, one-time values that let a relying party know an action has not been done twice by the same person without learning who that person is. In 4.0 a distributed network of OPRF nodes run through TACEO computes them: each node holds a Shamir share of the relying party's key, queries arrive blinded, and a threshold must cooperate, so no single node can link or censor a user. The engineering write-up documents the design in public.
Two gaps matter for banks. As of the December 2025 design, authentication, proving the person presenting a credential enrolled it, was listed for World ID 4.1, and issuer revocation was listed as future work. Those may have shipped since, but World's public materials do not say so. A system sold to financial institutions should be judged on the version that is live.
What the badge does not prove
A Human Badge is an attestation about an account, not a verdict about pixels. World says the badge shows the account belongs to the Orb-verified human in the frame, checked by a live selfie at join time. It does not claim to analyze the video stream for synthetic artifacts. Detection asks whether this media is fake. Attestation asks whether this session is bound to a verified person.
The attack surface therefore moves rather than closes. A stolen phone with an unlocked app, a coerced selfie, or a compromised account all sit upstream of the badge. A synthetic video feed next to a legitimately issued badge is a scenario the design does not appear to address, because the badge proves the account holder, not the pixels. The failure mode of a trust badge is that viewers stop asking which claim it makes.
Coverage compounds this. Eighteen million verified humans is about 0.32% of internet users. In a meeting of eight, the odds everyone can produce a badge are low outside a pre-enrolled group. A missing badge is not evidence of fraud, and a present badge is not evidence that the speaker is who you think, only that the account is bound to some verified human.
Signal-based detection is the competing approach. Pindrop's Pulse app for Zoom analyzes audio and video for synthetic artifacts and matches voices passively, with in-meeting alerts, and Pindrop says seven of the top 10 U.S. banks are customers. Reality Defender was named a Market Shaper in Gartner's June 2026 report. Detection catches synthetic media regardless of enrollment and says nothing about takeover; attestation does the reverse. Buying one is buying half a control.
Analysts add a structural critique. Forrester called the Orb ecosystem centralized, of limited use outside Worldcoin cases, and duplicative of liveness checks that identity vendors already sell. A National Defense University paper notes that iris patterns are permanent, that an Orb produces a 12,800-digit iris code, and that a ubiquitous template network raises what it calls biometric sovereignty risk. Sources: Forrester, INSS.
The regulatory record World is carrying into banking
World's enterprise push is happening despite its consumer record. Rest of World documents three years of enforcement: Kenya paused verification in 2023 and a court later ordered deletion; Hong Kong's watchdog, after 10 covert visits, ordered a halt over "unnecessary and excessive" collection; Spain and Germany ordered deletions in 2024; South Korea fined the project about $830,000; Brazil banned it in January 2025 with a daily fine of 50,000 reais, roughly $8,800; Indonesia suspended collection in May 2025; the Philippines ordered a halt in October 2025; Thailand shut down scanning in November 2025.
Snowden's line, that the project is "cataloguing eyeballs," still anchors the privacy case. World answers that iris images never leave the device, that only encrypted fragments reach AMPC nodes, that proofs are zero-knowledge, and that nullifiers prevent correlation. Those are real mitigations. They do not resolve what happens when one company runs enrollment hardware for a credential banks and employers rely on.
The U.S. is looser, which is why the push started there. Roughly 7,000 Orbs ran across six U.S. cities as of April 2025, and state law is less uniform than GDPR. A global bank may run Orbs in New York while its Brazilian consumer business is barred from the same collection. That is a compliance project, not an IT install.
What to watch, and what to do
Four things decide whether this is infrastructure or a press release: whether a named bank goes into production and what its regulator says; whether 4.1 authentication and issuer revocation are live, since a credential without revocation is hard to audit; whether Zoom makes badge checks a default rather than a per-host setting, because opt-in badges do not stop the Arup scenario; and whether World's proposed fees, charged to applications in WLD per proof, survive procurement.
For security teams, the sensible position is additive. A badge is a useful factor for wire authorization and account recovery, where the current control is often a callback to a number that can be spoofed. It does not replace out-of-band verification, dual approval, or synthetic media detection. The Arup transfer did not fail for lack of a badge. It failed because one employee with authority believed a video call, and a badge helps only if someone requires it before the call starts.
World's claim that proof of human becomes "the gate for almost any transaction on the internet" is either obviously true in retrospect or a warning about chokepoints. The test is now running in a meeting link and a wire transfer.
Sources: Biometric Update, World, World engineering, CryptoPotato, Yahoo Finance, Rest of World, Imperva, NBC News, FinCEN, Pindrop, Computerworld.