Proof of Human: What World ID for Agents and Verified Zoom Calls Mean for Your Business

On 18 October World, the biometric identity company co-founded by Sam Altman, announced World ID for Agents, a service that lets banks and online platforms check whether an AI agent is acting on behalf of a real, verified person. A day later, World ID for Zoom reached general availability, putting a verified-human badge next to people's faces in video meetings.

The two launches answer the same problem from different directions. AI agents are starting to browse, compare and pay on behalf of customers, while deepfakes have become good enough to fool experienced employees on a live call. Businesses are left with two questions they never had to ask before: is this customer a real person at all, and is the person on my screen really who they appear to be?

In this article we look at what World actually launched, how proof of human works in practice, and what the shift towards verified identity means for companies that run websites, online stores and client-facing teams. Let's sink in!

What World actually announced

World ID for Agents, announced on 18 October 2026, is what the company calls its first industry-specific push. The initial version is aimed at banking and finance, and it allows an institution to confirm that an AI agent handling a payment or a purchase was authorised by a verified human rather than spun up by a fraud script. The underlying tool, AgentKit, is currently in beta.

The second piece is World ID for Zoom, now generally available in the Zoom App Marketplace. Meeting participants who completed a one-time verification can confirm their identity with a live selfie before or during a call, and the rest of the meeting then sees a badge next to their video feed. Organisations can require the check for sensitive meetings and decide themselves when it applies.

Behind both products sits the World ID app, available in more than 150 countries, which manages what the company calls Proofs of Human, Presence and Attributes. The idea is that a person verifies once and then reuses those proofs across services, without creating a new identity check for every product they touch.

How proof of human works

The strongest form of verification runs through the Orb, World's iris-scanning device. The scan produces an encrypted record that proves a person is unique and real, and the company says it does not keep a conventional database of readable biometric identities. Lighter options exist too, including government document checks and selfie-based presence checks, so not every proof requires a visit to an Orb.

For Zoom the flow is simple. A person verifies once, then confirms with a live selfie when a meeting requires it. The badge tells everyone else on the call that the face they see belongs to a verified human, not a generated one. Enterprises can even have an Orb installed onsite, although that is unlikely to be cheap.

World's argument for this design is worth noting. Deepfake detection, the company says, is an arms race that detectors will keep losing as generators improve, so it chose to verify the human instead and sidestep the race entirely. Microsoft is taking the opposite route and adding third-party deepfake detection to Teams, which means the market is currently testing both approaches at once.

World ID for Agents and the delegation problem

The more forward-looking part of the announcement is delegation. With AgentKit, a verified person can pass World ID Proofs to an AI agent. The agent can then present those proofs to a website or financial service, which confirms that a real, identified human stands behind it, without the person's name or personal details being exposed.

This matters because the web is currently blunt about bots. Many sites block automated traffic wholesale, which was reasonable when bots meant scrapers and spam. Agentic commerce changes the picture: TikTok, Stripe, Shopify and others are already building flows where an assistant completes the purchase. An agent carrying a delegation proof is a paying customer; an agent without one might be anything.

Consumer behaviour backs up the need for a trust layer. Research by PYMNTS Intelligence and Visa found that 56 percent of consumers would let an agent search and compare products, but only 35 percent would hand over saved payment credentials. People like the convenience and do not yet trust the plumbing. Verifiable delegation is one of the few concrete proposals for closing that gap.

Deepfakes stopped being a novelty

The scale of the problem is easy to underestimate. In a Gartner survey, 36 percent of senior cybersecurity leaders said their organisation had at least one deepfake incident during a video call in the past 12 months. That is no longer an exotic attack. It is a Tuesday.

The reference case is from 2024, when an employee of a multinational transferred 25.6 million dollars after a video call in which every other participant, including the chief financial officer, was a deepfake. The employee had doubts, joined the call to check, saw familiar faces and proceeded. Every step of the process worked as designed, and the design was no longer enough.

Since then the tools have become cheaper and faster, and the targets have widened from large corporations to any company where one person can authorise a payment. A badge on a video call does not solve social engineering as such, but it removes the specific trick of borrowing someone's face.

Why banking and finance go first

World named Bain Capital, OpenExchange, Outtake, Pantera Capital and VanEck Funds among its early financial partners, though no retail bank has publicly signed up yet. Finance is the natural starting point: money moves quickly, mistakes are often irreversible, and institutions already spend heavily on knowing who their customers are.

The weakness of traditional KYC is that it happens at onboarding. A bank may thoroughly verify who opens the account, yet every later interaction relies on passwords, devices and phone calls, which is exactly where deepfakes and stolen credentials operate. Continuous, lightweight proof of human at the moment of a transaction is a different security model.

Add agents to this picture and the stakes rise further. If customers begin sending AI assistants to move money, banks need a way to tell an authorised assistant from an automated attack, and to know which human answers for each action. That is precisely the gap World ID for Agents is built for.

What this means for businesses building digital products

You do not need an Orb in your office to act on this. The first practical step is procedural: agree on how high-risk requests such as payments and account changes get confirmed, and never let a video call alone be sufficient authority. A call-back on a known number costs nothing and defeats the 25.6-million-dollar scenario outright.

If your business runs sensitive meetings over Zoom, client onboarding in finance or legal work for example, the verification app is available in the marketplace today. It is an easy, visible signal of seriousness for clients, and it needs no custom development.

For companies running websites and online stores, the bigger task is to revisit the bot policy. Blanket-blocking automated traffic may soon mean blocking the agents of your best customers. It is worth watching how delegation proofs develop and designing checkout, forms and APIs so that a legitimate, verifiable agent can be let in later without rebuilding everything.

Finally, resist the temptation to collect biometrics yourself. Verification is becoming a specialised service precisely because storing iris scans or face data carries regulatory and reputational risk that most businesses should not touch. Consume proofs, do not hoard the raw material.

Final notes

Proof of human is heading the same way SSL certificates once went, from an exotic extra to an assumed part of doing business online. Whether World's iris-scanning approach becomes the standard or just one option among several, the direction is set by the problem itself, because both deepfakes and agents will only get more common.

For most businesses the sensible position is prepared, not pioneering. Tighten payment confirmation procedures now, keep an eye on agent verification standards, and treat verified identity as a feature your customers will shortly start expecting. The companies that think about it a year early will find the transition boring, which is the best outcome security work can have.