A conservative 2 Factor Proof of Identity

https://www.bing.com/search?q=swift%20transaction%20bank
We can improve on proof of identity without adopting a digital ID by using 2 Factor Authentication - where our ISP or phone company uses our PIN and either a phone SMS Text, or Google Authenticator if preferred, to authenticate phone based transactions.

skywatchtv.com /2022/11/03/bill-gates-global-digital-id/ A global ID can be better improved on or rendered harmless if these things are fully implemented, to include world economic forum agenda 21/25/30 without becoming the mark of the beast. Initially the digital ID may not be that MoTB but it paves the way for it - like no other agenda, (as super or quantum computer AI gains hold of society and fakeface etc become the norm).
We need an Android (and iOS) App to allow phone based financial transactions using PIN and TOTP. Like for Kiwibank & PBtech & Z petrol station, the App would connect through 4/5G or WiFi to the phone company website/s to establish Proof of Identity.

The website or App customer setup or login (possibly cached on user's phone) will use a phone company/ISP username and password or PIN/(like for online banking and cards), then TOTP to perform authentication, using installed PAM module/s. Once authenticated, (like with phone company or Internet Service Provider ISP eg Spark), a customer will have access to their account, where they have/will entered their payment bank account details, delivery address, contact details, (in the phone company database with 2factor info - like for Spark), and customer help. The database index won't be a global identifier like done for the Real_ID/RealMe, only an ISP/phone company Index# customer number - like for Spark.

We avoid a centralized ID website (except to float concepts, not implement them), as that would require a unique ID still. Phone company 2 factor authentication is only unique within that phone company/ISP, so is decentralized not global(centralized).

A smartphone can be purchased for NZD$139 now
thewarehouse.co.nz /p/2degrees-alcatel-1b-2022-bundle-blue/R2833129.html

To extensively field test Google Authenticator - to be fit for purpose in proof of identity for covid; and for eftpos transactions in the longer term.
To field test 2FA phone companies/ISPs require us to setup WHM and Cpanel - from cpanel.net, WikID RADIUS server. The total project, with eftpos, could need a dedicated specialized webserver team, to achieve production quality within a desired time frame, and to oversee ongoing public usage.

We could contract, for a time, security pro/s to try and break the pilot system - found through grc.com or Usenet google chat groups.

The smoothwall or ipcop whitelist will limit access to the webservers by authorized ISPs known in a country.

Codes will have limited one time entry and then be locked out for a required delay period - between successive entries.

It's easy to prevent super computers from flooding the system, using distributed server farms, in authorized countries, which could limit DDOS attacks, because it will include recaptcha (already used to thwart bots) and a short delay period for successive entries. Supercomputer code breaking relies on brute force, only when trillions of attempts can be made per second, on one target site. But with those security measures that's no longer possible, because an operation can only be attempted once every 5-10 seconds and can't break internationally distributed server farms - (the same as for youtube and search engines). Once, not 1 x10exp15 per second - for petaflop computers.
https://youtu.be/XPYaSBqFy74