“Palestine” is missing from the list..
and its people’s faces are on file in Tel Aviv

Every time a Palestinian user uploads a photograph of their passport or identity card to PayPal, or takes a picture of their face to prove who they are, they may assume that this data will not leave the company’s technical systems beyond what is required to complete the verification. But with new updates taking effect in June 2026, the matter goes well beyond security procedures or regulatory requirements.

These changes, announced by PayPal and already being applied to Palestinian users in the occupied territories and the Gaza Strip, open the door to far more sensitive questions: who processes this data? Who has the right to access it? And what changed once PayPal’s operations in the occupied Palestinian territories moved to a new Israeli legal entity?

The changes the company has begun to apply impose stricter verification procedures on Palestinians, including biometric identity verification — at a time when PayPal’s own documents reveal that part of this process is carried out by an Israeli digital-verification company led by former officers of Israeli military intelligence units, which handles identity documents and personal photographs within the company’s compliance and anti-fraud system.

This investigation traces the threads connecting PayPal to Israeli companies working in cybersecurity and biometric verification, and examines whether the effects of the new updates are confined to Palestinians in the occupied territories — or whether they also raise broader questions about the privacy of millions of Arab users: how their sensitive data is collected and processed, and who stands behind a technical system that has become a compulsory gateway to the digital economy.

In early June 2026, PayPal began a new phase in the restructuring of its operations in the occupied Palestinian territories, paving the way to transfer the running of its services from the Singaporean entity PayPal Pte. Ltd to a newly created subsidiary named PayPal Israel Payment Services Ltd, after applying for a payment service provider licence (PSP Licence) from the Israel Securities Authority.

Under this transfer, PayPal’s operations in the region come directly under Israeli law and regulatory oversight, including the instructions issued by the Israel Securities Authority in November 2024, which require licensed payment companies to apply stricter customer identity verification procedures (KYC).

These procedures include electronic identity verification using official documents and, in some cases, biometric verification by matching a photograph of the face against identity documents.

Although the company has presented these changes as part of regulatory compliance requirements, they may raise digital-rights concerns — not only because verification requirements have been tightened on Palestinians, but also because they deepen PayPal’s ties to the Israeli financial system at a time when the company faces sustained criticism over its policies towards Palestinians in the occupied territories.

But the legal change is only part of the story. As identity verification tightens, another and more consequential question comes into view: who actually processes the personal documents and biometric data that users upload to PayPal? That question leads to a network of digital-verification companies, headed by an Israeli firm that has become a principal partner in the process.

Before turning to the companies that carry out identity verification, PayPal’s own documents and privacy policies reveal that it collects a wide range of data on its users, going beyond the basic information needed to complete payments.

Alongside name, address, email, phone numbers, banking details and transaction history, the platform collects technical data about how the service is used — device type, operating system, internet protocol (IP) address and approximate geographic location — as well as information tied to user behaviour inside the platform and, in some cases, the websites or applications that referred the user to PayPal.

The data above may look much like what many other applications request. But with identity documents and biometric data, the platform gives their owner no way to change, replace or delete them — and the party administering this process on PayPal’s behalf raises questions and concerns about the security of personal information and about who gains access to it, as will be set out below.

When fraud risk is suspected, or when "Know Your Customer" (KYC) requirements are applied, the company asks users to upload official identity documents — a passport, identity card or driving licence — along with a personal photograph or a short video for biometric verification that the face matches the official document.

The privacy policy states that this data is used for regulatory compliance, anti-money-laundering, counter-terrorist-financing and fraud prevention — requirements imposed by regulators in the various countries where the company operates.

These operations, however, are not carried out entirely inside PayPal. The company relies on external service providers specialising in digital identity verification, as its own data-processing documents acknowledge. Among those providers, one Israeli company has come to play a pivotal role in the biometric verification PayPal carries out.

PayPal’s published data-processing documents reveal that the company relies on Au10tix Limited to carry out part of its digital identity verification. Au10tix is an Israeli company specialising in biometric verification, data extraction from official documents, and the detection of forgery and fraud.

Its services include reading data automatically from passports, identity cards and driving licences, then matching the personal photograph or "selfie" against the official document using facial-recognition technology and liveness detection — a step intended to confirm that the person being verified is physically present, rather than using a still image or a forged identity.

According to PayPal’s documents, these services are used within compliance and risk-management procedures — meaning that a user asked to verify their identity may have their data and documents pass through Au10tix’s systems to complete the process.

What draws privacy researchers to this arrangement is not only the nature of the technology, but the identity of the company itself, the background of its founders and senior officials, and its record in handling sensitive data — factors that have led a number of researchers to question the level of governance and oversight applied to the biometric data processed through this system.

According to research carried out by Arabic Post, Au10tix is not merely a start-up in digital verification: its roots extend into a network of Israeli security companies, and it is led by former officials, some of them linked to Israeli military intelligence units — which opens the door to broader questions about the nature of this system and the relationships behind it.

Au10tix matters not only as a technical provider of identity-verification services, but because of who founded it and the corporate network it emerged from.

The company was founded by Ron Atzmon, whose published professional profile refers to prior military service, while specialist media reports have linked his name to Unit 8200 of Israeli military intelligence — the unit known for developing electronic-intelligence and cyber-warfare capabilities, and from which a large number of Israel’s technology and cybersecurity founders have emerged.

Tracing the company’s corporate record shows that Au10tix did not emerge in isolation from this environment. It is one of the companies that came out of the ICTS International group — a security firm founded by Menachem Atzmon, the father of Au10tix’s founder, in cooperation with former officials of Israel’s internal security service (Shin Bet) and former security officials of the Israeli airline El Al, with the aim of marketing Israeli security expertise in protecting airports and infrastructure around the world.

Over the past two decades Au10tix has moved from verifying travel documents to becoming one of the world’s leading biometric-verification providers, with a client list that includes major technology and digital-services companies — among them X (formerly Twitter), TikTok, Uber, Coinbase and LinkedIn, alongside PayPal.

This record is not in itself evidence of data misuse, but it explains part of the attention paid to the company’s role in processing biometric data — particularly given its ties to an Israeli security and intelligence environment, and the reliance of major financial platforms on it to verify the identities of millions of users.

Alongside the company’s corporate background, its security record stands out as one of the main reasons for the controversy surrounding its role in running identity verification.

Between December 2022 and June 2024, Au10tix suffered a cyber breach caused by malware infecting the machine of one of its operations managers, leaking employee credentials via Telegram.

According to investigations disclosed later, the breach opened access to systems holding identity documents, passport images and users’ biometric data. Specialist reports also indicated that some of the data remained at risk even after the company announced that the incident had been contained.

In February 2026, a report published by MintPress News raised further questions after it carried accounts from users on X who said their real names had begun appearing in searches from inside Israel shortly after they uploaded their documents to Au10tix’s system to verify their accounts.

While these observations are not conclusive evidence of a leak from inside the company, they prompted information-security researchers to call for greater transparency about how biometric verification data is managed.

Nor is the record of security incidents confined to Au10tix. PayPal itself has faced a number of incidents in recent years relating to the protection of user data.

In December 2022, the company suffered a cyberattack that breached some 35,000 accounts using login credentials leaked from other services, exposing personal information including names, addresses, social security numbers and dates of birth.

The case ended in January 2025 with a settlement with the New York State Department of Financial Services, under which PayPal paid two million dollars after being accused of failing to meet certain cybersecurity requirements.

In February 2026 the company also disclosed a separate incident caused by a coding error in its PayPal Working Capital service, which exposed some customers’ data — including names, phone numbers, dates of birth and social security numbers — for close to six months.

However different these incidents may be in nature, their recurrence — together with PayPal’s reliance on outside companies to process identity verification — brings back a fundamental question: how far can global financial platforms guarantee the security of the biometric data that has become an essential part of their services?

The controversy around PayPal is not confined to how it collects data or to the companies that carry out identity verification. It extends to the nature of the service the company provides in the occupied Palestinian territories — a service that has for years drawn criticism from human-rights organisations and Western politicians who accuse it of discriminating between Palestinians and Israeli settlers.

When opening a new account, the platform offers no "Palestine" option in its list of countries — forcing Palestinians living in East Jerusalem, or those holding Israeli documents, to register their accounts as residents of "Israel" if they want access to certain services.

By contrast, PayPal makes its services available to Israeli settlers living in West Bank settlements, even though those settlements are considered illegal under international law.

The policy has drawn criticism inside the United States itself: eleven members of Congress sent a letter to PayPal’s management arguing that the company’s continued provision of services to Israeli settlers, while denying Palestinians equal access to the digital economy, raises concerns of discrimination and the violation of economic rights.

The company has offered no detailed explanation for the policy, noting on previous occasions only that the operating environment in the Palestinian territories is "high risk" — a justification that has not convinced its critics, who point out that PayPal continues to operate in markets and countries experiencing armed conflict or more complex security conditions.

As the new identity-verification updates take effect, rights advocates fear these procedures will become a further obstacle for Palestinians, if continued use of the service is tied to verification requirements that not all users can satisfy, or that demand documents many of them do not hold.

Although the recent regulatory updates target PayPal’s operations in the occupied Palestinian territories, the questions this investigation raises do not stop at that region’s geographic borders.

PayPal’s policies for collecting personal and financial data, and the identity-verification procedures it applies, are used to varying degrees on its users worldwide — including in the Arab countries where the company operates.

When a user is asked to verify their identity, the process may involve uploading official documents and a photograph of their face — data that, according to the company’s own documents, may be processed by external providers specialising in digital verification, among them the Israeli company Au10tix.

This does not mean that all PayPal users’ data is transferred to an Israeli company, or that such data automatically becomes available to any government body. But the platform’s reliance on an Israeli provider for part of its biometric verification raises, according to digital-privacy experts, questions about data governance, about who processes it, and about the legal safeguards governing its use and protection — particularly where biometric data and identity documents are concerned, which their owners can hardly change or replace if they are ever breached.

These concerns are growing as the world becomes more dependent on biometric verification in financial services. The debate is no longer confined to how effective these systems are at combating fraud; it now extends to sovereignty over sensitive data, transparency in choosing the companies that process it, and the oversight imposed on them.

In this context, the PayPal case raises a question that concerns not only Palestinians. It opens a wider debate about the future of digital privacy for millions of Arab users who rely on global financial platforms for their daily transactions — many of them without knowing how their data is processed, or which parties take part in that process.