How to identify higher-risk actions in a digital journey begins with consequence. An action deserves closer attention when it can move value, redirect a payment, change account control, expose sensitive information or produce an outcome that is difficult to reverse.
Understanding how to identify higher-risk actions in a digital journey also requires separating access from activity. Authentication establishes trust when the user enters an application. The level of risk can change later as the user moves from viewing information to changing settings, approving access or directing value somewhere new.
Begin with the outcome of the action
Industry labels are useful, but they are not the best starting point for assessing in-app risk. The same underlying action may appear in several types of application.
Changing a payout account can affect an insurance claim, a medical-aid refund, a property booking or the earnings of a platform worker. Adding an administrator can affect a business application, hospitality account or public-service portal.
Focusing on the outcome makes it easier to identify similar risks across different digital journeys.
Group actions into five practical categories
Actions that move value
These actions release money, credit, loyalty value, refunds or other transferable benefits.
Examples include approving a payment, redeeming loyalty points, drawing down credit or using a stored payment method for a high-value purchase.
Actions that redirect value
These actions change where money or another benefit will be sent.
Examples include replacing payout details, changing a refund account, linking an external wallet or adding a new payment destination.
Actions that change control
These actions affect who can access, administer or recover the account.
Examples include granting another user access, activating an electronic SIM on a new device, changing registered contact details or authorising another administrator.
Actions that expose sensitive information
These actions reveal or export personal, financial, health, customer or operational information.
The risk depends on the sensitivity of the information, the user’s permissions and the consequence of disclosure.
Actions that are difficult to reverse
Some changes create consequences that cannot be corrected easily. A payment may be released, a benefit redirected, a new user granted access or sensitive information exported before the organisation or customer notices.
The harder the outcome is to reverse, the stronger the case for confirming that the authorised person remains behind the interaction.
Compare low-risk and higher-risk moments
The same application can contain very different levels of risk.
A customer may check a booking and later change the account receiving a refund. A medical-aid member may read a statement and later replace the bank details used for reimbursements. A retailer’s customer may view an order and later redeem a large balance of loyalty points.
This comparison helps teams avoid adding unnecessary friction to routine activity while still identifying the actions that deserve greater identity confidence.
Review the controls already in place
Identity assurance should not be assessed in isolation. Organisations may already use passwords, one-time PINs, recognised devices, biometric checks, access permissions, transaction monitoring and fraud investigation.
Each control answers a different question. Authentication helps decide whether access should be granted. Permissions define what the account can do. Transaction monitoring assesses the action. Device controls provide information about the environment.
Additional identity assurance contributes another piece of context: whether the authorised person remains present as the session continues.
Decide where renewed identity confidence adds value
For each higher-risk action, teams can ask:
- What financial, privacy or access consequence could follow?
- Which identity checks took place earlier in the journey?
- How much time or activity may separate login from this action?
- Which existing controls assess the device, behaviour and transaction?
- Would greater confidence in the user’s identity improve the decision?
- What should happen if that confidence cannot be maintained?
The final question is operational as well as technical. The organisation needs a clear response that fits its customer journey, policies and existing fraud controls.
Keep the limits of identity assurance clear
Identity assurance cannot determine whether the authorised user is making a wise decision or acting under manipulation. It does not detect malware, judge a payment destination or replace the investigation of unusual activity.
Its purpose is to strengthen confidence in who is interacting with the application. That signal should be considered alongside other security and fraud information rather than treated as a complete decision on its own.
Extending identity assurance beyond login
Datanamix provides Continuous Facial Recognition with Liveness as part of its identity and verification technology portfolio.
The solution is designed to strengthen existing authentication by extending identity assurance throughout an active digital session. This allows organisations to consider additional identity confidence around selected higher-risk actions while retaining their existing access, device, transaction and fraud controls.
Book a demo with Datanamix to explore the higher-risk moments within your digital journeys.
