Which in-app actions need additional identity assurance? The strongest candidates are actions that can move or redirect value, change who controls an account, expose sensitive information or create a decision that may be difficult to reverse.
A practical way to decide which in-app actions need additional identity assurance is to consider the consequence of the action rather than treating every part of a digital journey alike. Checking a booking or reading a statement is different from changing payout details, authorising another user or redeeming stored value.
Does every action after login need the same assurance?
No. Applying another identity check to every click may add friction without improving the decisions that matter most.
The level of assurance should reflect what the user is trying to do. Low-risk activity may continue under the organisation’s existing session controls, while actions with greater financial, privacy or access consequences may justify renewed identity confidence.
This keeps the approach proportionate. It also allows security, fraud and product teams to focus additional controls on the moments where misuse could have a meaningful effect.
Which actions can move or redirect value?
These actions change where money or another form of value will go. Examples include:
- Replacing the bank account used for an insurance claim, medical-aid refund or property payout
- Linking an external wallet or payment destination
- Redirecting a tenant deposit or guest refund
- Redeeming loyalty points for vouchers, airtime or gift cards
- Approving a high-value purchase using a stored payment method
The account may already be authenticated when the action occurs. The important question is whether the organisation still has enough confidence in the person making the change.
Which actions change account control?
Some actions may not move money immediately, but they can influence who controls the account later.
Examples include changing registered contact information, activating an electronic SIM on another device, granting a new administrator access or authorising another person to act on the account.
These changes can affect future notifications, password recovery, access rights and payment settings. Additional identity assurance may therefore be useful before the change is completed, even when the session began with a valid login.
When does access to sensitive information become a higher-risk action?
Viewing ordinary account information is not always comparable with opening medical records, exporting customer data or accessing formal education and public-service records.
The organisation should consider the sensitivity of the information, the effect of unauthorised disclosure and whether the action gives the user access to information beyond what is normally required.
Identity assurance does not replace permissions, privacy controls or audit records. It can add confidence that the authorised person remains present when sensitive access takes place.
What about approved drivers, couriers and other platform users?
On some platforms, the authenticated profile represents a person who has been approved to perform a specific role.
A ride-hailing driver or courier may log in correctly at the start of a shift. If another person later operates the active profile, the issue extends beyond account access because the platform connects that identity to customers, vehicles, trips and deliveries.
Additional identity assurance during the session can help the platform maintain greater confidence that the approved operator remains the person using the application.
Can additional identity assurance confirm that every action is legitimate?
No. Confirming identity does not establish whether an action is financially sound or whether an authorised user has been deceived, pressured or manipulated.
It also does not detect malware, assess the reputation of a payment destination or replace transaction monitoring and fraud investigation.
The role of identity assurance is narrower: helping the organisation maintain confidence in who is interacting with the application. Other controls remain responsible for assessing the action, device, behaviour and wider fraud risk.
How can organisations decide where to use it?
Start by mapping the actions available after login and asking:
- Can this action move or redirect money, benefits or stored value?
- Can it change who controls the account or receives future notifications?
- Can it expose sensitive personal or business information?
- Can it grant another person or device access?
- Would the action be difficult to reverse?
- Would greater identity confidence improve the decision?
The answers help distinguish ordinary activity from higher-risk moments without applying the same control everywhere.
Where Continuous Facial Recognition with Liveness fits
Continuous Facial Recognition with Liveness is designed to extend identity assurance beyond login while complementing existing authentication, access, transaction and fraud controls.
It can help an organisation maintain greater confidence that the authorised user remains present when a higher-risk action takes place. The organisation still determines which actions require additional assurance and how the wider control environment responds.
Book a demo with Datanamix to discuss where additional identity assurance could support your digital journeys.
