Routine and consequential digital actions should not always rely on identical checks. The answer to ‘Should Every Digital Action Require the Same Identity Check?’ is no. The appropriate level of assurance depends on what the action allows the user to do and what could happen if the wrong person completes it.
Considering ‘Should Every Digital Action Require the Same Identity Check?’ helps organisations avoid two poor outcomes: adding friction to low-risk activity or relying on too little assurance when money, information or account control is at stake.
The consequence of the action matters
Viewing an account balance, reading a statement or checking a delivery status usually carries a different consequence from transferring funds, changing payout details or approving access to another device. Treating these actions as equivalent can make a digital journey either unnecessarily difficult or insufficiently protected.
Login establishes a starting point
Passwords, one-time PINs, recognised devices and biometric checks can help establish who is entering an application. These controls remain important. The difficulty is that an authenticated session may continue for some time, while more consequential actions occur later.
Identity assurance can follow the level of risk
A risk-based approach begins by identifying the actions that can move money, redirect value, expose sensitive information or change who controls an account. An organisation can then decide which controls should apply to each action instead of repeating the same process across the entire journey.
Where Continuous Facial Recognition with Liveness may help
Continuous Facial Recognition with Liveness can help an organisation maintain greater confidence that the authorised user remains present during an active session. It can add assurance around selected actions while working alongside existing authentication, device and fraud controls.
The Datanamix article on how Continuous Facial Recognition with Liveness can support fraud prevention explains why identity assurance can continue after the opening authentication event.
More checking is not always better
Additional assurance should have a defined purpose. An organisation should consider the consequence of the action, the customer experience, the limitations of the technology and the response when the user cannot be verified. Lower-risk activity may not justify the same intervention as a payment or account-control change.
Existing fraud controls still have separate roles
Identity assurance does not determine whether a transaction is legitimate or whether a customer has been manipulated. Transaction monitoring, device security, behavioural analysis, payment controls, customer education and fraud-response processes remain necessary because they answer different questions.
Match assurance to the decision
The practical starting point is to map the actions available after login and identify those with the greatest financial, privacy or access consequence. This gives the organisation a clearer basis for deciding where continued identity assurance may add value.
Contact Datanamix to discuss where Continuous Facial Recognition with Liveness may complement your existing controls.
