What breaks when organisations rely on two step authentication workarounds instead of direct face comparison?

Two step workarounds can create a brittle process where enrollment and immediate authentication are treated as separate checks, even though they may not validate the same identity event. That can add friction without materially improving assurance. Direct face comparison is more useful when the goal is to verify a live applicant against a known image on file or from an ID authority.

Why Two-Step Workarounds Break Identity Assurance

Two-step workarounds often separate enrollment from the actual face check, so the process can confirm that a person completed two actions without proving that the same live person was present for both. That weakens assurance, especially when the purpose is identity proofing rather than simple account recovery. It can also create a false sense of safety because the workflow looks strict while the underlying check remains easy to route around.

Direct face comparison is designed to bind a live capture to a trusted reference image, which is a different assurance problem from asking someone to pass two sequential checkpoints. When organisations substitute choreography for verification, they may still satisfy a policy step while failing to stop impersonation, replay, or delegated access. For identity-sensitive onboarding, recovery, or remote verification, the question is not whether the user can complete two steps, but whether the evidence actually matches the claimed identity.

In practice, many teams discover this only after a disputed enrolment or recovery event shows that the workflow was stricter on paper than it was in assurance.

How It Works in Practice

A direct face comparison flow usually asks for a live selfie or video frame and compares it against a stored reference, such as an authoritative ID image or a previously verified profile image. The value is not the face scan alone, but the binding between a live presentation and a known identity record. That binding matters most when the risk is impersonation during onboarding, step-up verification, or high-trust account recovery.

Two-step workarounds often try to approximate this with an enrollment step and then a separate confirmation step, but the two checks may be disconnected in time, context, or assurance level. A user might complete the first step on one device, then satisfy the second step later through a channel that does not prove liveness or continuity of presence. If the design does not ensure that both steps verify the same subject, the control becomes procedural rather than evidentiary.

Use direct comparison when the decision depends on whether the current presenter matches a trusted image.
Treat a second step as support, not as a substitute for biometric or document binding.
Preserve device, session, and capture context so the comparison can be evaluated as one identity event.
Escalate to stronger review when the image source, capture quality, or chain of custody is unclear.

Standards-based identity assurance guidance distinguishes between proofing, verification, and authentication, and that distinction is useful here because a process can be secure at one stage while still failing at the stage that matters. NIST SP 800-53 Rev 5 Security and Privacy Controls describes control families that support stronger authentication and auditability, while NHI Mgmt Group highlights how weak lifecycle visibility creates gaps even when access processes appear to be in place. These controls tend to break down when organisations mix recovery, enrollment, and authentication into a single workflow because the evidence requirements become ambiguous.

Common Variations and Edge Cases

Tighter identity checks often increase friction, so organisations have to balance user experience against assurance and fraud resistance. That tradeoff is real, but it should be explicit; if the use case only needs low-risk account access, a lighter workflow may be acceptable, while regulated or high-impact actions justify stronger binding.

There is also no universal standard for when a face comparison must be paired with a second factor versus when it can stand alone. Current guidance suggests the decision should depend on the consequence of failure, the quality of the reference image, and whether the process includes strong liveness and anti-spoofing protections. A workaround is especially weak when the second step can be completed asynchronously, by a different device, or through a channel that does not preserve identity continuity.

If the organisation is relying on the workaround to compensate for poor reference data, manual exception handling, or weak recovery controls, the problem is not the lack of a second step but the lack of a trustworthy identity event. That distinction matters because more process does not automatically mean more assurance.

Risk and Threat Considerations

The main risk is assurance failure: the organisation may believe it has verified identity when it has only verified process completion. That creates exposure to impersonation, recovery abuse, and enrolment fraud, especially where an attacker can exploit weak liveness checks, reused images, or a disconnected second step.

Failure mechanism: Workarounds break when the workflow verifies two actions instead of one continuous identity event, allowing an attacker or impostor to satisfy the process without proving they are the live subject being authorised. If the second step is easy to replay, delegate, or complete out of context, it cannot reliably offset a weak or absent face comparison.

Impact: Unauthorised accounts can be created or recovered, trust decisions can be made on false identity evidence, and downstream access controls inherit a bad initial assurance decision.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA-1 — Identity Management, Authentication and Access Control	Direct face comparison supports stronger identity assurance for access decisions.
Recommendation — Use PR.AA-1 to bind identity proofing evidence to the access decision.
NIST SP 800-63	IAL2 — Identity Assurance Level 2	The question concerns whether the verification method actually proves the claimed identity.
	AAL2 — Authenticator Assurance Level 2	Two-step workarounds can weaken authentication assurance even when they look stronger.
Recommendation — Apply IAL requirements to ensure the presented evidence matches the claimed identity. Require an authenticator that preserves assurance across the full verification flow.
CIS Controls v8	5 — Account Management	Identity workaround failures often surface in onboarding and recovery paths.
	6 — Access Control Management	The core issue is whether the control grants access on trustworthy identity evidence.
Recommendation — Harden account enrollment and recovery paths so weak checks cannot create valid access. Restrict access decisions to identity evidence that meets the required assurance threshold.

Practitioner Guidance

What to verify: Confirm that the control is binding a live presenter to a trusted reference image, not merely checking that two workflow steps were completed. If the evidence does not prove continuity of the same identity event, treat the result as lower assurance.

Decision rule: If the action being protected has material fraud or access consequences, require direct comparison plus liveness and audit evidence; if it is low-impact access, a lighter flow may be acceptable but should be clearly documented as such.

Practitioner takeaway: The useful question is not whether the process has two steps, but whether those steps actually increase confidence in the same identity claim; if they do not, the organisation has added friction without adding meaningful assurance.