How should organisations scale identity verification when more services move online during a crisis?

Organisations should treat identity verification as core infrastructure, not a back-office control. When demand shifts online quickly, the practical test is whether authentication can stay usable, secure, and resilient at scale. Teams should prioritise frictionless verification for high-risk journeys, align it with customer trust, and avoid relying on passwords alone when usage, fraud pressure, and attack volume all rise together.

Why identity verification becomes infrastructure during a crisis

When more services move online at once, identity verification stops being a niche onboarding step and becomes part of the service layer itself. Organisations need assurance that new and returning users can be verified quickly enough to keep demand flowing, while still resisting fraud, account takeover, and synthetic identity abuse. The right model is one that can absorb sudden volume without collapsing into manual queues or weak fallback checks.

The practical issue is not only volume, but assurance under pressure. A system that works in calm conditions can fail when traffic spikes, staff are remote, and adversaries exploit urgency. That is why modern identity programmes increasingly treat verification as a controlled trust decision, not a one-time formality, and why guidance such as NIST SP 800-63 Digital Identity Guidelines remains useful when designing scalable assurance levels.

Organisations that rely on passwords alone usually find that scale makes their weakest assumptions visible. As more interactions shift online, the verification layer has to support both access and trust decisions across the full customer journey, not just account creation or password reset.

What scalable identity verification has to handle

Scalable identity verification needs to do more than confirm that a person can enter a code or answer a knowledge question. It has to balance assurance, usability, and resilience across onboarding, re-authentication, step-up checks, and exception handling. In a crisis, the goal is to keep high-volume journeys moving while applying stronger checks only where the risk justifies it.

That means segmenting journeys by risk. Low-friction verification may be appropriate for routine access, while high-risk actions such as changing payout details, opening an account, or recovering access should trigger stronger proofing. For customer-facing services, that typically means combining document checks, liveness tests, device or session signals, and policy-based step-up controls rather than leaning on a single control path. The Identity Proofing and KYC Guide and Identity Verification Buyer’s Guide are both relevant to that operating model.

Scale also changes the failure modes. If verification depends on a single channel, a single vendor, or a manual review queue, the organisation can end up trading fraud risk for availability risk. A resilient design gives the business multiple assurance paths, clear escalation rules, and measurable fallback capacity so the verification function does not become the bottleneck.

How to keep trust high while demand and fraud pressure rise

The most important design choice is to align assurance with the decision being made. Not every interaction needs the same level of identity evidence, but every interaction that changes financial, contractual, or privileged state needs a defensible level of confidence. For that reason, identity verification should be designed as a portfolio of controls, not a single gate.

Practically, teams should prefer frictionless methods for routine access and reserve stronger verification for high-risk moments. That can include step-up authentication, document and biometric proofing, or trusted recovery paths that are harder to social-engineer. Because crisis conditions often increase both genuine demand and malicious attempts, the verification service should also be monitored as an abuse surface, not just a customer convenience feature. The NIST AI Risk Management Framework is not an identity standard, but its emphasis on governance, measurement, and controlled deployment is useful when verification increasingly depends on automated scoring or decision support.

Where organisations serve regulated customers, trust also depends on legal and regulatory alignment. Cross-border identity and trust services may be shaped by eIDAS 2.0, the EU Digital Identity Framework, while onboarding and beneficial ownership checks often map to FATF Recommendations for AML and KYC. Those requirements matter because they set the minimum evidentiary bar for trust decisions, even when service demand is surging.

Risk and Threat Considerations

When identity verification is rushed, the main risk is not simply operational overload, it is trust degradation. Attackers benefit when organisations shorten proofing steps, accept weaker evidence, or create broad fallback processes that are easier to abuse than the primary path. High-volume remote onboarding also increases exposure to synthetic identities, injected video, replayed images, and account recovery fraud.

Failure mechanism: Verification capacity becomes the constraint, so teams either queue legitimate users for too long or weaken checks to keep conversion moving. That creates openings for fraudsters to blend into legitimate demand spikes and for compromised accounts to be recovered through weak exception handling.

Impact: The result can be account opening fraud, unauthorized access, higher chargeback and support cost, and lasting damage to customer confidence. In regulated environments, weak proofing can also create audit and compliance exposure if the organisation cannot show that assurance decisions were proportionate to the risk.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-63 and NIST SP 800-53 Rev 5 set the technical controls, while EU AI Act and ISO/IEC 42001:2023 define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-63	Digital Identity Guidelines	Covers assurance levels and scalable authentication for online identity verification.
Recommendation — Map journeys to assurance levels and step up verification for higher-risk actions.
EU AI Act	EU AI Act regulatory framework	Applies when automated identity decisions materially affect regulated online services.
Recommendation — Document automated verification governance and keep human oversight for high-impact exceptions.
ISO/IEC 42001:2023	AI Management System	Relevant when identity verification uses automated scoring or AI-assisted decisioning.
Recommendation — Put governance, monitoring, and review around AI-assisted verification decisions.
NIST SP 800-53 Rev 5	IA-8 — Identification and Authentication (Non-Organizational Users)	Directly addresses external-user authentication in scalable online services.
Recommendation — Apply IA-8 to prove external users before granting access or account changes.

Practitioner Guidance

What to prioritise: Define which journeys need strong identity evidence now, before crisis traffic forces ad hoc decisions. The most important distinction is between routine access and state-changing actions, because they should not share the same verification path.

What to verify: Test whether the verification flow can sustain peak demand without collapsing into manual review or one-size-fits-all fallback. If the process cannot absorb a surge while preserving assurance, it is not yet infrastructure, it is still a bottleneck.

Decision rule: If the action changes money, account control, or recovery authority, require stronger proofing than the login flow uses. If the action is low risk and high volume, optimise for speed and low abandonment, but keep monitoring for abuse and anomaly patterns.

What practitioners underestimate: The crisis condition itself changes attacker behaviour. A verification design that looks acceptable in normal load may become materially unsafe when operations, support, and fraud teams are all under pressure at the same time.

Practitioner takeaway: Scale identity verification by separating user experience from assurance depth, so the organisation can keep online services usable without turning urgency into a fraud shortcut.