TL;DR: AI is making phishing, impersonation and payment fraud more scalable, while digital identity controls such as qualified electronic signatures and verified credentials are being pulled into the centre of transaction security, according to GlobalSign. The governance shift is clear: identity proofing and cryptographic assurance now sit alongside fraud prevention, not after it.
At a glance
What this is: GlobalSign argues that digital identity verification is no longer just a formality, because AI-driven fraud and payment deception now make identity assurance part of transaction security.
Why it matters: For IAM, fraud, and identity verification teams, the implication is that proofing, signatures, and cryptographic trust controls need to be designed as operational fraud barriers, not only as onboarding checks.
By the numbers:
- In the UK, online shopping rose from 40% of the population in 2020 to 75% in 2022.
- Europe accounted for 26% of global fraud cases in 2023.
- The United States represented 42% of global fraud despite a smaller population.
Context
Digital identity verification is the governance layer that proves who is participating in a transaction, not just who can create an account. In this article, that function is pulled into fraud control because AI-assisted impersonation, phishing, and payment deception now exploit weak identity assurance at the point of trust.
The article’s core security message is that cryptographic identity controls now sit inside the fraud stack. That matters to IAM, identity verification, and payment security teams because verified credentials, qualified electronic signatures, and trusted identity issuance are becoming control points for both compliance and abuse prevention.
Key questions
A: Organisations should use cryptographic verification to confirm a user, device, or entity without depending on fragile assumptions or exposed personal data. The practical goal is to reduce fraud and account takeover while preserving a smooth customer journey. Strong verification works best when it is reusable across channels, tied to clear trust signals, and paired with controls that limit unnecessary data handling.
Q: Why do qualified electronic signatures matter in fraud prevention?
A: Qualified electronic signatures matter because they create a legally recognised link between a trusted identity and the transaction itself. That reduces the chance that a fraudster can impersonate authority, dispute an approval, or use a weak signature process to bypass controls. They are most useful where the business impact of fraud is high.
Q: What are the signs that an identity proofing process is too weak for high-risk interactions?
A: A weak process usually shows up when organisations depend on basic PII matching, ask the same identity questions at every step, and cannot distinguish a genuine user from someone using stolen details. High abandonment can also signal poor design if security demands are heavy but the workflow still fails to detect fraud or abnormal activity.
Q: Should organisations prioritise cryptographic trust controls over manual fraud checks?
A: They should prioritise cryptographic trust controls for high-value and high-risk workflows, then use manual review as a backstop. Manual checks are too slow and too easy to bypass when impersonation is the main threat. Cryptographic assurance scales better because it validates identity and transaction integrity before execution.
Technical breakdown
Why identity proofing now sits inside fraud control
Identity proofing used to be treated as an onboarding step that happened before real risk began. That model breaks down when attackers can use AI to imitate executives, automate phishing, and move across digital channels at scale. In that environment, the trust decision is not only whether a person or organisation exists, but whether a transaction should be accepted at all. Verified identity becomes part of the control path for payments, signatures, and document exchange, because fraud now often depends on defeating trust rather than defeating systems.
Practical implication: Treat identity verification as a live transaction control and not a one-time enrollment activity.
How qualified electronic signatures change transaction assurance
A qualified electronic signature is more than an image of a handwritten signature. It is a legally recognised electronic signature backed by a trusted identity and cryptographic assurance, which gives the signature evidential weight in high-risk transactions. That makes it useful where the business needs both non-repudiation and a stronger link between the signer and the action taken. The practical effect is that verification, trust issuance, and signature generation are merged into one control surface, which is much harder for fraudsters to spoof than a simple approval workflow.
Practical implication: Use stronger signature assurance where the business impact of impersonation or disputed approval is high.
Why digital wallets and machine-readable credentials matter
Digital identity wallets reduce how much personal data must be shared during a transaction while preserving a verifiable trust chain. Machine-readable credentials also let systems validate identity automatically, which is important where payment, invoicing, or document workflows need to scale without sacrificing assurance. The architecture shifts the burden from manual review to cryptographic validation, but only if issuers, relying parties, and trust frameworks are aligned. Without that alignment, the wallet becomes another data container rather than a usable fraud control.
Practical implication: Design wallet-based identity flows around verifier trust and credential interoperability, not just user convenience.
NHI Mgmt Group analysis
Digital identity has crossed into fraud operations: this article shows that identity verification is no longer a front-door admin task but a live control in the fraud path. When AI can scale impersonation, the security value of identity proofing is measured at transaction time, not enrollment time. That makes identity assurance a fraud-detection and fraud-prevention concern for IAM, payments, and trust teams alike.
Qualified electronic signatures create a higher-assurance trust boundary: the real value of QES is not documentation convenience but stronger evidentiary linkage between signer, credential, and action. That matters because many fraud schemes succeed by creating ambiguity about who approved what. Practitioners should treat QES as a governance mechanism that reduces disputed authority, not as a paperless workflow feature.
Verification trust gap: the article exposes the gap between a credential that identifies someone and a process that confirms the legitimacy of a transaction. AI-assisted fraud thrives in that gap because the human verifier often assumes identity proofing and intent are the same thing. They are not. The practitioner conclusion is that transaction acceptance needs its own trust signal, separate from simple login assurance.
Digital identity wallets will only matter if relying parties trust the issuance chain: storing credentials in a wallet does not create security by itself. The control value comes from issuer trust, verifier policy, and consistent cryptographic validation across jurisdictions and use cases. That means identity and fraud teams need shared governance, not isolated wallet projects.
What this signals
Digital identity verification is becoming a fraud control. For practitioners, that means the governance question is no longer whether a user was enrolled correctly, but whether the business can trust the transaction they are asking to complete. Identity, payments, and fraud teams need a shared decision model for when a credential is strong enough to authorise value transfer.
Verification trust gap: the hardest problem is not identifying a person, but proving that the action they request is legitimate. AI-enabled impersonation widens that gap because social engineering can now mimic authority faster than manual review can respond. The practical response is to move trust checks closer to execution and make them cryptographically verifiable.
Digital identity wallets and qualified signatures will only improve governance if relying parties define what counts as acceptable proof. Without clear policy on issuers, assurance levels, and transaction thresholds, the technology simply shifts the burden rather than removing the risk.
For practitioners
- Reclassify identity verification as a transaction control Map verification steps to payment approval, document signing, and high-value workflow triggers so the control exists at the point of fraud opportunity, not just onboarding.
- Require stronger assurance for high-risk approvals Use qualified electronic signatures or equivalent cryptographic proof where impersonation or delegated authority could create material financial loss.
- Separate login assurance from transaction legitimacy Add policy checks that verify the request, not only the authenticated user, before executing transfers or accepting binding approvals.
- Align wallet acceptance with verifier policy Define which issuers, credential types, and proof levels your business will trust before enabling digital wallet based identity flows.
Key takeaways
- AI-assisted fraud is pushing digital identity verification into the fraud control stack, not leaving it as a back-office onboarding step.
- The article’s evidence shows that online transaction growth and cross-border fraud scale have made impersonation and payment deception a material operational risk.
- Practitioners should align identity proofing, qualified signatures, and transaction policy so that trust is enforced at approval time, not after the fact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST CSF 2.0 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on proving identity before a transaction can be trusted. |
| SP 800-63C — Federation | Digital wallets and trusted credentials depend on reliable assertion and verifier trust. | |
| Recommendation — Strengthen identity proofing for high-risk transactions and bind assurance level to the value being transferred. Define which federated assertions and credential issuers your relying parties will accept. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article treats transaction approval as an authorisation decision, not just a login event. |
| PR.DS-10 — Data-in-transit is protected | The article relies on cryptographic protection of identity and transaction data during exchange. | |
| Recommendation — Align authorisation decisions with transaction policy so access does not automatically equal approval. Protect identity assertions and payment data in transit with cryptographic controls and trusted channels. | ||
| GDPR | Art.32 — Security of Processing | Digital identity systems process personal data and need appropriate security of processing. |
| Recommendation — Apply security of processing measures proportionate to the identity data and fraud risk involved. | ||
Key terms
- Digital Identity Check: A Digital Identity Check is a remote identity verification process that uses digital evidence, automated validation, and device-based proofing instead of paper document handling. In recruitment and vetting, it helps confirm a person’s identity quickly while reducing manual admin, improving consistency, and limiting unnecessary data sharing.
- Qualified Electronic Signature: A higher-assurance signature backed by certificate-based identity and trust service provider controls. It is used where legal recognition and stronger evidentiary value are required, especially in cross-border or regulated workflows where the identity chain must remain defensible.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Trust Service Provider: A Trust Service Provider is an organization that issues, validates, or manages digital trust services used to establish confidence in identities, transactions, or communications. In practice, it may provide certificates, signatures, identity verification, or trust frameworks that support authentication, non-repudiation, and policy enforcement across systems and regulated workflows.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, identity lifecycle, and secrets management. It helps practitioners connect identity controls to the broader security programme that protects transactions, access, and trust.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org