Identity checks split across signup and sign-in reduce fraud risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Zumigo's blog post: A global bank separates onboarding identity proofing from returning sign-in checks, using live phone and line signals only where they answer an active risk question.

Why it matters: This matters because IAM and identity verification teams need different controls for proofing a new identity versus re-authenticating a known one, especially where mobile channels carry the trust signal.

Context

Identity verification fails when organisations use the same control stack for two different questions. Onboarding asks whether a person is real and reachable, while sign-in asks whether an already verified customer still controls the channel they used before.

In this pattern, the security problem is not access management in the narrow IAM sense. It is trust lifecycle management across the customer journey, where phone integrity, possession checks, and identity proofing need to be separated rather than blended into one step.

Key questions

Q: How should teams separate identity proof from authentication in digital identity programmes?

A: Treat authentication as evidence that a credential was presented correctly, not proof that the person or service was truly verified. Identity proof should be defined separately, with different assurance levels for onboarding, recovery and high-risk actions. That separation prevents weak login events from being mistaken for strong identity assurance.

Q: Why do SIM swaps create such high fraud risk for banks and consumer apps?

A: They create high fraud risk because a single number takeover can unlock OTP interception, password resets, and contact impersonation in one chain. That lets the attacker move from identity access to financial theft without needing malware or device compromise. Any app that treats SMS as trust evidence is exposed to this pattern.

Q: How do live phone signals improve identity verification?

A: Live phone signals improve identity verification by checking that a claimant controls an active, recently observed device or number during the session. They are commonly used as a risk signal alongside OTPs, device binding, SIM change checks, and step-up authentication. By themselves they do not prove identity, but they can help detect account takeover, spoofed enrolment, and synthetic identity patterns.

Q: What should teams do first when a login channel may be compromised?

A: The first step is to suspend use of the suspected login channel, then move the user to a trusted recovery path such as a separate device, backup factor, or in-person verification. Teams should invalidate active sessions, reset affected credentials, and review recent authentication events for compromise. If the primary device is untrusted, device replacement may be needed before re-enrolment.

Technical breakdown

Why onboarding needs identity proofing plus possession checks

New-account checks have to answer two different questions at once: does this person exist as claimed, and can they receive or control the phone number tied to the application. Synthetic identity fraud exploits systems that validate individual attributes separately but never challenge whether the full identity is coherent. A live name-and-address check tests the applicant against current sources, while SIM state, device state, and call-forwarding status test whether the channel used for one-time codes is still under the applicant's control. The mechanism works only if those signals are checked in real time, not reused from a previous session. See the Magic Links and Email OTP Security Guide.

Practical implication: Separate proofing from possession verification so a new-account workflow can detect synthetic identity and channel takeover at the same moment.

What changes at sign-in when identity is already established

Returning-user sign-in is a different control problem because the identity claim is no longer the thing being tested. At that point, the live question is whether the phone or line has changed since the last legitimate verification, which is why recent SIM swaps, device changes, and call forwarding become high-signal indicators. Re-running full identity proofing at every login creates friction without improving the decision that matters. The better design is to preserve the proofing outcome and re-check channel integrity immediately before a code or session is trusted. See the Account Takeover Prevention Guide.

Practical implication: Use sign-in controls to detect channel compromise, not to repeat identity proofing that was already completed.

How phone-based trust signals support fraud detection

A mobile number can carry more than a static contact point if the programme can inspect live state around it. SIM status, handset changes, and call handling provide a dynamic trust layer that passwords and stored profile data do not. That makes the phone useful as an identity assurance anchor, but only when teams treat it as a live risk signal rather than a one-time enrollment field. The architectural idea is simple: use the phone as an evidence source for current control, not as a permanent proof of identity. Read OTP security.

Practical implication: Instrument mobile-channel risk signals as part of identity verification so channel tampering is visible before step-up or session issuance.

Threat narrative

Attacker objective: The attacker wants to establish or reuse a customer identity strongly enough to complete onboarding or sign-in and gain fraudulent account access.

1. Entry begins when an attacker presents a synthetic or otherwise weakly rooted identity during onboarding and tries to pass attribute checks.
2. Credential access occurs when the attacker obtains or redirects the phone channel used for one-time verification through SIM change, device change, or call forwarding.
3. Escalation follows when the attacker reuses that channel trust to complete account creation or sign-in as though the legitimate user were present.
4. Impact is account takeover or fraudulent access to banking and investment relationships under a seemingly valid customer identity.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity proofing and re-authentication are different governance problems: treating them as one control stack hides the fact that new-account risk and returning-user risk are not the same. Onboarding needs to test whether the identity is coherent; sign-in needs to test whether the channel is still controlled. Organisations that collapse those questions into a single workflow usually either over-verify known users or under-verify new ones, and both outcomes weaken trust. Practitioners should design policy so each stage answers only the question that is open at that stage.

Channel integrity is the real control surface in mobile identity fraud: a phone number is only useful if the organisation can tell whether its state has changed since the last trusted event. SIM swaps, device changes, and call forwarding are not peripheral signals; they are the active conditions that make a one-time code unreliable. That means the control model has to be continuous at the channel level even when identity itself is already established. Identity teams should treat mobile channel change as a first-class risk trigger, not a supporting metric.

Verification trust gap: the dangerous assumption is that a previously validated contact path remains trustworthy until a user next logs in. In reality, the time between events is where compromise happens, especially when the same phone is used for both reachability and proof of possession. Magic Links and Email OTP Security Guide is relevant here because the same design issue appears anywhere a delivery channel is mistaken for proof of identity. Practitioners should separate channel trust from identity trust in policy, not just in tooling.

Identity fraud defence improves when the assurance model becomes stage-aware: a bank does not need the same evidence at every interaction, but it does need the right evidence at the right interaction. That is the governance lesson for IAM and fraud teams alike: assurance should be sequenced, not repeated blindly. The practical outcome is lower friction for known users and stronger resistance to synthetic identity at the point where it first enters the lifecycle.

What this signals

Stage-aware verification will become the stronger pattern in customer identity programmes: organisations that keep using one universal control stack for every interaction will continue to pay for friction they do not need and assurance they do not actually get. The more valuable model is to match evidence type to lifecycle stage, with proofing reserved for first-time identity creation and channel checks reserved for returning access.

Verification trust gap: customer identity programmes fail when they assume a previously verified phone number remains a trustworthy proofing path indefinitely. The operational answer is to govern the channel as a mutable risk object, not a permanent identity attribute, and to trigger checks when its state changes rather than on a fixed schedule.

For practitioners

• Split onboarding from sign-in policy Use separate decision trees for first-time proofing and returning-user authentication so each workflow evaluates only the open risk question.
• Check mobile channel integrity in real time Evaluate SIM state, device change, and call forwarding immediately before trusting a one-time code or session grant.
• Treat synthetic identity as a lifecycle threat Require live identity validation at account creation and correlate it with channel-risk signals before activation completes.
• Instrument takeover indicators at sign-in Alert on recent number porting, forwarding activation, or handset changes because those are the conditions that turn a valid login path into a takeover path.

Key takeaways

• This pattern separates the risk of proving a new identity from the risk of reusing an already verified one, which is the right governance move for customer journeys.
• Live mobile-channel checks matter because SIM changes, device changes, and call forwarding can turn a valid verification path into a takeover path.
• The practical shift is to design identity assurance around lifecycle stage, so onboarding and sign-in use different evidence instead of one blanket control stack.

Related NHI Mgmt Group resources: Magic Links and Email OTP Security Guide · Account Takeover Prevention Guide · Test and Synthetic Accounts Governance Guide · Service Account Security Guide

Key terms

• Synthetic Identity Fraud: Synthetic identity fraud is the creation of a fake identity from a mix of real and fabricated personal data. Fraudsters use it to open accounts, build credit, and evade standard checks. Defenders look for thin-file identities, inconsistent identity attributes, repeated reuse of contact details, and unusual account-age patterns across applications.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Proof-of-Possession: Proof-of-possession binds a token or credential to a specific key so possession of the token alone is not enough to use it. For AI agents, it reduces replay risk and helps ensure that an intercepted credential cannot be reused by a different actor.
• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps identity and security practitioners connect control design to the broader access lifecycle.