Identity continuity is now the control gap in fraud prevention

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Daon's blog post: Fraud prevention is failing less at the front door than at continuity, because repeated actors are not being recognised across onboarding, recovery, and subsequent interactions.

Why it matters: This matters to IAM and identity verification teams because durable fraud defence depends on linking signals across the lifecycle, not treating each interaction as a fresh trust decision.

By the numbers:

• Organisations globally lose an estimated 5-7% of annual revenue to fraud.

Context

Identity verification can confirm a claim at a single moment, but it does not by itself preserve memory about the actor behind that claim. When fraud teams treat each interaction as isolated, the same person can reappear through recovery, account takeover, or a slightly altered presentation and still pass a fresh check.

The governance gap is continuity: linking identity, device, behavioural, and recovery signals into a persistent record that survives channel changes and repeated attempts. That becomes especially important when organisations need to anchor identity proofing to customer lifecycle decisions rather than stopping at onboarding.

Key questions

Q: How should fraud teams recognise repeat actors across the customer lifecycle?

A: Fraud teams should recognise repeat actors by linking accounts, devices, payment instruments, behavioural patterns and recovery events into a persistent actor view. That view lets them correlate the same person or bot across onboarding, login, reset and transaction steps, then apply step-up verification, velocity checks, device binding and case review when patterns recur.

Q: Why do recovery flows create more fraud risk than onboarding in many systems?

A: Recovery flows often carry more fraud risk because they are built to restore access after a weaker proofing event, so attackers target password reset, account takeover recovery and SIM swap paths. A high-risk trust path typically has fewer friction controls, more helpdesk dependency and higher chances of identity substitution than initial onboarding.

Q: How does identity continuity improve fraud detection?

A: Identity continuity improves fraud detection by preserving the relationship between a person, device, credential and account across sessions and lifecycle events. When login, recovery, payment and support activity can be tied to the same underlying identity, analysts can spot reuse, impersonation and gradual account takeover faster through correlation rules and graph-based review.

Q: What is the best way to govern retained fraud signals?

A: Retained fraud signals should be governed as sensitive security data with clear purpose limits, retention periods, access controls and audit logging. Keep only the features needed for risk scoring, casework and model training, then expire or pseudonymise stale records so old flags do not distort decisions or expose customer activity beyond their intended use.

Technical breakdown

Why moment-in-time verification misses persistent fraud actors

Moment-in-time verification answers a narrow question: does this identity evidence look valid right now? That is useful for onboarding, but fraud is often cumulative and adaptive, with actors reusing devices, documents, biometrics, and account recovery paths. If signals are stored locally and not linked to prior events, the control resets after every interaction. The result is a system that can detect an issue once yet fail to recognise the same actor later. Continuous identity models shift the unit of analysis from the transaction to the actor, which is the only way to make repeated fraud visible.

Practical implication: Treat verification as one input to a broader actor-history model, not as a standalone trust verdict.

Persistent identity graphs and fraud signal retention

A persistent identity graph connects customer records, devices, behaviours, biometrics, and confirmed fraud events over time. The point is not to store more data indiscriminately, but to preserve continuity so later decisions can be compared against known history. Fraud signal retention matters because a discarded detection is a lost control signal. Governance is essential here: retained fraud indicators must be separated from legitimate customer data, access must be restricted, and privacy handling must be explicit. Otherwise, the same memory that improves fraud defence can create compliance exposure. See the Identity Fraud Prevention Guide.

Practical implication: Build governed retention for confirmed fraud signals so they remain usable in future decisions without polluting customer records.

Why recovery is becoming the highest-risk trust step

Recovery often has weaker controls than onboarding, yet it can grant access to an existing account, making it a high-value re-entry point for fraud. If recovery is evaluated without historical context, an organisation may effectively re-onboard an actor it has already flagged. That is why recovery should not be a separate silo. It needs to inherit prior trust and risk evidence from onboarding, authentication, and fraud investigations. In practice, recovery becomes a test of whether identity continuity exists at all, rather than just a password-reset or identity-check workflow.

Practical implication: Apply the same risk memory to recovery that you expect from onboarding, or recovery will remain the easiest path back in.

Threat narrative

Attacker objective: The objective is to keep returning under a trusted or partially trusted identity so fraud can continue across multiple interactions and institutions.

1. Entry occurs through a verified identity, a recovery process, or another reused trust path rather than through a brand-new fake persona.
2. Credential and signal reuse let the actor re-enter with familiar devices, documents, biometrics, or behavioural patterns that resemble prior legitimate activity.
3. Impact comes from repeat fraud that survives one-off detection because the organisation never connected the actor's prior events into a durable view.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity continuity is the missing control plane in modern fraud defence. Organisations have invested heavily in proving identity at the front door, but fraud persists because the same actor can reappear through recovery, device reuse, or slightly altered credentials. The decisive issue is not whether a single verification step works, but whether the system recognises repeated behaviour as the same risk over time. Practitioners should treat continuity as a governance layer, not an analytics afterthought.

Recovery is now a privileged trust path, not a routine support process. When recovery is isolated from prior fraud signals, the organisation may restore access to an actor it has already challenged or blocked. That is a lifecycle failure, not just a help desk issue. Recovery policy, identity proofing, and fraud telemetry need to be linked so that re-entry is judged against historical context, not a clean slate.

Fraud signal retention creates durable memory, but only if governance keeps it separate from normal customer data. The useful pattern is a living record of devices, behaviours, biometrics, and confirmed fraud events that can inform later decisions. The risk is uncontrolled reuse of those signals in ways that weaken privacy or create false positives. The right model is durable memory with strict access and purpose limitation, not a larger dumping ground for data.

Cross-journey linking is the control that turns detection into recognition. Onboarding, authentication, transaction checks, and recovery all need to feed the same actor view so the organisation stops asking whether each event is independently valid. That shift aligns identity verification with fraud prevention rather than treating them as separate disciplines. The practitioner outcome is a decisioning model that can challenge continuity breaks instead of rediscovering the same actor repeatedly.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Actor memory will become a competitive control in fraud programmes. As more attackers reuse identities across channels and institutions, teams that preserve continuity will be able to recognise repeat behaviour faster than teams that only score each event on its own. The practical shift is toward shared actor context at the point of decision, not scattered checks after the fact.

Recovery governance will matter more than password policy in many environments. If recovery paths can re-admit actors without historical context, they undermine even strong onboarding controls. Fraud operations, IAM, and identity verification teams will need joint ownership of the re-entry process, because that is where continuity is either preserved or broken.

For practitioners

• Build a persistent actor graph Link onboarding, authentication, recovery, device, behavioural, and fraud-event data into one governed identity continuity model so repeat actors can be recognised across journeys.
• Treat recovery as a high-risk re-entry point Apply stronger proofing, historical signal checks, and step-up review to recovery flows so they inherit prior fraud context instead of resetting trust.
• Retain confirmed fraud signals with governance Keep watchlists, device fingerprints, and confirmed fraud attributes durable, access-controlled, and separated from legitimate customer records.
• Unify decisioning across onboarding and return visits Make every login, transaction, and recovery attempt query the same actor history so continuity breaks are evaluated as risk, not ignored as noise.

Key takeaways

• Fraud prevention fails when organisations treat each interaction as isolated instead of preserving actor memory across the lifecycle.
• The article cites estimated annual fraud losses of 5-7% of revenue, which shows how expensive repeated recognition failures can become.
• The control implication is to connect onboarding, authentication, and recovery into one governed continuity model rather than separate trust decisions.

Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · Identity Proofing and KYC Guide · Identity Verification Buyer's Guide

Key terms

• Identity Continuity: Identity continuity is the ability to preserve a workload’s verified identity across proxies, services, and other infrastructure boundaries. It matters because zero trust breaks down when a request loses its original proof of identity and falls back to network trust or header-based assumptions.
• Persistent Identity Graph: A persistent identity graph is a trust model that links a person, device, credential, and account history across interactions. It helps organisations recognise returning users, but it also creates governance obligations around accuracy, expiry, and misuse of linkage signals.
• Fraud Signal Retention: Fraud Signal Retention is the practice of keeping fraud-related indicators, such as device fingerprints, velocity flags and prior case outcomes, for later detection and review. It defines how long those signals stay available for scoring, investigations and correlation, and controls their exposure through retention rules and access limits.
• Actor Tethering: Actor Tethering is the linking of separate accounts, devices, sessions or transactions to the same underlying person or automated actor. It uses shared identifiers, behavioural links and device or credential reuse to maintain continuity across events, helping detection systems recognise repeat abuse and identity substitution.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle basics. It gives practitioners a common control vocabulary for governing trust across human and machine identities.