TL;DR: The European Central Bank found that strong customer access measures, including non-repudiation, helped reduce online banking fraud by 50% in the EU between 2019 and 2021, underscoring how authenticated action trails now matter as much as access control, according to Seamfix. For identity teams, the lesson is that proof of action, not just proof of login, is becoming a core governance requirement.
At a glance
What this is: This is an IAM analysis of non-repudiation as a fraud-control and compliance requirement, with the ECB-linked finding that stronger customer access measures helped reduce online banking fraud by 50% in the EU.
Why it matters: For IAM practitioners, the message is that identity governance must prove not just who logged in, but who performed a sensitive action, especially where fraud, audits, and regulatory accountability intersect.
By the numbers:
- strong customer access measures, including non-repudiation, helped reduce online banking fraud by 50% in the EU between 2019 and 2021
Context
Non-repudiation closes the gap between authentication and accountability. In practice, it means an IAM system can tie a specific transaction, approval, or signing action to one verified person and preserve evidence that stands up in disputes, audits, and fraud investigations.
That matters because many identity programmes still optimise for access and session control while leaving action evidence weak. For banks, regulated financial services, and customer-facing platforms, the control question is no longer only whether the user got in, but whether the organisation can prove exactly what that user did.
The article is focused on financial services, where fraud prevention and compliance obligations make provable action trails a governance requirement rather than a niche feature.
Key questions
Q: How should security teams implement non-repudiation in IAM?
A: Start by requiring strong authentication for sensitive actions, then ensure each action is tied to a durable audit record. The key is not only proving who signed in, but proving who approved, changed, or transferred something. If the evidence chain cannot survive dispute or investigation, the control is incomplete.
Q: Why does proof of action matter more than login success in fraud cases?
A: Because login success only proves a session existed, while fraud disputes usually ask who approved or executed a specific action. Without action-level evidence, organisations can authenticate a user and still be unable to prove responsibility for the transaction, signature, or entitlement change.
Q: What are the signs that an IAM programme is weak on non-repudiation?
A: Common warning signs are logs that stop at authentication, sensitive actions that are not individually traceable, and inconsistent evidence across fraud, audit, and application teams. If investigators must reconstruct responsibility from multiple systems, the control is too fragmented to be reliable.
Q: What is the difference between authenticity and non-repudiation in cybersecurity?
A: Authenticity verifies that a message, file, or request came from its claimed source. Non-repudiation goes further by making it difficult for the sender to deny the action later. Authenticity answers who sent it. Non-repudiation answers whether the sender can credibly dispute having sent it, using signatures, timestamps, and audit evidence.
Technical breakdown
How non-repudiation differs from authentication and integrity
Authentication proves an identity is likely genuine at the point of access. Data integrity proves content has not been altered. Non-repudiation adds a third property: evidence that a specific action was performed by the claimed party and can later be attributed to that party. In IAM, that usually depends on strong identity proofing, cryptographic assurance, transaction binding, and logs that preserve the action context. Without those links, the system may know a session existed, but not whether a specific payment, signature, or approval is defensible in a dispute.
Practical implication: design IAM controls so critical actions are attributable, not just authenticated.
Why audit trails matter for fraud and compliance
An audit trail becomes useful when it is time-stamped, action-specific, and resistant to tampering. That means logs must show who accessed what, which action was taken, and under what conditions, with enough fidelity to support investigation and regulatory review. In financial environments, this is often the evidentiary layer that turns a security event into a provable case. If the log only records login success, it cannot establish responsibility for a transaction or an entitlement change.
Practical implication: keep action-level logs that are complete enough for audit and fraud review.
How access policy supports non-repudiation
Role-based access control and context-aware policy help reduce the number of actors who can perform a sensitive operation, which narrows dispute space and improves attribution. But the governance value comes from pairing authorisation with evidence, not replacing it. If a user can perform a high-risk action from any device, any location, and any channel without additional verification, attribution becomes weaker even when access is technically granted. Non-repudiation therefore depends on policy design as much as on logging design.
Practical implication: align high-risk permissions with strong contextual controls and explicit action evidence.
Threat narrative
Attacker objective: The attacker wants to complete a fraudulent action that looks authorised at the time it occurs and remains hard to attribute afterward.
- Entry occurs when a fraudster uses stolen or abused credentials to reach a customer or employee account that lacks strong proof of action controls.
- Escalation follows when the attacker performs a transaction or administrative action that the organisation can authenticate but cannot later attribute with confidence.
- Impact occurs when the victim disputes the action and the institution lacks immutable evidence to prove who initiated it and under what conditions.
Breaches seen in the wild
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Non-repudiation is becoming the missing control layer between identity and fraud. Authentication answers whether a subject was present, but fraud and regulatory disputes require proof of the specific action performed. In financial services, that shifts IAM from a gateway function to an evidentiary control plane. Organisations that cannot bind actions to identities will keep treating fraud as an investigation problem instead of a governance problem.
Action attribution is now a governance requirement, not just a logging feature. Immutable logs matter because they preserve evidentiary value after the fact, but only if they capture the action, context, and permission path. A session record without transaction binding does not establish responsibility. The practical conclusion is that identity governance must treat high-risk actions as controlled events with evidentiary weight, not as generic application activity.
Fraud controls fail when they stop at proof of login. Many IAM programmes still assume that strong authentication is enough to resolve accountability. That assumption breaks in customer fraud, internal approvals, and digital signing flows where the dispute is not whether access existed, but who authorised the action. The lesson is to govern the action itself, not just the session that preceded it.
Digital fingerprinting changes the balance between access and assurance. The article's most useful concept is that each sensitive action needs a durable evidentiary trail that can survive challenge. That is especially relevant for banks and regulated service providers because non-repudiation bridges IAM, fraud operations, and compliance evidence in one control pattern. Practitioners should treat this as an enterprise assurance design problem, not a point solution.
What this signals
Proof of action is the governance gap many IAM programmes still leave open. Most identity stacks were built to control access, not to preserve evidentiary attribution for sensitive actions. That gap becomes visible when fraud teams, auditors, and investigators need to know not just who authenticated, but who actually committed the action.
Non-repudiation is where IAM, fraud, and compliance converge. In regulated environments, the control has value only when policy, logging, and challenge response are designed together. Practitioners should expect this requirement to surface first in customer payments, approvals, and digital signing flows where dispute handling is unavoidable.
For practitioners
- Map high-risk actions to evidentiary controls Identify transactions, approvals, document signatures, and entitlement changes that require action-level proof, then separate them from ordinary session logging.
- Strengthen proof at the point of action Use MFA, device context, and step-up verification where the business needs to prove who authorised the action, not only who accessed the system.
- Bind logs to the transaction context Capture actor, action, timestamp, resource, and policy decision in tamper-resistant logs so investigators can reconstruct the event without relying on application memory.
- Review fraud and audit gaps together Align fraud operations, IAM, and compliance teams on which actions must be non-repudiable, since the control only works when evidence requirements are explicit.
Key takeaways
- Non-repudiation shifts IAM from access control to action attribution, which is why it is increasingly relevant to fraud and compliance.
- The article ties stronger customer access measures to a 50% reduction in online banking fraud in the EU, showing the value of evidence-rich identity controls.
- Practitioners should prioritise sensitive actions, bind them to durable logs, and make sure the organisation can prove who did what under challenge.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-10 — Non-repudiation | The article is directly about proving actions and preserving evidentiary attribution. |
| IA-2 — Identification and Authentication (Organizational Users) | Strong identity proofing underpins the action attribution discussed in the article. | |
| AU-2 — Audit Events | The article emphasises detailed event logging as part of non-repudiation. | |
| Recommendation — Implement non-repudiation controls for transactions that require durable proof of authorisation. Require strong authentication before allowing high-risk actions that need later attribution. Define audit events for sensitive actions and ensure they are recorded with sufficient context. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article ties non-repudiation to access control and permitted actions in IAM. |
| Recommendation — Constrain sensitive actions to explicitly authorised users and review those permissions regularly. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account governance and access traceability are central to the article's IAM focus. |
| Recommendation — Maintain accountable user records and remove access that cannot be tied to a current owner. | ||
Key terms
- Non-Repudiation: Non-repudiation is the ability to prove what an identity did, when it did it, and under what authority. For autonomous agents, that evidence must include context, approvals, and tool usage so later review can reconstruct the decision path.
- Event-Level Logging: Event-level logging records the actual actions taken by an identity, not just the fact that access existed. It provides evidence for investigations, audits, and policy validation. For modern identity governance, this is often more useful than entitlement snapshots because it shows behaviour in context.
- Transaction binding: Transaction binding links a user's identity, the document they approved, and the workflow state into a single evidence record. This matters in digital lending because a signature alone is not enough to prove the right person approved the right version at the right stage.
- Reset Audit Trail: A record set that preserves the meaningful details of a password reset event, including the identity involved, the authorisation path, and the outcome. Audit trails matter because they prove legitimacy, support investigations, and help compliance teams demonstrate control over identity recovery.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org