TL;DR: KYC systems are under pressure from deepfakes, synthetic identities and AI-generated documents, while customers still expect faster onboarding, according to Trulioo. Reusable identity and reverification shift verification from repeated checkpoints to continuous trust, reducing friction without lowering assurance.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Trulioo's blog post: Reusable identity and reverification are changing KYC from repeated point checks into continuous trust orchestration.
Why it matters: This matters because identity teams need to reduce onboarding friction without creating openings for synthetic identities, deepfakes, and repeat fraud across channels.
By the numbers:
- The EU will issue Digital Identity Wallets to all citizens and businesses by the end of 2026.
- Mobile driver’s licenses are already accepted at more than 250 TSA checkpoints.
Context
KYC verification has traditionally relied on repeated document checks, but that model breaks down when fraudsters can generate convincing synthetic identities, deepfakes and AI-made paperwork faster than manual review can keep up. The governance problem is not only fraud volume but also the mismatch between static onboarding steps and identity risk that changes over time.
Reusable identity changes the starting point by letting a person present portable digital credentials instead of rebuilding trust from scratch at every platform. That matters most where onboarding spans regulated services, digital wallets and reusable proofing flows, because the control objective shifts from one-time approval to governed reuse.
Reverification adds an ongoing trust check after onboarding, which is especially relevant when a user returns with the same identity signals but a different risk posture. That makes the model more resilient than one-off verification alone, and it is a typical response to the modern fraud environment.
Key questions
Q: How should organisations handle identity verification when deepfakes can mimic real users?
A: Organisations should stop treating visual similarity as proof of identity and move high-risk workflows toward cryptographic verification, issuer trust, and device-bound proof of possession. Deepfakes are a scaling problem, so the control needs to fail closed when evidence can be simulated. Use selfies only where the business impact of a false accept is low.
Q: Why does reusable identity change KYC governance?
A: Reusable identity changes KYC governance by decoupling proof from each new onboarding event, so control shifts to how the original assurance is reused, refreshed and revoked. Governance must track provenance, relying parties, consent scope and the risk that external credentials may be accepted beyond their intended context. That means stronger credential validation, binding rules and audit trails.
Q: How does reverification help stop repeat fraud?
A: Reverification helps stop repeat fraud by forcing an already known identity to prove liveness, continuity or control again before a new account, payout or recovery action is approved. It reduces reuse of stolen credentials and synthetic identities by checking that the same person, device or trusted factor is still present and legitimate.
Q: Are reusable credentials enough without biometrics?
A: No. Reusable credentials can prove prior enrolment or possession, but they do not by themselves prove the current person is the same one who was originally verified. Without live-person binding, a stolen credential, replayed token or account takeover can still be reused. Biometrics or other presence checks add a separate assurance layer.
Technical breakdown
How reusable identity changes the KYC verification flow
Reusable identity replaces repeated collection of the same identity evidence with presentation of a portable credential that another relying party can validate. In practice, that credential is only as strong as the trust framework behind it, including cryptographic integrity, issuer assurance and acceptance rules across jurisdictions. The architecture reduces duplicate proofing steps, but it does not eliminate the need for binding the credential to the live person presenting it. That is why reusable identity is best understood as a re-use layer over identity proofing, not a substitute for it. See the Digital Identity, eID and Identity Wallets Guide.
Practical implication: Treat reusable identity as a governed trust input and define which assurance levels and issuers your onboarding flow will accept.
Why biometrics matter when credentials are reusable
Biometric verification adds a live-person check that helps confirm the presenter is the same individual who controls the credential. Facial verification and liveness detection are used here to counter presentation attacks, including synthetic media and replay attempts. The point is not that biometrics are perfect on their own, but that they materially raise the cost of impersonation when paired with a reusable credential. In KYC, that combination matters because the credential may be portable while the person should still be continuously bound to it during the session. See the Identity Proofing and KYC Guide.
Practical implication: Use liveness and face matching as a control against presentation fraud whenever reusable identity is accepted.
How reverification supports continuous identity assurance
Reverification shifts identity confidence from a single onboarding event to a recurring signal that can be refreshed as conditions change. Instead of assuming the original check remains sufficient, the control re-tests the identity relationship using new evidence such as biometrics or behavioural patterns. That helps detect returning fraudsters who reused valid-looking credentials or manipulated earlier checks. It also reduces friction for legitimate customers because the system can recognise them without asking for a full restart of the verification workflow.
Practical implication: Design reverification to trigger on risk changes, not only on fixed calendar intervals.
Threat narrative
Attacker objective: The attacker’s objective is to obtain trusted identity status that can be reused to pass future verification steps and commit fraud at scale.
- Entry occurs when an attacker presents a synthetic identity, deepfake or AI-generated document during onboarding.
- Credential access is achieved when the verification system accepts the false identity as legitimate and issues trust to the wrong person.
- Escalation follows when the fraudster reuses that accepted identity to reenter the funnel or pass later checks without starting over.
- Impact is fraudulent onboarding, avoided detection of repeat abuse, and unnecessary manual review cost for the business.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Reusable identity is becoming a trust distribution problem, not just a user-experience problem. Once credentials can be reused across platforms, governance has to decide who can rely on which proof, under what assurance, and for how long. That changes KYC from a point-in-time screening exercise into a policy problem about credential acceptance, issuer trust and cross-platform reuse. Practitioners should treat portability as a controlled trust decision, not a convenience feature.
Reverification is the control that keeps KYC from freezing identity at the moment of enrolment. Fraud patterns evolve after onboarding, so a one-time check cannot be the only line of defence. The better model is continuous confirmation that a returning customer still matches the verified identity, especially when deepfakes and synthetic identities can degrade static checks. Practitioners should move from fixed-step verification to risk-triggered revalidation.
Identity verification now needs to absorb the same orchestration logic that IAM uses for access decisions. The article’s core shift is not simply faster onboarding, but coordinated trust across reusable credentials, biometrics and repeat verification. That makes the control stack closer to governed identity lifecycle management than to traditional document review. Practitioners should align KYC flows with the broader identity programme instead of leaving them as a separate fraud queue.
Orchestrated trust will separate mature programmes from patchwork verification flows. As reusable identity grows, the old model of manually stitching together documents, face checks and exception handling will become harder to sustain. The winning pattern is policy-led orchestration that can accept portable credentials, refresh assurance and flag inconsistent re-presentation. Practitioners should redesign KYC around governed trust orchestration rather than incremental checks.
What this signals
Identity verification will increasingly behave like a policy engine rather than a static review queue. As reusable credentials spread, programmes will need explicit acceptance rules for issuers, assurance levels and re-presentation conditions. That pushes KYC closer to governed orchestration, where trust is refreshed continuously instead of being frozen at onboarding.
Known-face logic will become a practical control category in fraud-resistant onboarding. The real value is not simply recognising a returning user, but combining recognition with revalidation when behaviour or device context shifts. Practitioners should expect fraud teams, IAM teams and customer onboarding teams to converge on shared assurance signals.
Continuous assurance will matter more than one-time approval. A KYC model that can recognise legitimate users while re-checking risk is better suited to AI-generated fraud than a model built around a single pass/fail event. That makes lifecycle-style identity governance increasingly relevant to customer onboarding programmes.
For practitioners
- Reduce document-heavy onboarding steps Remove repetitive document upload points where legitimate users are forced to restate identity evidence and where AI-generated documents are easiest to substitute into the workflow.
- Add live binding checks to reusable credentials Pair credential acceptance with liveness and facial verification so the person presenting the credential is checked against the holder, not just the document payload.
- Trigger reverification on risk signals Revalidate returning users when device, behaviour, session context or identity evidence changes, rather than relying on a single onboarding decision.
- Prepare for wallet and mDL acceptance rules Define which issuers, assurance levels and presentation conditions your KYC flow will accept before digital wallets and mobile driver’s licences become routine inputs.
Key takeaways
- Deepfakes, synthetic identities and AI-generated documents are stressing KYC models built around one-time verification and repeated manual checks.
- Reusable identity and reverification shift onboarding toward continuous trust, which can reduce friction while improving fraud resistance.
- Programmes that want to use portable credentials safely need explicit issuer trust rules, live binding checks and risk-triggered revalidation.
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Digital Identity, eID and Identity Wallets Guide · Generative AI Fraud Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack surface, NIST SP 800-63 and NIST CSF 2.0 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | Reusable identity and reverification both sit inside identity proofing and re-proofing decisions. |
| SP 800-63B — Authentication | Biometric binding and reverification depend on authentication strength for returning users. | |
| Recommendation — Apply SP 800-63A to govern proofing evidence, assurance levels and reuse conditions. Use SP 800-63B to align biometric and session authentication with the required assurance level. | ||
| GDPR | Art.32 — Security of Processing | Identity verification flows process personal data and require security controls over collected evidence. |
| Recommendation — Apply Art.32 to protect identity data, verification artefacts and processing integrity. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Trusted identity reuse is an authorisation decision about which credential assertions may be accepted. |
| Recommendation — Define acceptance rules so reused identity assertions are only trusted within approved bounds. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Verification platforms expose authentication and trust-boundary decisions that can be bypassed by forged identity evidence. |
| Recommendation — Test identity flows for authentication bypass paths that let synthetic or replayed evidence pass. | ||
Key terms
- Reusable Identity: Reusable identity is a verification model that allows an identity proof to be used again across multiple platforms or journeys. It can reduce repeated document collection, but it also requires clear governance for revalidation, revocation, and jurisdictional boundaries so trust does not become portable without control.
- Reverification: Reverification is a later identity check that happens after the initial onboarding event. It exists because trust is not permanent. In high-volume platforms, reverification helps catch account takeover, transfer, or drift in device and behavioural risk before abuse spreads.
- Deepfake: Synthetic or altered media created with AI or machine learning so that a person appears to say or do something they never did. In security terms, deepfakes are trust attacks that can distort identity verification, approval workflows, and fraud detection.
- Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners align trust decisions across identity, access and automation workflows.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org