Notifications
Clear all
Topic starter
12/07/2026 12:19 pm
TL;DR: AI is making phishing, impersonation and payment fraud more scalable, while digital identity controls such as qualified electronic signatures and verified credentials are being pulled into the centre of transaction security, according to GlobalSign. The governance shift is clear: identity proofing and cryptographic assurance now sit alongside fraud prevention, not after it.
NHIMG editorial — based on content published by GlobalSign: digital identity, fraud and qualified electronic signatures
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should organisations secure high-value payment and approval workflows against AI-enabled fraud?
A: Organisations should raise assurance where the action creates financial or legal consequence.
Q: Why do weak identity checks increase fraud risk in digital onboarding?
A: Weak checks allow unverified identities to enter trusted workflows, which means fraud can start before the organisation has enough evidence to stop it.
Q: What do security teams get wrong about electronic signing workflows?
A: Teams often treat e-signature tools as document automation rather than identity and evidence systems.
Practitioner guidance
- Reclassify high-value workflows as identity assurance points Map invoices, approvals, payment changes and contract execution to explicit assurance levels so that weaker identity checks are no longer accepted for high-impact actions.
- Deploy cryptographic verification for binding transactions Use qualified electronic signatures or equivalent certificate-backed controls for actions that require legal enforceability, non-repudiation or clear signer accountability.
- Reduce trust in human-looking approvals Add step-up checks when payment instructions, banking details, delegate approvals or executive requests deviate from normal patterns.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- Discussion points from Dave Birch, Andreas Brix and Maxwell Chen on the direction of digital identity and fraud
- The article's explanation of how PSD2 and new EU invoicing requirements use qualified identity in payment processes
- The practical role of SignNow integration in simplifying secure signature workflows
- The forward-looking commentary on post-quantum encryption and PSD3 implications
👉 Read GlobalSign's analysis of digital identity, fraud and qualified signatures →
Digital identity verification and payments fraud: what teams need to do?
Explore further
12/07/2026 12:32 pm
AI has turned identity verification into a live fraud-control layer, not a one-time onboarding check. The article’s core message is that digital transactions now need continuous assurance about who is requesting, approving and executing them. That shifts identity verification into the operational path of payments, invoicing and document workflows. For practitioners, the lesson is to treat identity trust as a runtime control, not a static record.
A question worth separating out:
Q: Who should be accountable when digital identity verification fails in a payment or signing process?
A: Accountability should sit with the business owner of the transaction process, the identity team responsible for assurance policy, and the compliance function that defines evidentiary requirements. If payments, approvals or signatures fail, the issue is usually shared control design rather than a single tool failure. Clear ownership prevents gaps between fraud, IAM and legal teams.
👉 Read our full editorial: Digital identity verification is becoming a fraud control, not a formality
