Topic starter
06/11/2026 6:40 pm
TL;DR: A global bank uses different real-time checks for onboarding and returning sign-in, validating identity and phone integrity only when each question is actually open, according to Zumigo. The split model matters because it reduces fraud pressure without turning every login into a full identity proofing exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Zumigo: “Customer Stories: One Stack for Signing Up, Another for Signing In”.
Key questions
Q: How should teams separate identity proof from authentication in digital identity programmes?
A: Treat authentication as evidence that a credential was presented correctly, not proof that the person or service was truly verified.
Q: Why do SIM swaps create such high fraud risk for banks and consumer apps?
A: They create high fraud risk because a single number takeover can unlock OTP interception, password resets, and contact impersonation in one chain.
Q: How do live phone signals improve identity verification?
A: Live phone signals improve identity verification by checking that a claimant controls an active, recently observed device or number during the session.
Practitioner guidance
- Split onboarding from sign-in policy Use separate decision trees for first-time proofing and returning-user authentication so each workflow evaluates only the open risk question.
- Check mobile channel integrity in real time Evaluate SIM state, device change, and call forwarding immediately before trusting a one-time code or session grant.
- Treat synthetic identity as a lifecycle threat Require live identity validation at account creation and correlate it with channel-risk signals before activation completes.
Bottom line: This pattern separates the risk of proving a new identity from the risk of reusing an already verified one, which is the right governance move for customer journeys.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity proofing and re-authentication are different governance problems: treating them as one control stack hides the fact that new-account risk and returning-user risk are not the same. Onboarding needs to test whether the identity is coherent; sign-in needs to test whether the channel is still controlled. Organisations that collapse those questions into a single workflow usually either over-verify known users or under-verify new ones, and both outcomes weaken trust. Practitioners should design policy so each stage answers only the question that is open at that stage.
A question worth separating out:
Q: What should teams do first when a login channel may be compromised?
A: The first step is to suspend use of the suspected login channel, then move the user to a trusted recovery path such as a separate device, backup factor, or in-person verification. Teams should invalidate active sessions, reset affected credentials, and review recent authentication events for compromise. If the primary device is untrusted, device replacement may be needed before re-enrolment.
👉 Read our full editorial: Identity checks split across signup and sign-in reduce fraud risk