Topic starter
06/11/2026 6:40 pm
TL;DR: Financial institutions that stop at onboarding and rely on fragmented credentials leave security gaps across authentication, recovery and high-risk events, while continuous identity assurance ties those moments to one persistent customer record and risk-based friction, according to Daon research. The architectural break is discontinuity: assurance cannot be preserved by isolated checkpoints alone.
Editorial analysis by NHI Mgmt Group, based on content published by Daon: “Continuous Identity Assurance: A Technical Framework for Financial Institutions”.
Key questions
A: Financial institutions should bind onboarding, identity proofing and authentication to the same authoritative identity record, so the account cannot be opened under one identity and later controlled under another.
Q: Why does account recovery often create more identity risk than the login screen?
A: Because recovery frequently relies on weaker trust signals such as security questions, email access, SMS, or human support.
Q: What is the difference between presentation attacks and injection attacks in deepfake fraud?
A: Presentation attacks try to fool the system directly with an image, mask, screen replay, or video shown to the camera.
Practitioner guidance
- Map the full assurance lifecycle Document where onboarding, authentication, recovery and high-risk transactions are governed today, then identify every place a different team or tool can weaken the same identity record.
- Make recovery a primary control path Apply the same identity record, approval logic and binding checks to recovery that you use for initial proofing, instead of falling back to knowledge-based verification or ad hoc manual review.
- Separate spoofing from pipeline abuse Test biometric deployments for presentation attacks at capture and injection attacks in the transmission path, because the two failure modes demand different defences.
Bottom line: One-time onboarding proofing is not enough when later recovery and transaction decisions are governed by separate control paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Continuous identity assurance is a governance model, not a point product. Financial institutions do not fail because they lack a login control. They fail when onboarding, authentication and recovery operate as separate assurance events with no persistent identity state connecting them. That separation forces policy to guess across channels, which is exactly where fraud gains room to move.
A question worth separating out:
Q: What is the difference between presentation attacks and injection attacks in deepfake fraud?
A: Presentation attacks try to fool the system directly with an image, mask, screen replay, or video shown to the camera. Injection attacks bypass the camera path altogether by replacing the live feed with synthetic or prerecorded media. Both aim to impersonate a real person, but the technical control point and detection approach are different.
👉 Read our full editorial: Continuous identity assurance closes the gaps left by onboarding