Topic starter
24/06/2026 9:19 pm
TL;DR: Verifiable credentials combine claims, source validation, document checks, biometrics, and liveness testing to strengthen identity assurance under NIST 800-63-3, according to 1Kosmos. The practical issue is not whether the model is stronger, but whether verification depth, fraud resistance, and false-positive handling are governed consistently across identity programmes.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Verifiable Credentials: A Deep Dive into Enhanced Identity Assurance”.
Key questions
Q: How should security teams set assurance levels for digital identity proofing?
A: Start by mapping each journey to the evidence needed for the risk involved, then require the same assurance level across channels that perform the same function.
Q: Why do single-signal identity checks fail against modern fraud patterns?
A: Single-signal checks fail because they rely on one observation, such as a document image or a single device event.
Q: How can organisations tell if identity proofing is too weak?
A: Look for repeated reliance on one-time checks, inconsistent approvals, and recovery actions that are accepted without strong context.
Practitioner guidance
- Standardise assurance tiers Map each onboarding and recovery flow to a defined assurance level so teams know exactly which evidence is required before granting access or completing identity proofing.
- Require independent evidence sources Do not let one credential, one database check, or one biometric signal stand alone when the workflow claims higher assurance.
- Add live presence checks Use liveness testing and challenge-response prompts for remote proofing where a static image or recorded video would be enough to bypass review.
Bottom line: Verifiable credentials are not a single control, but a layered identity proofing model that combines claims, documents, authoritative sources, biometrics, and liveness testing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:28 am
Verifiable credentials are only as strong as the independence of the evidence behind them. A name, date of birth, document, and biometric sample do not automatically create high assurance if they all trace back to the same weak source. The programme decision is whether each signal materially reduces the chance of forged or stolen identity acceptance. That means practitioners should judge proofing depth by evidence independence, not by the number of checks performed.
A question worth separating out:
Q: Should organisations prioritise liveness checks or document verification first?
A: Neither should be treated as sufficient on its own. Liveness helps when the attacker uses a fake human presence, while document verification helps when the attacker starts with forged credentials or identity evidence. The better decision is to sequence both inside one risk-based flow, then add behaviour and device checks where fraud pressure is highest.
👉 Read our full editorial: Verifiable credentials are raising the bar for identity assurance