Topic starter
24/06/2026 9:19 pm
TL;DR: Verifiable credentials, as 1Kosmos describes them, depend on layered evidence from claims, documents, authoritative sources, biometrics, and liveness testing. Identity proofing breaks when teams treat different evidence standards as interchangeable across channels.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Verifiable Credentials: A Deep Dive into Enhanced Identity Assurance”.
Key questions
Q: Why do single-signal identity checks fail against modern fraud patterns?
A: Single-signal checks fail because they rely on one observation, such as a document image or a single device event.
Q: How can organisations tell if identity proofing is too weak?
A: Look for repeated reliance on one-time checks, inconsistent approvals, and recovery actions that are accepted without strong context.
Q: How should security teams set assurance levels for digital identity proofing?
A: Start by mapping each journey to the evidence needed for the risk involved, then require the same assurance level across channels that perform the same function.
Practitioner guidance
- Standardise assurance tiers Map each onboarding and recovery flow to a defined assurance level so teams know exactly which evidence is required before granting access or completing identity proofing.
- Require independent evidence sources Do not let one credential, one database check, or one biometric signal stand alone when the workflow claims higher assurance.
- Add live presence checks Use liveness testing and challenge-response prompts for remote proofing where a static image or recorded video would be enough to bypass review.
Bottom line: Verifiable credentials are not a single control, but a layered identity proofing model that combines claims, documents, authoritative sources, biometrics, and liveness testing.
Glossary terms: Identity proofing, Assurance Level, Liveness Testing, Verifiable Digital Credential
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
25/06/2026 6:28 am
Verifiable credentials are only as strong as the independence of the evidence behind them. A name, date of birth, document, and biometric sample do not automatically create high assurance if they all trace back to the same weak source. The programme decision is whether each signal materially reduces the chance of forged or stolen identity acceptance. That means practitioners should judge proofing depth by evidence independence, not by the number of checks performed.
A question worth separating out:
Q: Should organisations prioritise liveness checks or document verification first?
A: Neither should be treated as sufficient on its own. Liveness helps when the attacker uses a fake human presence, while document verification helps when the attacker starts with forged credentials or identity evidence. The better decision is to sequence both inside one risk-based flow, then add behaviour and device checks where fraud pressure is highest.
👉 Read our full editorial: Verifiable credentials are raising the bar for identity assurance