Use a risk-based approach. Apply stronger checks only when the transaction, customer profile, or regulatory context warrants it, and keep lower-risk journeys fast and simple. Combine document checks, face matching, and fraud controls where needed, then reserve manual review for higher-risk cases. The goal is to protect access without forcing every customer through the same heavy process.
Why This Matters for Security Teams
Identity verification in customer journeys is a balancing act between conversion and abuse resistance. If every user faces the same heavy checks, abandonment rises. If every path is made easy, account takeover, synthetic identity fraud, and mule activity become cheaper to scale. Current guidance suggests treating verification as a risk decision at each step, not as a one-time gate, and aligning controls to the sensitivity of the action being taken.
That approach is consistent with NIST SP 800-53 Rev 5 Security and Privacy Controls, which supports control selection based on business context, and with Ultimate Guide to NHIs, where NHIMG shows how weak identity discipline turns into broad exposure once credentials or trust assumptions are reused across systems. The practical lesson is that friction should be concentrated where it materially reduces fraud, not spread evenly across the whole journey. In practice, many security teams encounter abandoned carts, support escalations, and fraud losses only after a uniform verification flow has already hurt both legitimate users and high-risk screening quality.
How It Works in Practice
A risk-based customer journey starts by defining which actions need stronger assurance. Signing in, updating an email address, adding a payment method, changing payout details, and initiating a refund should not all use the same verification depth. The control decision should consider transaction value, velocity, device reputation, geo-location, prior fraud signals, and whether the customer is trying to recover an account or change a sensitive attribute.
For lower-risk actions, lightweight controls are often enough: password plus a one-time code, device binding, or a trusted-session check. For higher-risk actions, businesses can add document verification, face matching, step-up MFA, or manual review. The point is to evaluate the risk at runtime and increase friction only when the context justifies it.
Well-run programs also separate identity proofing from ongoing authentication. A strong onboarding check does not eliminate the need for step-up controls later, because fraud often appears after the account is already active. Guidance from eIDAS 2.0 — EU Digital Identity Framework shows how assured identity can support later trust decisions, while 52 NHI Breaches Analysis is a useful reminder that identity trust assumptions fail quickly when credentials are reused or poorly governed. The operational pattern is simple:
- Use low-friction checks for low-value, low-risk, low-impact actions.
- Escalate only on anomalies, regulated actions, or high-value transactions.
- Keep manual review for edge cases where signals conflict or confidence is low.
- Log every decision so fraud teams can tune thresholds and reduce false positives.
These controls tend to break down when risk scoring is static across all channels, because fraud patterns differ sharply between login, onboarding, and payments.
Common Variations and Edge Cases
Tighter verification often increases abandonment and support load, requiring organisations to balance fraud reduction against customer experience and regulatory obligations. That tradeoff is especially visible in telecom, fintech, gaming, crypto, and cross-border commerce, where document quality, name matching, and local privacy rules can vary significantly.
There is no universal standard for this yet. Best practice is evolving toward layered verification, but the right mix depends on the market and the threat model. For example, a repeat customer on a trusted device may only need a step-up challenge, while a first-time payout request from a new location may justify document checks plus manual review. Similarly, businesses subject to AML or age verification requirements may need stricter flows than ordinary retail checkout. The FATF Recommendations — AML and KYC Framework are relevant when financial crime controls drive the verification threshold.
Teams should also watch for false confidence in “one and done” proofing. A strong onboarding check does not prevent account takeover later, especially when session theft, SIM swap, or social engineering are in play. The most resilient design uses adaptive controls, retries only when needed, and continuously recalibrates thresholds based on real fraud outcomes rather than abstract risk appetite.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-01 | Risk-based verification supports identity assurance matched to transaction sensitivity. |
| NIST SP 800-63 | IAL2 | Identity proofing strength should align with the trust needed for account lifecycle events. |
| NIST AI RMF | Adaptive verification is a govern and manage decision driven by risk context. | |
| OWASP Non-Human Identity Top 10 | NHI-02 | Credential and trust misuse in customer journeys creates identity abuse risk. |
Use AI RMF to document risk thresholds, review outcomes, and adjust controls based on evidence.
Related resources from NHI Mgmt Group
- How should teams reduce friction in customer identity journeys without weakening security?
- How should security teams implement continuous identity verification in AI-enabled customer journeys?
- How should security teams implement government-backed identity verification in customer and employee workflows without adding unnecessary friction?
- How should security teams reduce dependence on passwords in customer identity journeys?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
