The workflow confuses presence with authenticity. That breaks when the same call can be used to authorise access, recover an account, or approve funds, because the organisation has no reliable way to distinguish a real participant from a synthetic one. In practice, the control gap is at the point of decision, not in the call itself.
Why Video Alone Does Not Prove Identity
Video calls are useful for communication and human review, but they are weak as a stand-alone identity signal. A live face or voice only proves that someone appeared on the call at that moment; it does not prove who controls the session, whether the participant is synthetic, or whether the person on screen is the rightful approver for the action being requested.
That distinction matters because identity confirmation is not the same thing as presence confirmation. A call can establish that a person is reachable and responsive, but it cannot by itself bind the participant to a trusted enrollment record, a known device, or a verified assurance level.
When organisations treat a video interaction as the final proof, they collapse a weak signal into a high-trust decision. That is a control design error, not merely a user-training issue.
Where the Control Breaks in Real Workflows
The break happens at the decision point, not in the call itself. If the video call is used to authorise access, approve a payment, reset credentials, or recover an account, the organisation is relying on a channel that can be imitated, relayed, manipulated, or socially engineered. In the Identity Proofing and KYC Guide, the core lesson is that assurance has to come from stronger evidence than a live conversation alone.
A more reliable workflow separates observation from authorisation. The call may be one input, but the decision should also depend on independently verified factors such as a prior enrollment step, out-of-band verification, device binding, document checks, or a policy that limits what the reviewer can approve based on the assurance level achieved.
That same principle appears in broader identity operations. NHI lifecycle management is built around the idea that identity events must be governed across enrolment, use, review, and offboarding, rather than trusted from a single interaction. The control is only as strong as the weakest step that can trigger a privileged outcome.
What Additional Assurance Must Change Before You Trust the Decision
Additional assurance must change the evidentiary standard, not just add friction. If the result of the call can unlock money, access, or recovery, then the process needs a higher bar than “the person looked and sounded right.” A secure workflow should make it clear which evidence is required, who can make the decision, and what happens when the evidence is incomplete or ambiguous.
Good practice is to reserve video for low-risk confirmation or triage, then require a stronger control before any high-impact action. That can mean phishing-resistant authentication, a verified recovery path, a second approver, or a known trusted relationship established earlier in the lifecycle. The point is to ensure the person making the decision is validating a trusted identity, not just a convincing performance.
The same reasoning underpins standards for authenticators and assurance. NIST SP 800-63 Digital Identity Guidelines are useful here because they separate proofing, authentication, and assurance, which is exactly the distinction organisations blur when they overvalue a video call.
Risk and Threat Considerations
Video-based identity checks are attractive to attackers because they exploit human trust in realtime interaction. Deepfakes, impersonation, session relay, and coached social engineering can all turn a convincing call into an unsafe approval path, especially when staff believe the medium itself provides strong assurance.
Failure mechanism: The control fails when a live appearance is treated as sufficient evidence for a privileged decision, even though the organisation has not verified the caller through an independent assurance mechanism.
Impact: Attackers can obtain unauthorised access, account recovery, or payment approval, and the resulting compromise can propagate into fraud, lateral movement, or irreversible business loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Covers identity proofing and assurance separation for remote identity decisions. |
| Recommendation — Apply assurance levels that separate proofing from authentication before allowing high-impact actions. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Video-only approval can replace strong identity assurance with weak human-facing auth signals. |
| NHI-10 — Human Use of NHI | Highlights abuse when humans rely on a non-binding interaction to authorize identity-bound actions. | |
| Recommendation — Require a stronger authenticator or verified recovery path before granting access or approval. Prevent human reviewers from using a call alone as the basis for privileged identity decisions. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Identity decisions need authenticated users, not just a live conversation. |
| IA-5 — Authenticator Management | Recovery and approval flows depend on managing authenticators, not just observing participants. | |
| AC-6 — Least Privilege | Limits the blast radius when a video-mediated approval is abused. | |
| Recommendation — Authenticate users before they can approve access, recovery, or payment actions. Rotate, protect, and verify authenticators used in recovery and approval workflows. Constrain approvers so a single misused conversation cannot unlock excessive authority. | ||
Practitioner Guidance
What to prioritise: Separate identity verification from business approval. If the action changes money, access, or authority, require a second control that is independent of the call itself.
What to verify: Check that the workflow has a defined assurance threshold, a documented fallback when video evidence is uncertain, and a path that prevents the same conversation from both proving identity and authorising the outcome.
Common mistake: Teams often add a live video step and then assume the process is “stronger” without changing the underlying decision rule. That only adds confidence, not assurance.
Practitioner takeaway: Use video as a human confirmation signal, but never as the final trust anchor for high-impact actions unless it is backed by an independent, auditable assurance mechanism.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org