What signals should organisations use instead of documents alone?

Why This Matters for Security Teams

Documents alone are a weak signal because they prove something about the artefact, not the claimant’s current control of the identity. Fraudsters can reuse, alter, or synthesize images, while legitimate users can still be spoofed through account takeover, phone-number recycling, or manipulated recovery paths. Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls and NHI Management Group’s Ultimate Guide to NHIs points toward layered verification that combines possession, reputation, and behavioural evidence.

This matters because verification decisions increasingly feed access approval, recovery, fraud screening, and privileged workflows. If the organisation treats a document scan as a high-confidence proof, it often misses the stronger indicator: whether the claimant can demonstrate real-time control over a device, number, or account path that is difficult to fake at scale. In practice, many security teams discover the weakness only after an identity has already been used for enrolment, reset, or takeover rather than through intentional verification design.

How It Works in Practice

Better verification uses multiple signals together, with each signal answering a different question. Device possession asks whether the claimant controls a registered phone or endpoint. Phone-number ownership checks whether the number is active, stable, and not known for recycling or virtual relay abuse. Telecom reputation looks at whether the number is associated with fraud patterns, recent SIM swap activity, or high-risk carriers. Behaviour-based risk signals examine whether the interaction looks normal for that identity, location, and timing.

That layered approach aligns with the control logic in Ultimate Guide to NHIs and with NIST guidance that emphasises risk-based, continuously evaluated controls rather than one-time assertions. In practice, organisations should score signals at the moment of verification, then adapt the workflow:

• Low risk: accept standard checks and minimal friction.
• Medium risk: add step-up authentication, liveness checks, or delayed approval.
• High risk: route to manual review, out-of-band confirmation, or denial.

Behavioural signals are most useful when they are tied to the specific action being requested. A password reset, payout change, or admin enrolment should not use the same confidence threshold as a routine login. NIST SP 800-53 Rev 5 Security and Privacy Controls supports this sort of contextual enforcement by encouraging organisations to choose controls that are proportionate to the asset and threat model. These controls tend to break down when verification is outsourced to a static document workflow that cannot adapt to number-porting, device cloning, or session hijacking.

Common Variations and Edge Cases

Tighter verification often increases user friction and operational cost, requiring organisations to balance fraud resistance against conversion, recovery speed, and support volume. That tradeoff is especially visible in markets where device access is inconsistent or SIM-based identity remains common.

There is no universal standard for weighting these signals yet. Current guidance suggests treating documents as one weak input rather than the primary proof. Some environments will overweight device possession because it is easy to automate, but that can fail when devices are shared, managed by a family member, or routinely wiped. Others lean on telecom reputation, yet number recycling and VoIP abuse can make that signal noisy if it is not refreshed frequently.

Behaviour-based risk also needs careful scoping. It works best when the organisation has historical baselines and clear privacy boundaries. If the available data is sparse, the model may over-flag legitimate users or create blind spots for new accounts. NHI Management Group’s research shows why layered signals matter: only 5.7% of organisations have full visibility into their service accounts, and 80% of identity breaches involved compromised non-human identities. That same visibility problem shows up in human verification when teams rely on a single artefact instead of current control signals.

Related resources from NHI Mgmt Group

• When should organisations use OAuth with JWT instead of one alone?
• What breaks when organisations try to use one control for both login and proofing?
• How do organisations operationalise NHI ownership at scale?
• How should security teams use IAST and RASP in NHI governance?