A bank or payment provider must decide two related questions: who is opening an account, and whether the person authorising a payment is entitled to do so. Better identity tools can reduce friction, but they do not answer both questions automatically. A genuine customer can be manipulated into sending money to a criminal, while a convincing digital credential may still be obtained with stolen or fabricated evidence.
The Financial Action Task Force’s digital ID guidance describes how reliable digital identity can support customer due diligence when assurance and governance are appropriate to the risk. It does not turn an identity check into proof that every later transaction is legitimate. This distinction matters as payments become faster and remote onboarding becomes routine.
Identity assurance has layers
Identity proofing is the process of establishing a person’s identity. Authentication checks that someone accessing an account controls an approved credential. Authorisation determines what that person can do. These steps may share data, but a failure at one layer can have a different consequence from a failure at another. Treating a successful login as sufficient evidence for any unusual transfer can leave a payment provider exposed to social engineering.
The US NIST Digital Identity Guidelines organise identity proofing, authentication and federation into separate components and assurance levels. They provide a useful framework beyond the United States, although firms must still follow their own jurisdiction’s requirements. The practical question is whether a service applies an appropriate level of assurance to the action and can explain why it chose that level.
For onboarding, a strong process checks the quality of evidence, how it was issued and whether the applicant is linked to it. A biometric match may help with that link, but biometrics alone cannot establish that the source document is genuine or that the account will be used lawfully. Providers also need a secure way to handle customers who cannot use a particular device, have limited documentation or need to recover access after a phone is lost.
Fraud can move rather than disappear
Stronger authentication can deter account takeover, yet criminals may change tactics. The joint ECB and EBA report on payment fraud found that strong customer authentication remains effective while fraudsters adapt. A payment authorised by the actual customer can still result from deception. That makes transaction context, beneficiary checks, warnings and escalation routes important companions to identity technology.
A well-designed system can make an unusual payment pause for a reason the customer understands. It might ask for additional confirmation when a new recipient is added or when a transfer differs sharply from normal activity. Excessive challenges, however, can push customers toward unsafe workarounds or exclude people who cannot complete a digital step. The goal is a response proportionate to the transaction and the evidence of risk, not maximum friction everywhere.
The BIS review of digital fraud describes the range of fraud threats and supervisory responses. One implication is that identity data, payment monitoring and customer education must be considered together. A firm that invests heavily in document verification but lacks an effective process for reporting and freezing suspicious activity may still struggle to limit losses once fraud begins.
The recovery process is part of security
Account recovery is often the route an attacker seeks after strong login controls have been installed. Help desks need a way to verify a legitimate customer without allowing a caller with partial personal information to reset a credential. Password resets, device changes and changes to contact information should be logged and monitored, with clear rules for high-risk transfers soon afterward. Equally, customers who lose access need a realistic route back into essential payment services.
Privacy and data retention deserve equal weight. The more identity attributes a provider collects, the more sensitive material it must protect and govern. Centralised credentials can simplify verification across services while concentrating the impact of a breach or outage. Decentralised approaches may reduce some data sharing but introduce questions about recovery and acceptance. There is no universal architecture that removes all of these trade-offs.
Measure the outcome
Success should be judged through fraud losses, false rejections, account recovery failures, onboarding abandonment and the time taken to resolve disputes. A provider should also examine who is excluded or delayed by an identity control, and whether manual reviews are applied consistently. An improvement in one statistic can hide deterioration elsewhere: fewer account takeovers may coexist with more authorised push-payment scams.
The Financial Stability Board’s assessment of AI in finance flags both the potential for better controls and risks including fraud, data quality and third-party dependence. AI tools can help find patterns, but model outputs require testing and governance. An identity decision that cannot be reviewed, explained or corrected creates operational and customer-protection problems of its own.
Verify intent as well as identity
A customer can pass a biometric check and still be acting under pressure from a scammer. Payment controls should therefore evaluate the recipient, amount, timing and recent account changes as well as the strength of authentication. A newly registered device followed immediately by a large payment to a new beneficiary is different from a recurring utility bill, even if the same verified customer initiates both.
This distinction affects the wording of customer warnings. A generic warning shown on every transfer is easy to dismiss. A targeted message that explains why the payment is unusual can give the customer a better chance to reconsider. It should also tell the customer how to contact the provider through a trusted channel. When a warning cannot be completed by the customer, a review should have a clear response time and an accessible alternative.
Interoperability changes the risk map
A reusable digital identity can reduce repeated checks when customers move between services. But reliance on a shared issuer or credential platform can make its outage or compromise affect many providers at once. Participants should understand who verifies the credential, who can revoke it and how rapidly a change is reflected throughout the network. Contracts and technical standards should define those responsibilities before a dispute or incident occurs.
A shared credential also raises questions about data minimisation. A payment provider may need assurance that a person passed a required check without needing a copy of every document used to establish identity. Sharing the minimum necessary information can reduce exposure if systems are breached. It cannot remove the need for auditability, especially when a decision blocks access or a customer disputes a transaction.
The inclusion test
A digital route can make account opening faster for many people, including those who live far from a branch. It can also fail for customers without a recent smartphone, consistent connectivity or documentation that automated systems recognise. Providers should measure abandonment and rejection by reason, review whether manual alternatives work, and avoid interpreting every failed digital check as evidence of fraud.
Accessible recovery is especially important for older customers and people with disabilities. A secure assisted channel can provide a route back into an account without weakening the default digital controls. The design challenge is to prevent fraudsters from exploiting that channel while ensuring that legitimate customers are not locked out of essential services. Testing should include real recovery cases, not only a demonstration of successful onboarding.
Governance after launch
Identity systems change as fraud tactics, devices and customer behaviour change. A risk committee should review false positives, confirmed fraud, appeals and the effect of model or vendor updates. If an automated rule produces unexpected exclusions, there should be authority to pause or alter it. Audit trails need to record what evidence informed a decision and which version of the control was used.
Vendor oversight matters when a bank relies on an outside provider for document checks, biometrics or risk scores. The provider may perform the technical service, but the financial institution remains responsible for the customer outcome and its own regulatory obligations. Contracts should cover error reporting, testing, incident notification, data handling and the ability to review decisions. Identity can be a useful shared infrastructure only when accountability remains clear.
Digital identity is becoming part of payments infrastructure because it affects who can enter a financial service and how safely money moves afterward. The strongest approach separates proof of identity from proof of intent, matches assurance to the action, and offers customers a secure path to challenge mistakes. Technology helps, but the control is only as effective as the surrounding decisions and response processes.
Sources
Financial Action Task Force’s digital ID guidance
NIST Digital Identity Guidelines