Identiverse 2026 had a more useful message than the AI hype
At Identiverse 2026, the loudest theme was agents. The more practical takeaway for CIAM and authentication teams came from the fraud track: identity fraud prevention is still mostly about executing fundamentals better, not betting on a single new control.
That matters because AI is changing fraud economics fast. As one speaker put it, many old fraud schemes are still the same schemes from the last 5 to 10 years, but AI makes them cheaper, faster, and easier to scale. So the real design problem is not “what magic product stops fraud?” It is how to build layered authentication and risk-based authentication that raise friction only when a session actually looks risky.
A good benchmark from the conference: VicRoads discussed taking passkeys live for more than 5 million users with 70–90% activation, later referenced as 80% mobile passkey activation across 5M+ users, and doing it without replacing the IDP.
The core idea: assess passively first, step up second
The strongest pattern from the conference was simple: start with passive signals, then apply step-up authentication only when the risk justifies it.
That means looking first at signals such as:
- device reputation
- behavioral signals
- name, address, and date of birth
- anomalies in the current session
- the risk level of the attempted transaction
Then decide what happens next. If a user shows up on their usual device to check an insurance policy, they should not be forced through the same challenge as a suspicious session attempting a high-risk change.
This is why passkeys fit so well into consumer login security. The default path should be the low-friction, phishing-resistant one. Extra friction belongs in exceptions, not in the baseline.
The anti-pattern is familiar: every user gets the same OTP, the same knowledge questions, the same clunky fallback. That taxes 100% of users to maybe catch a small fraction of bad sessions.
Fraud is a lifecycle problem, not just a login problem
One of the sharpest points from the article is that fraud does not line up neatly with IAM system boundaries. The same identity appears at onboarding, enrollment, authentication, recovery, and payments, but many organizations still defend those stages in separate silos.
Here is the practical model:
| Lifecycle stage | Main control | Common failure mode |
|---|---|---|
| Onboarding | KYC / KYB proofing | A synthetic identity gets in |
| Enrollment | Credential binding | A fraudster binds their own device or passkey |
| Authentication | Login and step-up | Often the strongest point |
| Recovery | Reset and re-proof | SMS and knowledge-based recovery become the trapdoor |
| Payments | High-risk actions | The user is authenticated, but the action is fraudulent |
That leads to a useful rule: focus on the weakest handoff, not the strongest door.
Passkeys can harden authentication, but they do not fix a bad enrollment or a weak account recovery fraud prevention flow. If the wrong person binds the credential at enrollment, later login can be cryptographically correct and still operationally wrong.
Deepfakes and synthetic identity attacks hit verification first
Deepfake attacks matter, but mostly in identity verification, not routine authentication. The article makes this distinction clearly.
Passkeys prove possession of a private key scoped to a domain. They do not depend on what a face looks like on camera. That means deepfakes are more relevant in onboarding KYC, recovery, and high-risk step-up than in ordinary sign-in.
The same is true for synthetic identity fraud and the “fraud from the inside” pattern. CrowdStrike investigated more than 320 North Korean IT worker cases in twelve months, a 220% year-on-year increase. In those cases, the attacker often gets legitimate access through a legitimate process. Authentication controls do not catch that, because nothing is being bypassed.
That is why layered defenses need to extend beyond login to verification, least privilege, and continuous assessment.
Observability is what turns theory into operations
Most teams say they want risk-based authentication. Fewer can actually see where friction happens, where fallback gets abused, or which devices break the intended flow.
That is where authentication observability and process mining become operationally important. Login, signup, recovery, and transaction step-up should be measured as one connected journey, not as isolated events in separate dashboards.
Corbado is a passkey observability and adoption platform for large B2C enterprises.
The broader lesson is straightforward: if you cannot see your enrollment and recovery paths with the same clarity as your happy-path login, attackers will find the window while you keep polishing the front door.
Read the full breakdown.
Top comments (0)