---
url: 'https://www.corbado.com/blog/identity-fraud-layered-authentication-identiverse-2026'
title: 'Layered Authentication: stop Identity Fraud without taxing every User'
description: 'Deepfakes, synthetic identities and fake employees: why risk-based layered authentication beats running one login flow for every user.'
lang: 'en'
author: 'Vincent Delitz'
date: '2026-07-31T09:02:04.809Z'
lastModified: '2026-07-31T09:03:08.488Z'
keywords: 'identity fraud, layered authentication, risk-based authentication, deepfake fraud, step-up authentication, CIAM fraud prevention'
category: 'Passkeys Strategy'
---

# Layered Authentication: stop Identity Fraud without taxing every User

## 1. Introduction: boring Half of Identiverse

If you read any recap of Identiverse 2026, it was about agents. Every keynote, every booth
and most of the interview stage. We covered that side in
[blended identity and runtime authorization](https://www.corbado.com/blog/blended-identity-ai-agents-identiverse-2026)
and in [shadow AI and agent debt](https://www.corbado.com/blog/shadow-ai-agent-debt-identiverse-2026).

But there was a quieter thread that matters more to anyone running consumer logins. It is
the same thread we were in Las Vegas for: our own session with
[VicRoads](https://www.corbado.com/blog/vicroads-passkeys) walked through taking passkeys live for more than 5
million users at a 70-90% activation rate. The fraud track was its natural counterpart.

The framing that cuts against the AI hype came early. Asked how much AI is changing fraud,
the answer split in two: AI is enabling genuinely new attack types like deepfakes, but the
bigger effect is as a force multiplier on schemes that have existed for a decade.

> "A lot of the traditional fraud schemes that we've seen over the past 5 to 10 years, we're
> still seeing them, but AI is now allowing the fraudsters to be more efficient and more
> effective in how they carry out those traditional schemes."

That distinction matters, because it decides where you spend. If it is mostly the same
attacks executed faster and at higher volume, then the answer is the unfashionable one: get
the fundamentals of authentication and risk assessment right, and make them work at scale.

## Key Facts

- **AI is mostly not inventing new attacks, it is making the old ones cheaper and faster.**
- The recommended architecture is **layered and risk-based**: assess passively first, then
  add friction only in proportion to the risk of the specific transaction. **"There's no one
  silver bullet."**
- Fraud has to be evaluated across the **whole account lifecycle**, not just at login.
  Quote, purchase, claim and sign-in are the same person, and most organisations verify them
  in separate silos.
- The newest pattern named on stage is **fraud from the inside**: candidates who pass a
  remote hiring process to obtain legitimate internal access. CrowdStrike investigated
  **more than 320** North Korean IT worker cases in twelve months, a **220%** year-on-year
  increase.
- External benchmarks confirm the scale. A Gartner survey of 302 cybersecurity leaders,
  published September 2025, found **62% of organisations experienced a deepfake attack** in
  the prior 12 months.
- The thesis in one line: **"Authentication is usually the strongest door. Recovery and
  enrollment are often the windows."** With the revenue side attached: **68% of applicants
  abandon online account opening** and **48% of consumers who hit digital friction moved to
  another bank**.
- Five places where **passkeys deliberately do not help**: recruitment interviews, credential
  reset, shared devices, deliberate credential sharing and AI agents. The anchor figure for
  the other 95%: **97% of identity attacks are password based** (Microsoft Digital Defense
  Report, 2025).

## 2. There is no silver Bullet, there is a Ladder

The central recommendation was layered authentication, and the fraud sessions were specific
about what that means operationally.

The sequence: assess passively first, using signals the user never sees. Device reputation,
behaviour and traditional identity signals such as name, address and date of birth. Then,
depending on the risk of that specific session and the risk of the transaction being
attempted, decide whether to add friction and how much.

> "Say you go to log in to your insurance account. We want to assess the risk of your device
> first. And if we see, okay, this is the device that we usually see Mike using, then maybe
> we just let him log in. There's no friction. But if we see some anomaly come up, depending
> on the risk associated, we decide what type of authentication method we provide. So
> everybody's not getting the same experience."

The anti-pattern is the one most organisations actually run: a single workflow applied
uniformly to every customer. Nobody should have to answer knowledge-based questions or
receive a [one-time password](https://www.corbado.com/glossary/otp) every time they check an insurance policy.

> "Imagine how cumbersome it would be if every time you had to sign in to your insurance
> policy, they made you do a quiz or a one-time password."

The internal business argument is worth stealing. Fraud is a small percentage of transactions
if you are doing reasonably well, so a control that taxes 100% of users to catch it is a bad
trade. Framing it as balancing fraud against customer experience is what gets it approved.

This is the same logic behind [passkeys](https://www.corbado.com/glossary/passkey) as a default path rather than a
step-up mechanism: the low-friction option should be the secure one, so that added friction
can be reserved for the sessions that actually warrant it. The following diagram shows how
a single session is routed through that ladder.

## 3. Fraud is a Lifecycle Problem, not a Login Problem

The second theme was that assessing identity once, at account creation or at login, is not
enough. The analogy used was a house with a front door, a back door and windows, where most
fraud programs secure one of them.

The insurance example walks the full arc. A consumer arrives on the website for a quote, and
that is the first point where device risk and identity need to be assessed, before any policy
exists. Months or years later the same identity comes back to file a claim. If the
verification happened properly at quote time, the claim can be matched against it. If it did
not, the claim is the first real check, and by then money is moving.

> "You need to be able to assess the risk of the identity every time that they come to
> interact with you."

The timeline below lays that arc out and marks where the silos break it.

That also corrects a common assumption about why insurance and healthcare get attacked. The
old thinking was that they are less exposed than financial services because there is less
direct money to steal. The actual prize is non-public data:

> "What fraudsters do is they leverage the vulnerabilities within insurers and health
> providers' systems in order to gain access to get data, which they can then turn around to
> continue to build out the profile that they've stolen so that they can then go on and do
> other frauds in other industries."

The organisational blocker is silos. Claims has a claims problem, underwriting has a bot
problem on the quoting platform and consumer experience has a login problem. All three are
the same person.

> "The consumer that gets a quote is the consumer that's coming to file a claim is the
> consumer that's coming to log in."

CIAM teams know that shape. Login data lives with one team, fraud signals with another and
support tickets with a third, so nobody sees the whole path a user took.

## 4. Weakest Handoff, not the weakest Door

The session that most directly confirms the argument in section 3 stated it more sharply than
we would have dared:

> "Authentication is usually the strongest door. Recovery and enrollment are often the
> windows."

The lifecycle map is the one to steal. Five stages, each with its own control and its own
characteristic failure:

| Stage | Control | How fraud gets through |
| --- | --- | --- |
| Onboarding | KYC and KYB proofing | A synthetic identity simply gets in |
| Enrollment | Credential binding | The fraudster binds their own passkey or device |
| Authentication | Login and step-up | Usually the strongest point |
| Recovery | Reset and re-proof | Knowledge questions and SMS reset become a trapdoor |
| Payments | High-risk actions | Authorized user, but is this a legitimate transfer? |

The conclusion is the sentence every CIAM team should have on a wall:

> "Fraud does not care about your IAM architecture diagram. It cares about the weakest
> handoff."

Note where a passkey sits in that table. It hardens exactly one row, and it can be
**bound by the wrong person** in the row above it. Enrollment binding is the step where a
strong credential gets issued to a fraudster, after which every subsequent login is
cryptographically perfect and completely wrong.

### 4.1 Numbers behind it

The figures the session was anchored to, sourced from TransUnion, Thomson Reuters, LexisNexis
Risk, the Financial Times and Signicat:

| Finding | Value |
| --- | --- |
| Global digital account openings suspected of fraudulent activity | 13.5% |
| Annual worldwide losses from synthetic identity fraud | $3.1bn |
| Annual global cost of financial crime compliance including KYC and AML | $10bn+ |
| Total cost of financial crime compliance, US and Canada | $61bn |
| Customers who abandoned an online account-opening application | 68% |
| Consumers who hit digital friction and moved to another bank | 48% |

The last two rows are the business case for layered authentication stated from the revenue
side rather than the security side. Two thirds of applicants abandon onboarding, and nearly
half of the people who hit friction take their money elsewhere. A control that adds friction
uniformly is not neutral, it is expensive.

The characterisation of the modern attacker explains why volume has changed:

> "The fraudster is no longer 'a person in a hoodie.' It is a small automation business with
> terrible ethics and excellent uptime."

## 5. Deepfakes: what actually changed

On the genuinely new side, one control pattern has settled for document-based verification: scan the document, check it is real and unmanipulated, take a
selfie with a liveness check to confirm a real person is present in real time rather than a
synthetic video, then match the two.

The external benchmarks put scale behind this:

| Finding | Source |
| --- | --- |
| 62% of organisations experienced a deepfake attack in the prior 12 months | Gartner survey of 302 cybersecurity leaders, fielded March to May 2025, published September 2025 |
| 41% experienced a deepfake combined with social engineering on an audio call, 35% on a video call | Gartner CISO survey, n=297 |
| Deepfakes are linked to 1 in 5 biometric fraud attempts globally | Entrust 2026 Identity Fraud Report, based on over one billion identity verifications |

The important nuance for authentication teams: deepfakes attack **identity verification**,
the process of proving who a new or unknown person is, far more than they attack
**authentication**, the process of proving a returning user is the same person as before. A
[passkey](https://www.corbado.com/glossary/passkey) is scoped to the domain it was created for and proves possession
of a private key, so it does not care what a face looks like on camera. Synced passkeys,
which are backed up and available across a user's devices, behave the same way here as
device-bound ones. That does not make deepfakes irrelevant, but it does mean the control
belongs at onboarding, recovery and high-risk step-up, not in the everyday login path.

Recovery is where the two meet, and it is the weak point in most consumer stacks. If a
sophisticated login is backed by a recovery flow that falls through to a call centre and a
few knowledge-based questions, that is where the attack goes. This is one of the
[day-2 problems](https://www.corbado.com/blog/passkey-day-2-problems) that only shows up after a rollout is live.

## 6. Where Passkeys stop helping

The most useful session for a passkey-first team was useful precisely because it opened by
conceding the point. First slide: **passkeys are transforming identity verification.** Second
slide: **sometimes passkeys can't help.**

The five gaps named are the ones a passkey rollout does not close:

- **Recruitment interviews.** No credential is being bypassed, because none has been issued
  yet.
- **Account credential reset.** The moment the cryptographic binding is deliberately broken.
- **Access to shared devices.** Where device binding stops meaning person binding.
- **Deliberate credential sharing.** A passkey handed over willingly is not an attack the
  protocol can see.
- **AI agents.** Software acting for a person, with no face and no device of its own.

The three figures anchoring those:

| Claim | Source |
| --- | --- |
| "Nearly every Fortune 500 company has unknowingly hired a North Korean IT worker" | Axios, 2025 |
| "One impersonation phone call. $100 million in damage" | MGM, 2024 |
| "97% of identity attacks are password based" | Microsoft Digital Defense Report, 2025 |

The last one is the argument for passkeys stated by someone who sells something else. The
first two are the argument for why passkeys alone are not a fraud strategy.

### 6.1 Genuine human Presence as the Root of Trust

The proposal: when a credential cannot be trusted to represent a person, the fallback has to
be evidence of a live human being, independent of any device. Liveness detection is expected
to move from **incremental to essential to foundational**, underpinned by a stack of
standards arriving at once: NIST SP 800-63-4, CEN/TS 18099, ISO 25456, FIDO work and eIDAS 2.

Whether liveness can carry that load is open, and it was raised as such on stage. The
structure of the argument holds regardless of vendor: a passkey proves the same device and
the same key are back. It does not prove the person behind it is who they were at enrollment,
and recovery is exactly where that distinction becomes expensive.

## 7. Newest Pattern: Fraud that gets hired

The trend flagged as newest is not consumer fraud at all. It is external actors using the
same synthetic-identity techniques to pass a remote hiring process:

> "The newest fraud trend that we're seeing is it being used to try to access internal
> systems. So this is somebody from a foreign country actually going through a recruiting
> process to apply for a job, getting onboarded so that they can get access to your internal
> systems where they've just hit the treasure chest of data."

This is well documented outside the conference. CrowdStrike's 2025 Threat Hunting Report
counted **more than 320** North Korean IT worker cases in twelve months, close to one
investigation per day, and a **220%** year-on-year increase in the activity it tracks as
Famous Chollima. Generative AI was used at every stage: drafting resumes, building false
identities and masking appearance during video interviews. The UN has estimated the scheme
generates between $250 million and $600 million per year.

It is an identity problem rather than an HR problem because the attacker ends with legitimate
credentials, issued by a legitimate process. No authentication control catches that, since
nothing is being bypassed. The controls that apply are verification at onboarding, least
privilege afterwards and behavioural detection.

It now reaches fraud vendors as the top enterprise concern from CISOs, and it extends past
employees to contractors and third-party vendors. It is also the same attribution problem the
agent track spent three days on, with a human in the seat.

## 8. Fight AI with AI, but keep the Fundamentals

Defenders need AI to keep pace with the volume and quality of AI-generated attacks, and that
retires nothing that already works. The signals the fraud track kept returning to are
unglamorous: device, behaviour, name, address, date of birth. The AI layer processes those at
machine speed and separates good patterns from risky ones.

The point that gets too little attention is that no single company sees enough of the
picture. Fraudsters are not industry-specific, and a profile assembled from a healthcare
breach gets monetised somewhere else entirely.

## 9. What to take back to a CIAM Team

Four things carry directly into a consumer authentication program.

**Stop applying one workflow to everyone.** The default path should be the low-friction,
[phishing-resistant](https://www.corbado.com/glossary/phishing-resistant-mfa) one. Step-up should be a response to a
signal, not a policy applied to the whole population. A single mandatory OTP for every user
is expensive in both SMS costs and abandoned sessions, and the burden falls overwhelmingly on
genuine users who never needed it.

**Instrument the whole journey, not just the login endpoint.** Signup, login, recovery and
high-value transactions are the same identity, and treating them as separate systems creates
the blind spot. Seeing that path end to end, across every method a user actually touches, is
the case for [authentication observability](https://www.corbado.com/blog/authentication-observability).

**Put deepfake controls where deepfakes attack.** Verification, recovery and high-risk
step-up. Hardening those is worth more than adding liveness checks to a routine login.

**Fix the fallback before it becomes the attack path.** Every recovery route that reverts to
a phone call, an OTP or a security question is where a well-defended login gets bypassed.
This is the specific failure mode we cover in
[passkey day-2 problems](https://www.corbado.com/blog/passkey-day-2-problems).

## 10. How Corbado can help

Layered authentication only works if the bottom rung is both low-friction and
phishing-resistant. That is the rung [Corbado Connect](https://www.corbado.com/connect) builds: passkeys as the
default path in an existing IdP or CIAM stack, so step-up can be reserved for the sessions
that actually warrant it instead of applied to everyone.

[Watch video](https://www.corbado.com/videos/connect/passkey-intelligence.mp4)

- **Passkey intelligence.** Decide per device and per user whether to offer, nudge or
  suppress a passkey, so the low-friction path is only shown where it will actually succeed.
- **Gradual rollout.** Rollout rules and A/B tests let you move traffic onto the passkey path
  in controlled steps rather than switching a population over at once.
- **Recovery and fallback in view.** Passkey management and fallback flows are part of the
  same instrumented journey, which is where the weakest handoff usually sits.
- **Every step recorded.** [Corbado Observe](https://www.corbado.com/observe) captures login, signup and recovery
  as structured events, so the friction you removed and the friction you kept are both
  visible per device, browser and market.

## 11. Conclusion

The agentic sessions got the attention. The fraud track had the immediately actionable
advice, and its message was deliberately unexciting: AI has made existing fraud cheaper and
faster rather than replacing it, so the response is to assess risk continuously, apply
friction proportionally and stop pretending a single authentication method fits every user
and every transaction.

The organisations described as mature were not the ones with the most tools. They were the
ones that had broken down internal silos and started looking at identity across the whole
customer lifecycle. Any team hits the same conclusion after their first year of running
passkeys at scale.

## Frequently Asked Questions

### What is layered authentication?

Layered authentication assesses risk passively before asking the user for anything, then
applies additional verification only in proportion to the risk of that session and
transaction. At Identiverse 2026 the sequence was described as device and
behavioural assessment first, traditional identity signals such as
name, address and date of birth alongside them and step-up authentication only where an
anomaly or a high-risk transaction warrants it.

### How is AI changing identity fraud?

Mostly by making existing fraud faster and cheaper rather than by inventing new categories.
AI was described at Identiverse 2026 as a force multiplier on schemes that have existed
for five to ten years, alongside a smaller set of genuinely new attacks such as deepfakes.
The practical implication is that the response is largely better execution of known controls
at greater scale, not a replacement architecture.

### Do deepfakes break passkeys?

No. Deepfakes attack identity verification, where an organisation is trying to establish who
an unknown person is, typically at onboarding or account recovery. Passkeys are scoped to the
domain they were created for and authenticate a returning user cryptographically, so a
synthetic face or voice on camera is irrelevant to the login itself. That holds for synced
passkeys, which are available across a user's devices, as well as for device-bound ones. The
exposure is in recovery flows that fall back to a call centre, an OTP or knowledge-based
questions.

### How common are deepfake attacks against organisations?

A Gartner survey of 302 cybersecurity leaders, published September 2025, found 62% had
experienced a deepfake attack in the prior 12 months. A separate Gartner CISO survey of 297
respondents found 41% had experienced a deepfake combined with social engineering on an audio
call and 35% on a video call. Entrust's 2026 Identity Fraud Report links deepfakes to 1 in 5
biometric fraud attempts globally.

### Why do fraudsters target insurance and healthcare?

For data rather than direct financial gain. Sessions at Identiverse 2026 explained that
insurers and health providers hold rich, non-public consumer data, and that fraudsters use
access to those systems to complete stolen identity profiles which are then monetised in
other industries such as financial services.

### What is the fake employee fraud trend?

It is the use of synthetic identities and AI-altered appearance to pass a remote hiring
process and obtain legitimate internal system access. CrowdStrike's 2025 Threat Hunting Report counted more than
320 North Korean IT worker cases in twelve months and a 220% year-on-year increase in that
activity, with generative AI used to draft resumes and modify appearance during interviews. It is difficult to catch with authentication controls because nothing is
being bypassed, so the defences are verification at onboarding, least privilege and
behavioural detection.

### Should every user get the same authentication flow?

No. Applying one workflow uniformly taxes the large majority of genuine users to catch a
small percentage of fraud. The layered approach described at Identiverse 2026 assesses risk
up front and then selects the workflow, so that recognised devices and low-risk transactions
proceed without friction while anomalies and high-value actions trigger stronger
verification.