Continuous authentication is the new trust infrastructure

By Bob Long, President of the Americas, Daon

The bar for establishing trust used to be relatively low. A user arrived, presented credentials matched to those on record, and was let in. From that point on, everything that followed was treated as legitimate. Because the person at the gates had the credentials to prove they were who they claimed to be, trust was assumed from the outset. That “trust but verify” approach worked when identity signals were clear-cut and hard to fake. A password, a device, or a quick biometric check carried enough trust to support an entire session.

AI has changed the economics of deception, and attackers are increasingly finding ways to bypass authentication altogether. Social engineering, especially AI-assisted phishing, has made credential theft faster and more scalable than ever. According to one report, losses from global AI scams could reach $40 billion by 2027, and deepfake-enabled “vishing” attacks increased by over 1,600 percent between Q4 2024 and Q1 2025 in the U.S. alone. Authentication controls are strengthening to combat this, but fraudsters continue to adapt, using malware, stolen session tokens, and device hijacking to bypass credentials entirely and take over active, trusted sessions. Strong authentication still matters enormously, but organizations can no longer assume that trust established at login will remain intact throughout the rest of a session.

Identity can no longer be tied to a moment in time, a specific device, or a single interaction. It has to follow the user, adapt to context, and respond to fraud risk as it evolves throughout a session. That’s the idea behind Identity Continuity: treating digital identity as a singular, persistent profile that is validated and revalidated across every interaction, in every channel, over time. With this approach, trust isn’t granted once and carried forward. It’s continuously earned, continuously assessed, and continuously reinforced. At a time when anything can be made to look real, sound real, and behave like the real thing, trust can no longer rely on appearances. “Looks can be deceiving” used to be a throwaway phrase, but today it’s a policy.

Where the ‘authenticate once’ model breaks down

The failure of the authenticate-once model shows up every day in the channels organizations rely on most. Take a typical web interaction. A user logs into a financial account, maybe once every 60 or 90 days, using a username, password, and perhaps a device check. At that point, the system assumes the session is secure. But if that device is already infected with malware, the door is open. From there, an attacker can observe, wait, and act at a vulnerable moment or when they stand to gain the most, whether that’s moving money, extracting sensitive data, or changing account details. The initial authentication event did exactly what it was designed to do. It verified access. What it didn’t do was protect everything that followed.

The same pattern plays out in contact centers, onboarding journeys, and workforce environments. A caller might pass an initial verification check, but that doesn’t guarantee the same legitimate person remains in control throughout the interaction. Consider this. Fraudsters are now capable of inserting themselves into live voice sessions, using the early moments of an interaction to build a deepfake of the account holder’s voice before taking over the conversation. The agent hears no change, but the fraud prevention model has completely broken down. Trust was effectively established at the start, but never meaningfully challenged again. This is frequently the case even when the stakes rise within an interaction.

Peeling back the layers of continuous authentication

If the problem is that trust decays over time, the answer to that problem isn’t to make a single check stronger. It’s to stop relying on a single check altogether. Instead of asking, “Is this the account holder?” once and moving on, the system needs to ask that question repeatedly, using a combination of signals that build confidence over the course of an interaction. Some of those signals are explicit, like a biometric check or a trusted device. Others are passive, like how someone interacts with a system, where they are located, or if their voice displays anomalies that indicate it was generated synthetically. Together, those signals help monitor the integrity of a session over time, identifying when behavior begins to drift away from what’s expected or trusted. When enough risk indicators accumulate, the system can respond dynamically with step-up authentication against a strong, identity-assured factor to re-establish trust before a high-risk action is allowed.

This is where the distinction between verification and authentication becomes important. Verification establishes that a person is who they claim to be at the outset, establishing a digital identity based on evidence by comparing the data to an authoritative record like AAMVA, matching the image on the ID to a selfie, or both. Authentication then takes over, confirming that the same legitimate user is present in each subsequent interaction. The problem is that, in many traditional systems, credentials are not strongly bound to the verified identity established during onboarding. Organizations may know who opened the account, but still rely on the assumption that the same person remains in possession of the credentials used afterward. In an Identity Continuity model, the primary authenticator is established automatically during verification and bound to a singular identity record for that verified identity that can operate across all channels. Subsequent use of that authenticator, or another strong, phishing-resistant credential derived from it, provides far higher assurance that the verified user is genuinely present throughout the interaction. In a continuous model, authentication doesn’t stop after login but adapts to context, evaluates risk in real time, and introduces step-up authentication when something changes.

Moving on from single-point checks

The challenge facing most organizations today is that their approach to identity security is heavily fragmented. Verification and credential establishment frequently happen as separate exercises and repeat across various channels. An organization may know who the account holder is, but have no assurance that the account holder was actually present when the authentication credential was created or that the account holder operating on one channel is the same account holder on another. Account recovery introduces another major point of weakness. In many systems, recovering access still depends on proving possession of something that may already be compromised, whether that’s an email account, a device, or an SMS channel. Each process may appear strong in isolation, but they don’t always share context or identity assurance, and that’s where risk begins to build. Fraud doesn’t need to break every layer; it only needs to find the gap between them. A compromised credential, a weak recovery flow, or an unchallenged session can undo everything that came before it, which is why treating identity as a series of disconnected checkpoints no longer works. Too often, organizations are left relying on assumptions that users will protect their credentials, avoid compromise, and recognize attacks before damage is done. The model assumes trust persists between checkpoints, even when the conditions around them have changed

A continuous approach, on the other hand, treats identity as a single, persistent profile that follows the user across channels, interactions, and time, rather than resetting at each stage of the journey. Verification, authentication, and recovery are no longer separate events but part of a coordinated system that continuously shares signals and context. That’s particularly important when users move fluidly between web, mobile, contact center, and in-person interactions, often within the same journey. The signals that determine trust need to flow across every touchpoint to ensure the validity of the final transaction.

Identity, access management, fraud, and compliance functions are beginning to converge around the same problem: establishing and maintaining trust in a world where nothing is necessarily as it seems. “Trust but verify” needs to become “verify before you trust”, but even then trust cannot be sustained on its own. If trust is the foundation of every digital interaction, then continuous authentication is the infrastructure that keeps it standing.

About the author

As President of the Americas at Daon, Bob Long leads the sales, business development, customer success, marketing, and operations for the region encompassing North America, South America, and Latin America.

Article Topics

biometric authentication  |  biometrics  |  continuous authentication  |  Daon  |  digital identity  |  trust infrastructure