Identity Verification Under AI Pressure: 6 Key Stats for 2026

Most teams now have some kind of technical control meant to verify that a real person is present during remote identity verification. However, things get slightly more complicated when the interaction may no longer be a normal “human session”. AI-assisted actors can now move through onboarding, login, recovery, support, or transaction flows in ways that look user-like from a product perspective, while the actual actor behind the session is unclear.

The main risk here is not even fraud itself, but misclassification: legitimate assistance can be sent to fraud review, whereas scripted abuse blends into normal user friction if the ID verification system is lacking. That’s why human-presence checks need to preserve enough context to tell whether the interaction was user-controlled, assisted, automated, manipulated, or still uncertain.

The strongest human-presence controls will therefore combine policy and evidence. Policy defines which assisted actions are acceptable and which ones require step-up. Evidence shows whether the biometric was captured live, through a trusted path, during the same session, with enough context to defend the decision after a fraud case, complaint, audit request, or regulator question.

Only 46% of organizations say they can fully verify that biometric data was captured live. 

Another 52% have partial or no verification, while 2% are not sure.

It’s clear that the vast majority of organizations have biometric controls in place, but, at the same time, not everyone can fully prove the integrity of the capture event.

As a result, a biometric match can look persuasive while still resting on weak capture integrity. Recorded media, injection attacks, masks, generated faces, manipulated streams, and compromised capture paths all challenge the assumption that the person was physically present during verification.

The team must be fully aware of which attack types are tested, whether camera injection is covered, how live capture is tied to the document and session, what happens after low-confidence results, and what evidence remains for audit. A good control should help the team decide whether the person was present, whether the biometric came through a trusted path, and whether the decision can be defended later.

However, teams should also consider the business impact: stronger liveness controls can reduce false acceptance, but poor configuration can increase user friction or false rejection. That’s why there need to be risk-based rules in place: liveness checks for higher-risk sessions, review triggers for low-confidence capture, and documented rationale for any manual override.

This comes as little surprise as IDV teams are constantly dealing with a vast array of AI-related risks — and it’s not always easy to have full protection against every tool at fraudsters’ disposal.

The recommendation here is to view AI-content detection not as a standalone feature, but a critical part of the whole identity decision. 

To test your own efficiency, you can take a suspicious onboarding session and ask whether the team can reconstruct why it was allowed, rejected, or escalated. If the answer depends on scattered logs, missing vendor outputs, or analyst notes with no supporting evidence, then the detection capability may be technically present but operationally incomplete.

There is a difference between knowing that a decision happened and being able to reconstruct why it happened. Many teams are close to the first part; fewer can fully prove the second.

That gap becomes important in AI-assisted identity cases because the missing details are often the details that explain the risk. If the team cannot see the capture path, retry history, liveness result, device context, reviewer action, active threshold, or reason for override, the case record may be too thin to explain the final decision.

A mostly reconstructable decision may be enough for routine troubleshooting, but it can fall short when the same decision is challenged by a regulator, auditor, court, customer, partner, or internal fraud team. 

The next question is whether organizations can turn their internal trace into audit-grade evidence.

It's becoming more and more integral that companies can defend their decisions in case of a regulator inquest. However, the 26-point gap shows that not every company has yet caught up with ever increasing compliance standards.

More specifically, the gap often exists because IDV data is scattered. One vendor may hold capture evidence, another may hold liveness results, a fraud system may hold device or behavior indicators, the case-management tool may hold analyst notes, and a compliance system may hold the final customer-risk decision. 

Even when all checks ran correctly, the organization may struggle to reconstruct the chain later if timestamps, rule hits, model outputs, reviewer notes, and vendor responses were not retained in one defensible case file.

Considering the extremely high awareness of identity threats we saw in Part I (98%), it’s alarming that perceived accountability for bad reactions to these threats is so spread out.

It’s worth noting that the 98% figure refers to concern about identity-related threats overall, while the accountability question focuses specifically on AI-driven identity decisions. 

Still, we believe this fact doesn’t undermine the logic: broad awareness of risk does not automatically translate into clear ownership.

On the one hand, the split is fully understandable: AI-related identity decisions involve many actors at once. Business teams focus on conversion and customer experience, risk and compliance teams own KYC policy and audit exposure, security teams track abuse and account takeover, and vendors often provide the checks or data behind the decision. 

On the other hand, the shared concern can easily turn into shared ambiguity.

The fix is to separate ownership of policy, ownership of detection, ownership of case decisions, and ownership of remediation. KYC leaders should document who approves risk thresholds, who reviews suspected synthetic evidence or liveness failures, who can override an automated decision, who monitors vendor quality, who handles external requests for decision evidence, and who updates policy after a confirmed AI-assisted attack.

Predictably, teams with clear visibility into AI-assisted identity activity report stronger verification, governance, and evidence capabilities than those with limited visibility. What did surprise us, however, is the size of the gap.

This is interesting because visibility is often treated too narrowly, as if it only means detecting whether AI was used in a session. But the data suggests something more: teams that can see AI-assisted activity more clearly also report stronger controls, better liveness assurance, stronger synthetic-content detection, better decision reconstruction, and better audit evidence.

The full Regula survey report is publicly available — free, with no strings attached.

Want to know how Regula can help your business strengthen identity verification against AI-assisted threats? Talk to our experts.