Identity checks at signup are not enough, a new report warns

Passing an identity check at signup does not make an account safe for good. That is the main message of a new report from Regula, titled Identity Verification Trends and Predictions 2027. It says businesses should judge identity checks across the whole life of a customer account, including recovery, support requests and AI agents acting for the customer.

One weak path is enough

Regula says attackers do not need to beat every safeguard. One route around a required step is enough, such as a weaker recovery flow, an exception, or a step that can be skipped. The report also says the setup guides that help developers connect a service can show attackers where to probe. AI may speed that up. Regula points to PHP2Shell research, which showed AI can help turn complex software flaws into working attacks.

AI agents need their own permission

Verifying a customer does not show what that customer's AI agent is allowed to do. Regula gives an example. A customer lets an agent book a flight for up to $1,000. The travel platform hands the payment step to a second agent. The payment provider must confirm the customer's approval, the spending limit, and that the second agent is entitled to act. If the price rises to $1,200, the original permission no longer applies and the customer must approve again.

The report notes that some US banks are already blocking third-party AI agents. Regula expects more demand for permission records that a receiving service can check on its own.

Explaining a decision later

Regula's research found that 82% of organizations surveyed had been asked by an outside party to justify an identity decision. In answer to a different question, 50% said they could rebuild a verification decision. The report expects more demand for records that link the evidence, the checks and the decision rules, even after a workflow has changed. The summary does not say how many organizations were surveyed.

Regula's chief technology officer, Ihar Kliashchou, noted that a customer who passes onboarding may return months later through account recovery, customer support or an AI agent. At that point, the business must know what the first check proved and whether that proof is still enough.

What to ask providers

Regula expects businesses to define which events call for which proof. A lost device and a sensitive account change may need different responses. Sometimes confirming a password or security key is enough. Other times a new identity check is needed. The goal is to avoid making returning customers repeat full signup. The report ends with five questions for verification providers, covering:

• Workflow security
• Reverification
• Auditability
• Data control
• Adaptability to new requirements