At 8:17 on a Monday morning, Aya received a message from her bank.
A transfer had been attempted from an account she had never seen.
She opened her banking application. Her password still worked. Her phone was still in her hand. Nothing appeared to have been stolen.
Yet somewhere on the internet, someone was behaving as Aya.
The problem, she realized, was larger than a stolen password.
For years, people had spoken about “identity verification” as though identity were a single fact that could be checked. Show a passport. Take a photograph. Compare a face. Enter a phone number. Answer a security question.
But each method proved something different.
A passport could establish that a document had been issued to a particular identity. A biometric check could establish that a living person was present. A cryptographic credential could establish possession of a particular secret.
None of these, by itself, answered the question Aya was now asking:
Who is actually behind this account?
That distinction had become increasingly important as generative AI made fabrication cheap. A convincing photograph could be synthesized. A voice could be cloned. A video could be manipulated. Even identity documents were becoming targets for increasingly sophisticated digital alteration. Recent research into ID-document attacks has found that generative-AI manipulation remains difficult for automated forensic systems to detect reliably. (arXiv)
Aya opened the social-media platform where someone had also been impersonating her.
The account used her name.
It displayed photographs that appeared to be hers.
It even reproduced several expressions she commonly used in messages.
To an ordinary observer, the account looked authentic.
But authenticity and identity were not the same thing.
The platform could potentially verify that the account controlled a particular email address or phone number. It could examine login locations, device characteristics, behavioral patterns and account history. It could ask for government identification or a live biometric check in higher-risk situations.
Modern digital identity systems increasingly treat identity as a layered process rather than a single test. NIST’s digital identity framework distinguishes identity proofing from authentication: proofing establishes a person’s identity during enrollment, while authentication establishes that the person subsequently controlling an authenticator is the same account holder. (NIST)
That difference mattered enormously.
A photograph of Aya did not prove that Aya had written a particular post.
A government ID did not prove that Aya had pressed “Send.”
A facial match did not prove that the person currently operating an account was authorized to operate it.
And a password proved very little once somebody else had obtained it.
This was why authentication technology had been moving toward cryptographic credentials.
With passkeys based on FIDO2 and WebAuthn, the service does not simply ask the user to present a reusable secret. A cryptographic key pair is created, and authentication is bound to the legitimate service’s domain. The private key remains under the user’s control, while the service verifies a cryptographic response. This design makes conventional phishing and credential replay substantially harder. (FIDO Alliance)
NIST’s newer guidance explicitly recognizes phishing-resistant authentication and identifies WebAuthn as an example of verifier-name binding. (NIST Pages)
But even that did not solve Aya’s entire problem.
A passkey could establish that the holder of a particular credential was authorized to access an account.
It could not, by itself, establish that the account holder was a particular human being named Aya.
That was the deeper problem.
Online identity was not one thing.
There was identity proofing: Does this person correspond to the claimed real-world identity?
There was authentication: Does this person control the authorized credential?
There was authorization: What is this authenticated account allowed to do?
And increasingly there was provenance: Can other people determine whether this particular message, photograph, video, or document actually originated from the claimed source?
The last question was becoming especially difficult in the age of synthetic media.
A post could be genuinely published from Aya’s account and still have been written by an attacker who had taken control of it.
Conversely, a message could genuinely have been written by Aya and reposted through an account that was not obviously connected to her.
The username was merely a label.
The photograph was merely evidence.
The account was merely a container.
None was the person.
Aya’s security team eventually restored her account. They revoked existing sessions, registered a phishing-resistant authenticator, reviewed recovery mechanisms and examined recent access logs.
But the incident left her with an uncomfortable realization.
The internet had spent decades designing systems to answer the question:
“Can you prove that you possess this credential?”
The next generation would have to answer a much harder question:
“What, exactly, are we claiming to prove about the person behind it?”
There would probably never be one universal test.
Instead, trustworthy digital identity would emerge from layers of evidence: identity proofing when necessary, cryptographic authentication, device and session security, transaction risk analysis, provenance mechanisms, and carefully designed recovery procedures.
The goal was not to create an infallible machine that could look at a screen and declare, This is definitely Aya.
The goal was more modest—and more useful.
To make impersonation progressively harder.
To make stolen credentials less valuable.
To make fabricated identities more expensive to maintain.
And, whenever someone claimed “I am this person,” to ensure that the system could explain exactly what evidence supported that claim—and what it could not prove.
Because online, the most dangerous sentence was not always:
“I am someone else.”
Sometimes it was simply:
“Trust me. I am me.”
All names of people and organizations appearing in this story are pseudonyms
Comments