Reinventing Identity Security: Why We Need a New Approach in 2025

May

2025

Time to read

Read so far

Written by:

Tony Ball

Time to read

Written by:

Tony Ball

Woman with a digital box around her face

Identity has been on a journey in the last 20 years. Rewind the clock and identity started as a thing we did face-to-face – trust was established on a human-to-human basis. For example, opening a bank account involved meeting your banker in person. You trusted the banker because you could meet them in the flesh, and they trusted you as a customer by meeting you in branch. This was identity 1.0.

Then in the last 10 years came a huge acceleration toward digital, the shift to online, and the advent of the smartphone. Interactions went remote, increasing the reach of financial services across borders and beyond, and we built banking and payment infrastructures capable of transacting in seconds. Remote identity verification, where a person uses their phone to take a photo of their identity document and their face, was a key enabler for this. Today, document and biometric-based identity (or identity 2.0) is a core part of our everyday lives.

Looking to the future, 2025 marks a turning point. We’re entering a new era: digital first world where identity credentials are formed online, and online first. Meanwhile the landscape today is markedly different from what it was 10 years ago. Identity 2.0 came with new challenges – from fraud to AI to compliance. Identity needs to adapt with this environment to keep up.

Just as we moved from physical solutions to digital-based solutions, from in-person to remote verification, we’re moving toward an era where identity is now central to every interaction we have online. And the way we handle identity must reflect that – from the way we detect fraud, to the compliance and standards that mandate how we verify and manage identity, to user-first experiences, privacy-led approaches, and the role of AI. 2025 is the time for identity 3.0.

Meeting today’s challenges head on – why now is the time for a new approach to identity

Identities are no longer confined to physical boundaries. They now encompass everything linked to individuals, organizations, or entities online – from usernames and passwords to biometrics, digital certificates, and online behavior. As the scope of identity grows so do the challenges of securing it.

Fraud is also more accessible and sophisticated than ever in 2025

An increase in sophisticated fraud demands more sophisticated approaches to identity in response. From deepfakes and fraud-as-a-service, to online sharing tactics and sophisticated software available off-the-shelf or via groups such as Telegram, the age of real-time deepfake fraud is here. For businesses, fraud can increase overall losses – global organizations lose on average 5% of their revenue to fraud every year. As an example of what's at stake for consumers, U.S. consumers lost $12.5 billion in 2024 – $2 billion of which was through a bank transfer or payment.

Exceptional customer experiences are table stakes

At the same time consumers are demanding more protection and security, they also expect more from customer experiences. Modern users expect more than just speed – they expect confidence. If an application feels clunky or untrustworthy, they’ll walk away. Research shows that up to 70% of potential customers abandon an application if it’s overly complex or lacks perceived security. For businesses, that’s a significant loss of revenue. In 2025 it's not enough to have either secure or seamless experiences – having both is a non-negotiable.

Compliance continues to increase in complexity and scope

From evolving identity standards including ETSI and NIST, to eIDAS changing the game in Europe with the introduction of digital wallets and eIDs, compliance is increasing in scope. We’re moving towards a future where we’ll have multiple modalities when it comes to identity, including physical IDs, digital IDs, databases, on-device signals, and more. It means more options but also requires more scalable and flexible solutions when it comes to managing identity. Increasingly, compliance teams must also wrap their heads around things like the Accessibility Act and the AI Act when it comes to technology they adopt and implement.

At the same time, none of these challenges exist in isolation. A key priority for businesses is managing the balance between fraud risks, security, and user experience. This is where identity becomes the enabler rather than the blocker. Identity isn’t about putting hurdles in place, or confronting users with a brick wall. It’s about getting the balance of risk right – providing genuine customers with easy access and allowing them to pass through the net, while stopping the fraudsters in their tracks, at every stage of the customer journey.

Identity is no longer just for day one. Rather, it connects critical moments across the entire customer lifecycle. Keeping customers safe online means not only proving identity at day one but also making sure that no one takes control of their accounts at day two, day 20, day 100, and beyond.

Moving to identity 3.0: What does this mean in practice?

So fraud is increasingly sophisticated and highly scalable; customers are more demanding than ever; and regulation is putting more constraints on how businesses can operate. The reality of 2025's landscape means many solutions businesses are using today are no longer fit for purpose. Solutions that are patched together with low-assurance signals and siloed across the user experience pave the way for access by bad actors while making it more difficult for genuine users to do what they need to do day-to-day.

This means striking the right balance of UX, risk, and security will continue to challenge users and organizations for years to come. 66% of organizations still believe that customer experience and fraud prevention are competing priorities.

This is why it's time to move away from one-time identity at onboarding, which creates friction at day one without much value downstream and leaves incomplete views of customer identity held together with dozens of low-assurance authenticators. Instead, we’re focused on building the infrastructure to secure the entire identity lifecycle, from day one to everyday, underpinned by the strong signals of trust that include facial biometrics and AI-powered fraud detection.

Our goal is to reinvent identity security to help businesses: prevent fraud such as deepfakes and account takeovers; establish trust across all interactions; and configure identity all in one complete platform designed for privacy, security, accessibility, ethics, and convenience.

Identity security: securing access across the entire customer journey

To unlock the full power of the customer lifecycle and prevent fraud and security risks, businesses today need to secure the vital moments of their customer journeys with real identity, built on a high assurance, trusted biometric established from the first impression. And as threats evolve, organizations must stay ahead with proactive measures that mitigate risk at every stage of the process.

Onboarding: The first line of defense is critical because it’s a step that is highly vulnerable to fraudsters using stolen or synthetic information. If not done securely, it opens the door to identity theft, credential stuffing, and damaged trust at later moments of the identity lifecycle.
Daily access: As individuals use accounts and conduct transactions, the risks of unauthorized access multiply. Attackers can intercept credentials through phishing, session hijacking, or exploiting weak authentication methods. This is why strong authentication is critical, especially during high-risk moments like transferring large sums or signing confidential documents.
Upselling: Expanding customer relationships, such as offering credit cards, loans, or new services, creates fresh opportunities for fraud. Without consistent identity verification, these high-value touchpoints can become entryways for bad actors.
Ongoing safety: The challenge of maintaining security doesn’t end after the initial setup or each session. Continuous monitoring is essential, yet the complexity of managing evolving threats, complying with regulations, and ensuring real-time responsiveness can overwhelm many organizations. Adaptive security protocols are key – without them there’s a heightened risk of data breaches, regulatory penalties, and costly fraud losses.

Key components of identity security

A robust identity security strategy must reflect that complexity, combining layered technologies that verify, authenticate, and monitor identities at scale to stop the bad actors at every point of access across the identity lifecycle.

An ideal approach is built on an integrated stack of capabilities that adapt to evolving risks and business needs:

Identity Verification: Confirm a person is who they say they are at onboarding with a library of global identity verification signals – including AI-powered document and biometric technology — to build trust with high assurance and minimal friction, catch fraud, and address compliance needs at scale.
Identity & Access Management: Manage user roles and permissions to ensure only the right individuals access the right resources so you can protect against account takeovers – from risk-based authentication to biometrics, passkeys, and certificate-based or step-up authentication.
Identity Orchestration: Coordinate all verification and authentication steps across platforms, automating decisions based on pre-set policies.
Fraud Detection Signals: Monitor behavior and device signals in real time to flag anomalies and stop suspicious access attempts.
Digital Signing: Sign anywhere in the world with the security and reliability you need. Operate faster, efficiently, and digitally with support for advanced electronic signatures, qualified electronic signatures, and document sealing.

Redefine Your Identity Journey

Our "A Guide to Identity Security" ebook combines in-depth analysis across multiple industries with current fraud statistics to help organizations secure their digital future – all while balancing security requirements and customer experience.

Download the ebook

Electronic and Digital Signing

Fraud Prevention

Identity and Access Management (IAM)

Identity Verification

Tony Ball

President, Payments & Identity

Tony Ball is President, Payments & Identity at Entrust, responsible for driving the evolution and growth of Entrust instant issuance, digital card solutions, identity verification, and secure digital interactions solutions. Mr. Ball joined the company in 2016 to lead the company's access control and authentication solution segments.

Mr. Ball has deep knowledge in the industry and previously served as President IAM for HID Global and as Senior Vice President for banking and security products for Gemalto across EMEA. He began his career at Schlumberger Technologies with over 20 years in multiple leadership roles across the globe preceding appointments to the executive ranks. Mr. Ball studied finance and business at Bournemouth & Poole College UK, and completed the IMD executive leadership program, Lausanne, Switzerland.

View all of Tony's Posts

Reinventing Identity Security: Why We Need a New Approach in 2025

Meeting today’s challenges head on – why now is the time for a new approach to identity

Fraud is also more accessible and sophisticated than ever in 2025

Exceptional customer experiences are table stakes

Compliance continues to increase in complexity and scope

Moving to identity 3.0: What does this mean in practice?

Identity security: securing access across the entire customer journey

Key components of identity security

Contact

Company

Newsroom

Product Resources