Verify online that someone is who they claim to be.
Determine if that person is also allowed access to a service, system, or location.
•
Passwordless authentication:
o
Via biometrics (Face ID, Touch ID)
o
Via device-based access (e.g., FIDO2/WebAuthn)
o
Through magic links or push notifications
•
Example: log in using only facial recognition with your phone as the key
•
Identity is no longer with a central party, but with the user themselves
•
Development with digital wallets, supported by standards such as Verifiable Credentials (VCs) and DIDs (Decentralized Identifiers); the EU mandates that each member state ensures an eID wallet by mid-2027.
•
User shares only the strictly necessary information
•
Authentication is no longer a one-time action during login
•
Access is dynamically adjusted based on behavior, location, time, device, and risk
•
Example: silently logging out or performing an extra check for suspicious behavior or for payments above a certain threshold.
•
Authentication is combined with behavioral analysis and AI:
o
Typing behavior, mouse movements, navigation paths in apps
o
Real-time anomaly detection
•
AI determines if access is suspicious and activates additional verification if necessary.
•
Solutions like FIDO2/WebAuthn, eIDAS 2.0, NIST SP800-63b will set the standard
•
More countries and sectors are contributing to a pan-European digital identity (such as through EUDI wallets)
•
Authentication is seamlessly integrated into:
o
Onboarding processes
o
Contract Signing
o
Transaction approvals
•
Think: iDIN + biometrics + selfie ID verification + 2FA, completed in 30 seconds
•
Move away from passwords only: integrate MFA or passwordless authentication with Selfie, Fingerprint, or iDIN / itsme / Verimi / okID
•
Choose API-first solutions that easily integrate into your own platform
•
Integrate authentication into the customer journey (combining UX and security)
•
Stay up-to-date with regulations, such as:
o
eIDAS 2.0 (EU Digital Identity)
o
NIS2 (cybersecurity directive)
o
Wwft / GDPR compliance
