TL;DR: Verifying identity only during initial registration is no longer enough to prevent modern fraud. Continuous authentication means verifying users continuously throughout a transaction. By combining device binding, behavioral analytics, and risk-based authentication, systems can detect account takeover and session hijacking before fraud occurs.
There is one assumption about transaction security that remains common in the digital financial industry: verifying a user’s identity during registration is enough to protect against fraud.
Strengthening security at the verification stage is important. However, fraud vulnerabilities do not only come from fake identities during registration. Fraud can enter at multiple points: during login, when accessing data, during transactions, and even during credential recovery.
The assumption that identity verification during onboarding is enough to protect an account is not entirely wrong. However, it is important to recognize that activity throughout the transaction also needs to be protected. This is why continuous authentication should be part of the security conversation.
Many financial institutions still rely on rigorous identity verification or e-KYC during onboarding. Once the transaction begins, the assumption is that the activity is being carried out by the legitimate user. There are no further checkpoints to verify that the person accessing the account is actually the rightful owner.
As a result, if a user’s password or OTP is stolen, their device is compromised, or their session is hijacked, the system may struggle to detect it. Fraud is often discovered only after the victim reports it, the money is gone, or trust has already been damaged.
Continuous authentication is a verification process that does not happen only during initial registration, but continues throughout a user’s activity on the platform.
With every login, access to sensitive data, and transaction, the system continues to ask: “Is this really the legitimate user?” It is not a question answered once, but one that is answered repeatedly.
Niki explained this approach during his AIBP Malaysia 2026 keynote: “Authentication should not be treated as a one-time event. You can do it every five minutes after session authentication to prevent sophisticated attacks such as session hijacking in the browser.”
Technically, continuous authentication works by comparing a user’s activity patterns against an established baseline. If anomalies are detected, such as a different device, unusual location, or unexpected interaction patterns, the system can increase the level of verification or even block access.
The challenge with continuous authentication is user experience. If every activity requires the same level of verification as the initial authentication, users will become frustrated.
The solution is risk-based authentication, where not every activity requires the same level of security.
“Low risk? Just tap. That’s enough, use the PIN on your device. But for high-risk operations, such as registering a new device or credential recovery, that’s where we raise the level with biometrics and make sure the account stays secure,” Niki explained during the AIBP Malaysia 2026 keynote.
With this approach, authentication can be tailored to the level of risk:
The result is stronger security without compromising the user experience.
All of this can happen within the system without creating additional friction for the user. Users can continue transacting smoothly while continuous authentication works in the background.
As fraud evolves into a structured industry, financial institutions can no longer rely solely on one-time verification.