What Your Customer’s Approval No Longer Proves

National electronic identity schemes tell you who approved a transaction. They do not tell you whether that person was anywhere near what they approved, and both organised fraud and credential-sharing services have learned to work in that gap. I argue that businesses cannot close it on their own, and that the change has to come from the schemes themselves.

Three scenes

You run a service your customers reach remotely: insurance, banking, telecoms, healthcare, a public portal. Three things happened last week at businesses like yours. Not one of them raised an alert.

A retired teacher gets a phone call. Money is leaving her account right now, the voice says; it has to be stopped this minute, and the only way to stop it is for her to confirm the cancellation herself. A request will appear on her phone: approve it, and the payment is blocked. The voice keeps talking, keeps her on the line, never leaves a gap long enough for her to wonder. Her phone buzzes. She enters her PIN. What she has just approved is the payment.

A man gets a text message from his bank: a payment he does not recognise is about to leave his account, and he should check immediately. He taps the link. The site looks exactly as it should, because it is a copy that passes everything he types straight through to the real one. He logs in. His phone buzzes exactly when he expects it to, and he approves. Nothing about the request looks wrong, because nothing about it is wrong. It is a real request from his real bank. It is just not his session. Somebody else is now signed in as him and is about to make the payment the message warned him about.

A man wants a better deal on his insurance. A comparison service offers to do the work for him. He just gives it his login. From then on, the service wears his identity: it does not act on his behalf, it acts as him. He trusts it to compare prices; he cannot see what else it does in his name, and he has no way to control it.

Three events. In the logs of three different companies: three identical, flawless, fully compliant high-assurance authentications.

What you thought you bought

At some point your business connected to your country’s national electronic identity scheme. Most countries now have one of their own. They are separate services, built to a similar design.

There was no real alternative: nothing else came with a national user base already in place. Your customers already had it on their phones. Your regulator recognised it. Your competitors had been using it for years. Somewhere along the way it became the national standard for proving who somebody is, and its reliability is not something anyone in your organisation is expected to question.

But what you were really relying on was never the login. It was evidence: three claims you could stand behind afterwards. This was your customer. They were present. They understood what they were agreeing to.

Any of the three can fail now, and nothing in the record tells you which one did. All you know for certain is that your customer’s credential was used.

The gap

Notice what nobody checked in any of those three scenes: whether the phone doing the approving and the screen showing the transaction were in the same room, or a thousand kilometres apart. Nothing in the chain establishes that the person approving is anywhere near the thing being approved. The approval is portable, and it can be given at any distance.

Worse, the attacker often picks the moment. Triggering the prompt usually needs nothing more than the national personal identity number, the local equivalent of a social security number. How well that number is protected varies a great deal from one country to the next. Where it is easy to come by, the fraudster can make your customer’s phone buzz and call in the same second to explain why.

None of this is a defect, and none of it is vendor negligence. It is a deliberate design from a period when the mobile phone was the only reliable way to reach a citizen. It is what made these schemes possible at all. It also made every transaction structurally an identity-not-present transaction, and we have carried on treating them as though the customer were standing at the counter.

Why this is different now

Two public facts from my own part of Europe, and they fit together.

Supply. In August 2026, Latvia’s road traffic safety administration disclosed a breach of historical payment records: names, personal identity codes, registered addresses, vehicle plates. It covered 1.2 million individuals and 200,000 companies, in a country of fewer than two million people. In practice that is almost every car owner in the country, myself included.

Demand. In December 2025, Eurojust coordinated raids on fraudulent call centres operating out of Ukraine and targeting victims in Latvia, Lithuania and the Czech Republic. Around a hundred employees, recruited across Europe. Commission of up to 7% of proceeds, with bonuses of cars or apartments for anyone clearing €100,000. More than 400 identified victims and over €10 million in losses, roughly €25,000 each.

Personal data on one side, an industrialised sales organisation on the other. Neither is an authentication story on its own. Put together, they describe the conditions your authentication now has to work in.

Why you cannot fix this on your side

I have lost count of the people around me who have had one of these calls. How many have you heard about?

After the Latvian breach, the national computer emergency response team (CERT) advised citizens never to approve an authentication request they had not initiated themselves. The advice is correct. It is also, at national level and following an incident of that scale, the strongest control anyone had available. Not because the CERT is weak, but because the design leaves no other lever to pull.

Consider what that lever is up against. On one side of the phone call: a person who read a warning leaflet once. On the other: a salaried professional on commission, working from a script, with a supervisor and a bonus plan, doing this for the fortieth time today. Awareness training makes the customer the last line of defence against a professional who does this for a living.

I work on identity for an insurer, so I look at this from the side that integrates these schemes rather than the side that builds them. From where I sit the options are narrower than they look. You do not own the identity provider or its roadmap. Step-up authentication does not help when every step shares the same weakness. Your fraud engine sees a clean session, a familiar device pattern and a valid signature, because that is exactly what it was. When the customer comes back and says it was not them, that signature is what your disputes process has to work with. Everything you can build on your side is a compensating control, not a cure.

What proximity means

One sentence: the approval must happen next to the thing it approves.

Passkeys are the familiar illustration. A passkey is bound to the origin it was created for and to the device holding it, so the credential cannot be presented to a site that is not the real one. Phishing against that credential is not made less likely, it is made impossible, because there is no way to present the credential to the wrong site at all. Passkeys are not a drop-in replacement for a national scheme, and nobody should pretend otherwise. The point is narrower and more useful: the industry now has a working example of what it looks like when presence is built into the design instead of being asked for.

And it does more than stop fraud. Scraping behind a customer’s login ends with it too. What ends is the impersonation, not the service: an aggregator would still be free to offer exactly what it offers today, it just could not do it by becoming the customer. It would have to ask for the data it needs, for a stated purpose, and be told yes or no. That is a better product than the one those customers have now, and it does not leave anyone carrying a risk they cannot see.

What only the schemes can do

The technology is no longer the obstacle. Apple, Google and Microsoft have spent years moving ordinary consumers onto passkeys, at a scale nobody else could have tested. That was the hard part, and it is now behind us. What has not followed is the other end of the market: the schemes standing behind contracts, payments and sensitive personal data, where the assurance matters most.

None of that makes the change cheap, and two objections deserve stating plainly.

Investment. Many of these schemes were built and funded by the banking sector. Adding proximity binding means rebuilding and writing off part of what was built. Set against that is what the gap already costs, year after year, in fraud operations, dispute handling and awareness campaigns that never remove the cause.

The people it would hurt most. Any change to how people authenticate falls hardest on those who find it hard already: customers who are less confident with digital services. They are also the ones the fraudsters call first. Whatever proximity would cost them, the flow they have today is not protecting them.

So, what we are asking for is simple. An approval used to prove that it was your customer, that they were there, and that they knew what they were agreeing to. Today it proves only that their credential was used. Proximity is what brings the rest back.

There is also a question of timing. European digital identity wallets are being built now, under rules that are already agreed. Rules do get revised, and protecting people from this kind of fraud is a fair thing for the next revision to take on. In the meantime, the wallet market is open by design. A provider is free to offer proximity-bound approval and to compete on it.

Card-present, twenty years on

The payments industry has been here before. It did not solve card fraud by asking people to be more careful. It separated card-present from card-not-present, admitted that the second was structurally weaker, and then changed what a transaction required.

Digital identity is roughly where cards were twenty years ago, except that the industry has not yet admitted the distinction exists.

What to do next

European digital identity wallets are arriving, and with them a choice of providers. Proximity-bound approval is something you can require of them, and something you can choose between them on, while the market is still forming.

With your existing scheme, ask where it stands on proximity binding: whether it is on the roadmap, what it would take, and what would trigger it. No provider will rebuild for one customer, but enough of them asking the same thing is how these schemes have changed before.

Until that changes, the rest stays with you. Every remote approval you accept is a decision about how much evidence that transaction deserves, and nobody else is going to make it for you.