KYC is for onboarding. But after that, can businesses trust they’re interacting with their real customers?

Updated May 1, 2026

The FTC reported that nationwide fraud losses topped $10B in 2023, and they've only climbed since. Forged signatures. Forged documents. Forged activity across every digital channel. Fraud is hitting your business on all fronts, and the liability is landing squarely on you.

These aren't edge cases. Fraud is destroying people's lives, and it's happening everywhere.

• A California couple lost $49K after they wired money to a fraudster pretending to be a Chase bank employee. Another elderly Utah man lost $10K due to the same type of telephone spoofing scam.
• Elder fraud is a nationwide concern, with seniors losing $1.6B in financial crimes in 2022.
• A Missouri man had his mail stolen because a fraudster went online and changed the forwarding address. Then he was able to cash paper checks from the mail and steal the person's identity to open a credit card.
• A 92-year-old Dallas woman's identity was stolen and her house was sold without her knowledge. Property deed fraud is happening nationwide; here are similar stories from New York, Arizona and Michigan.

What do all these types of fraud have in common? They happen after onboarding.

Most people assume that rigorous KYC at account opening (a username, a password, maybe a document check) makes every future interaction secure. It doesn't. Identity verification was originally built for onboarding and compliance, but fraud doesn't stop at account creation. In reality, the liability and damages are even higher when someone forges a signature or fraudulently gains access to an existing account.

Secure every customer interaction, not just onboarding

Most people expect that customer identity is verified once, when an account is opened or a customer is onboarded. Every interaction after that? Secured with nothing more than a username and password.

That process falls short because usernames and passwords are too easy to compromise. Hundreds of millions of passwords have been exposed due to widespread data breaches. And two-factor authentication is no longer bulletproof; fraudsters pretend to be the bank and call customers for the six-digit code the bank just texted them.

Stronger methods exist, including biometric verification, document verification, and liveness detection, but most businesses only deploy them at onboarding, if at all.

A business receives instructions from their customers every single day. This happens either because their customer clicks a button or they sign documents. When a customer clicks a button in an online portal to withdraw or transfer funds, how does a company really know who is clicking the button? When a bank receives a digital or physical document (such as a POA or other directive) that instructs them to move money or make account changes, how can they trust that these artifacts are real? When a county recording office receives a deed, how can they trust it wasn't forged? It's becoming harder to know what's real and what's fake. Physical documents aren't any safer.

In our digital world, a simple document with an eSignature does not ensure that the identity of the signer is verified. You need evidence that proves the signature was completed by the desired signer. The Financial Crimes Enforcement Network found in 2021, US financial institutions reported 1.6 million cases of identity-related fraud activities, equivalent to $212 billion in losses.

Companies are now realizing that every single interaction with their customers needs to be secured. Bad actors aren't just making fake accounts.

• They're stealing the credentials of real customers.
• They're impersonating those customers and signing documents.
• They're logging into customer portals and wiring money.
• They're authorizing all sorts of critical transactions online.

Up until now, most businesses assumed online transactions were safe because most online companies require a username and password to do business. That's not enough. Every instruction (a wire transfer, a power of attorney, a sale authorization) can be cryptographically tied to a verified identity before it executes. That's the standard businesses need to hold themselves to.

‍

But businesses aren't doing verification before all of these important transactions in a customer's lifecycle. It's impossible to ask customers to show ID every time they want to use the bank's platform, because that creates too much friction. Banks also can't implement, operate and manage a full suite of fraud or risk tools for every single button on their website. This is why fraudsters are winning.

Fraud is rising and consumers are unprotected. So, regulators are stepping in and writing legislation that puts the liability for fraud on businesses. Now, it's your problem to solve. What's happening is that financial institutions are now getting sued when fraud happens on their platform.

How to build certainty into every customer interaction

The inevitable next question is how businesses can reliably add identity assurance to every single interaction. It's impossible to achieve this if a business uses one system to verify wire authorization, another system to sign documents and another system to submit a loan application. Businesses can achieve certainty by having a single identity layer that's bound to any interaction. You need one system whether a customer needs to sign, notarize, authorize, click or verify their identity.

Any universal identity layer needs to provide the following:

• It needs to be a platform that understands state laws and has those requirements built in.
• It's a platform that can be used to sign or notarize documents, and even perform identity verification when there's nothing to sign.
• A platform's identity verification methods must be audited and certified (i.e. NIST IAL2).
• You need a dynamic customer experience so that customers can step up to a trusted agent in real time (like a notary) when a person's identity is in question.
• You need real-time fraud monitoring that takes in data (like email address age, IP location, ID verification and more) to determine if a signature is being forged.
• A platform needs to furnish documents, evidence and artifacts that prove a person authorized or signed, and these artifacts need to be cryptographically secure so they can't be tampered with.
• Most of all, you need a platform that saves identity so a consumer does not have to scan their ID every single time they need to interact with your company.

This is why we've built Proof: to bring trust to every transaction on the internet.