Virginie Flam, Senior Vice President of Smart Biometrics, IDEMIA Public Security explains what happens to security when seeing is no longer believing.
Image Credits: Jonathan Moyal Photographie
You have said that the security industry is facing something deeper than a fraud problem. What do you mean by that?
Everyday life depends on recognition. A photograph was evidence. A voice on the phone provided confirmation. A familiar face on a video call meant your colleague was there.
These assumptions are so embedded that we stopped noticing them. They no longer hold. It is now easy to manufacture a convincing face saying convincing things in someone else’s voice. Fraud is where we see this first, but the problem is broader.
AI has turned impersonation into a scalable business model: identities, attack tools and synthetic evidence can now be created, sold and deployed with the efficiency of software.
Hiring interviews, payment approvals, password resets and remote onboarding can all depend on one person recognising another. Every process built on that assumption is now resting on ground that has shifted.
The defining question is no longer simply how to build a stronger lock. It is how to establish three things: is the person genuine? Are they the right person? Are they authorised to act? Most organisations cannot yet answer all three with confidence.
In 2024, a Ferrari executive reportedly received a call from someone who sounded exactly like his Chief Executive – and stopped a suspected fraud with a single question. What does that tell us?
The executive received messages about a confidential acquisition, apparently from Ferrari CEO Benedetto Vigna. A phone call followed. The voice was convincing, reportedly even reproducing Vigna’s accent.
But something felt wrong, so the executive asked about a book Vigna had recently recommended. The caller ended the conversation.
The comforting interpretation is that an alert employee can defeat this.
The important conclusion is that the organisation was protected by a memory shared between two people. That defence worked for one person, in one company, during one call. But you cannot run an airline, hospital, bank or border on trivia.
When the final line of defence is a book recommendation, recognition has stopped being verification. Organisations need a systematic way to establish identity, presence and authority.
Is this different from the identity fraud the industry has always managed?
Yes, in one respect. A stolen password circumvents a security control – a convincing deepfake may appear to satisfy it. The system examines the evidence it was designed to assess and reaches the wrong conclusion.
From its perspective, nothing has malfunctioned. A valid-looking credential, face or voice is no longer enough. Organisations must determine whether the evidence is connected to a person, whether that identity is trusted and whether they are authorised for that particular action.
This is why biometrics, verifiable digital credentials and access policies need to work together.
Biometrics establish the connection to the person. Verifiable credentials carry verifiable claims across physical and digital environments, while allowing people to disclose only what is necessary.
Access policies determine what the “person” is permitted to do. None of these elements are sufficient alone.
You lead a business line at one of the world’s largest biometrics companies. Has your own industry contributed to this situation?
We have, although perhaps not in the way people might expect. For roughly two decades, the identity industry has worked to make verification almost invisible: fewer steps, fewer prompts and less friction.
That ambition was right. Security does not improve because employees spend their mornings struggling with authentication screens.
The mistake was subtler. In removing friction, we sometimes also removed the evidence connecting an access decision to a genuine person. A token is passed between systems. A credential is replayed.
An approval is granted remotely. The experience may be seamless, but the organisation may retain little assurance about who was actually behind the decision. Synthetic identities, deepfakes and autonomous machines are exposing the cost. We were right to remove unnecessary friction.
The challenge now is to restore verifiable evidence without bringing back complexity.
Biometrics sit at the centre of that work, but they can frighten people. Are those fears misplaced?
Some are entirely justified. A centralised database containing poorly protected biometric data can concentrate risk and create opportunities for misuse.
Biometrics cannot be replaced as easily as a compromised password, so regulators and the public are right to demand strict safeguards.
But biometrics do not have to be centralised. In a decentralised model, an individual’s biometric reference can remain securely stored on their phone.
Matching takes place locally, under the user’s control, so the biometric data does not need to be transmitted to or retained by the organisation granting access.
The organisation does not receive a copy of the person’s face. Instead, it receives secure confirmation that the authorised user has authenticated using a trusted device and credential.
Combined with user-held verifiable credentials and selective disclosure, this allows people to prove who they are without repeatedly sharing their complete identity record. A face is not a secret. Biometrics should therefore not be treated like passwords.
Different environments require different architectures. Matching may take place on a phone, at an access point, on an edge device or within a governed system. In every case, the objective is to use and retain only the minimum data required, with consent and governance.
Privacy advocates and security engineers should want the same outcome: proof without surveillance and trust without unnecessary centralisation.
European regulations are reshaping cybersecurity, identity and AI. Will this resolve the problem?
Not on its own, but it is pointing us in an important direction. The Cyber Resilience Act introduces cybersecurity obligations across the lifecycle of products with digital elements. NIS2 reinforces risk management and accountability. eIDAS 2.0 advances identity that can be verified and used across services.
The AI Act introduces obligations and restrictions for certain biometric and AI applications.
These regulations are different, but together they reflect a shift towards accountable systems, verifiable identity, controlled access and protected data. The danger is treating compliance as a checklist.
A security program can pass an audit while leaving weaknesses unresolved. Regulation can establish expectations, but it cannot design an organisation’s identity architecture or connect isolated systems. Compliance should confirm a strong security strategy – not substitute for one.
What is coming next that security leaders may not be ready for?
The next major category of identities requesting access to our systems will not always be human.
AI agents already interact with software and complete transactions on behalf of users. Yet almost everything the industry has built assumes that a person is directly operating the device or application at the other end.
Verifiable digital credentials connect an agent to a trusted person or organisation and provide evidence of the authority it has been granted. However, no broadly adopted, end-to-end model has yet emerged. AI agents are arriving faster than the frameworks needed to govern them.
Suppose an organisation accepts your diagnosis. What does a genuine answer look like?
Fraud frequently succeeds at the handoffs between otherwise strong controls. In many organisations, one system enrolls a person, another verifies their identity, a third authenticates them and a fourth controls access.
When a credential is lost, a fifth process takes over, identity reconstruction, which may rely on weaker evidence than was initially required. Every handoff creates a seam, and those seams are where attackers look for opportunities.
The answer is continuity; a person’s identity should first be established with the appropriate level of assurance. That trusted identity can then be bound to secure physical and digital credentials and used across environments.
Recovery is particularly important. It should mean re-establishing trust in the person, not falling back on questions a stranger could research. The future of access is not simply better facial recognition or stronger authentication. It is a continuous identity lifecycle.
This means people can establish identity properly once and reuse that assurance appropriately, rather than proving themselves repeatedly.
How does this change the traditional separation between physical and digital access?
That distinction matters, but it does not matter to attackers.
The same employee may use a biometric credential to enter a building, a digital credential to access an application and another process to recover their account. If those systems do not share a coherent view, an attacker will target the weakest.
A compromised digital identity can have physical consequences. A poorly controlled recovery process can undermine both physical and digital security. The objective is not necessarily to place every system on a single platform. It is to create one continuous, interoperable chain of trust.
A security leader reads this on the way to a conference. What should they do differently next week?
Three things – none of which require an immediate purchase order.
First, identify every decision that depends on someone seeing or hearing another person. Second, map the complete lifecycle, paying attention to the handoffs between enrollment, credentials, physical and digital access and recovery.
Third, bring physical security, cybersecurity, identity and fraud teams into the same conversation. Your organisation may divide these responsibilities. Your adversary does not divide the attack surface. Then ask three questions at every critical moment
- Is the person or machine genuine?
- Is it connected to a trusted identity?
- Is it authorised to perform this action now?
Many organisations cannot answer all three consistently. Recognising that is the starting point for building something stronger. Identity has become infrastructure.
When its chain of trust breaks, banking, borders, healthcare, digital services and access can all break with it. Yet the trust layer on which these activities depend still receives less attention than other forms of critical infrastructure.
The organisations best prepared for what comes next will be those able to establish that the person is genuine, the identity is trusted and the action is authorised.
Virginie Flam
Virginie is Senior Vice President of Smart Biometrics at IDEMIA Public Security, which has spent five decades building the biometric and identity systems used by governments and enterprises worldwide.