Identity Verification Flaws in Onboarding and Account Recovery Pose Growing Security Risk

Beyond Traditional Authentication

While multi-factor authentication (MFA) and conditional access have strengthened login security, they do not resolve all identity-related problems. Attackers are shifting tactics from credential theft to exploiting weaknesses in how trust is established or re-established within an organization's identity lifecycle.

Vulnerabilities in Onboarding

The onboarding process for new employees presents a critical juncture for identity verification. If initial identity checks fail, an attacker can gain legitimate-appearing access to an organization's environment. An example of this is the joint alert issued in late July 2026 by the US Department of State and allies, warning that North Korean IT workers were impersonating foreign nationals to secure technology jobs by falsifying identity documents.

Account Recovery Exploits

Similar vulnerabilities exist in account recovery processes. Threat actor groups like Scattered Spider are known for their proficiency in social engineering, impersonating employees to trick service desks into resetting passwords and granting access. This tactic was linked to the 2025 M&S ransomware breach, which resulted in an estimated $400 million loss in operating profit due to lost sales.

The Core Security Challenge

The fundamental security question in these scenarios is the organization's confidence in verifying the identity of the person making a request. Verizon's Data Breach Investigation Report indicates that stolen credentials are involved in 44.7% of breaches, highlighting the ongoing challenge of identity assurance.