Identity proofing

Identity proofing happens before any account exists. It is the process of establishing that a person is genuinely who they claim to be.

Authentication afterwards only ever proves that whoever is logging in is the same entity that set the account up. If the wrong person set it up, every subsequent login is a perfectly valid login by an impostor. That distinction matters at the point of onboarding and at the point of recovery, which is where a lot of fraud actually enters, because the security of every login afterwards rests on a decision made once, early, often by somebody under time pressure.