Travis McGregor is CEO and Co-Founder of SLC Digital, a hardware-rooted transaction assurance platform helping enterprises combat AI fraud.
For years, we’ve told ourselves a reassuring story about digital identity.
If someone can access an email account, receive a text message or tap “approve” in an app, we assume they must be who they say they are. On that assumption, we’ve built financial systems, enterprise workflows, consumer platforms and approval chains that move quadrillions of dollars in value flows each year.
That assumption is no longer safe. Artificial intelligence (AI) has exposed an infrastructure for digital trust built on assumptions instead of proof.
The Reality Of Modern Fraud
Today’s attackers increasingly bypass security not by breaking encryption, but by impersonating legitimate users and moving through controls that were never designed for sustained adversarial pressure.
Email accounts are compromised. Phone numbers are hijacked through SIM swaps and port-out fraud. App approvals are socially engineered. And AI has accelerated all of it. Deepfakes, voice cloning, synthetic identities, automated phishing and AI agents have made impersonation faster, cheaper and increasingly scalable.
The financial impact is significant. Cyber-enabled fraud continues to generate billions of dollars in reported losses annually in the United States alone, underscoring the growing cost of compromised accounts, impersonation and socially engineered transactions.
Why Traditional Authentication Is No Longer Enough
As organizations optimized for speed and user experience, identity became less about proof and more about whether a user’s behavior looked legitimate enough to continue.
Multi-factor authentication remains essential, but not all authentication factors provide the same level of assurance. Some widely deployed approaches still depend on communication channels and user interactions that can be intercepted, manipulated or socially engineered.
Email addresses and phone numbers were designed for communication, not for proving identity. A password plus a one-time code adds confidence, as does a push notification approved in an app, but neither necessarily proves that the authorized person approved the action.
I’ve spent more than three decades building companies across the mobile ecosystem, working with networks, devices and the infrastructure underlying global connectivity.
I’ve repeatedly seen the same pattern: When security fails, it isn’t necessarily because organizations lack tools. It’s because we keep layering controls on top of systems that were never designed to establish trust. We’ve tried to solve architectural problems with workflows, alerts and user judgment.
What Comes Next
No single technology will solve identity fraud, but organizations should begin evaluating authentication methods based on whether they can provide verifiable proof rather than another signal for attackers to manipulate. Passkeys, hardware-backed credentials, secure device and network authentication, transaction signing and step-up controls for high-risk actions all move the industry toward stronger forms of verifiable trust.
An important emerging category is hardware-rooted authorization, which binds trust to protected cryptographic keys in secure hardware and proves that an authorized device is present and participating when an action occurs. SIM/eSIM secure elements, trusted execution environments, secure enclaves and other hardware-backed architectures can provide this trust anchor. These approaches can move organizations beyond asking whether an action merely looks legitimate and toward establishing that a trusted credential is present and cryptographically participating in the authorization process.
The next generation of digital trust must establish not only who is accessing a system, but whether a trusted credential is present and whether a sensitive action was explicitly authorized.
What Executives Should Do Now
This isn’t just a security matter. It’s an infrastructure decision that leadership owns. Here’s where executives can act:
• Re-Examine Identity Assumptions: Audit where and how your organization proves identity today. If approvals depend on messages, one-time codes or in-app taps, understand the risk you’re implicitly accepting, especially for high-value or irreversible actions.
• Prioritize Cryptographic Proof Over Behavioral Inference: Risk engines, AI models and fraud analytics remain valuable, but they should complement—not replace—deterministic proof that the right person authorized the action.
• Track The Regulatory Shift: Watch evolving guidance around phishing-resistant authentication, transaction authorization and identity assurance as expectations move away from easily manipulated authentication channels.
• Expect An Adversarial Future: We have to assume attackers are automated, persuasive and increasingly AI-enabled. Build systems that don’t rely on human judgment at the moment of approval, but instead embed trust and intent upstream by design.
The Next Standard For Digital Trust
The challenge isn’t that today’s identity systems have failed. It’s that many were designed for a digital environment that is rapidly disappearing.
We’re entering an era in which the standard for digital trust will no longer be simply how quickly organizations can authenticate users, but how confidently they can establish that a trusted credential is present and that a high-risk action was explicitly authorized.
That shift—from identity as a checkpoint toward authorization grounded in cryptographic proof—will redefine digital trust over the next decade.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?