Less Than Half of Organizations Can Reliably Tell If There’s a Real Person Behind an Online Identity Check

Regula study: Most organizations lack reliable proof of human-led identity interactions. GNW

Article content

RESTON, Va., July 01, 2026 (GLOBE NEWSWIRE) — While most organizations have tools to verify human presence, only 48% fully trust them. The latest Regula survey, The New Shapes of Identity Threats 2026, highlights that AI-assisted automation, deepfakes, and generated identity evidence are changing what businesses need from identity verification. Now it is not just a pass-or-fail result, but proof that a real person was present and the evidence was authentic.

Article content

Article content

The findings come as businesses prepare for a new phase of digital identity risk, where AI agents, automated systems, deepfakes, and human users can all move through the same onboarding, authentication, and account recovery flows. AI is becoming an active participant in digital interactions, making it increasingly difficult for organizations to determine who — or what — is behind an identity verification attempt.

Article content

Article content

Article content

Human presence becomes a critical trust signal

Article content

Regula’s research reveals a significant confidence gap in organizations’ ability to verify that a real person is present during remote identity checks.

Article content

While 76% of organizations report having technical controls designed to verify human presence, only 48% consider these controls reliable.

Article content

Article content

Article content

Article content

Regula survey states that more than half
of organizations cannot confidently prove that a real person is behind an online identity check

Article content

The survey findings suggest that many organizations can verify identity evidence but remain uncertain whether that evidence was submitted by a genuine human. In practice, systems built to verify people increasingly encounter activity that behaves like a user, submits identity evidence like a user, and moves through digital journeys like a user — without necessarily involving a real person.

Article content

Article content

Face matching alone is no longer enough

Article content

Regula’s study also highlights growing concerns around biometric authenticity and liveness assurance.

Article content

More than half of organizations (52%) cannot fully verify that biometric data was captured live from a real person. Meanwhile, 41% cannot always detect when identity data or signals have been manipulated.

Article content

These findings reflect a fundamental shift in identity verification. A face match may demonstrate similarity, but it does not necessarily prove that biometric data originated from a real person in real time. Deepfakes, synthetic identities, injected camera feeds, and replay attacks increasingly challenge traditional verification approaches.

Article content

The challenge is not detecting fakes — it is managing trust

Article content

Organizations are entering an environment where interactions may be initiated by humans, authorized AI agents, automated systems, or fraudsters using the same technologies. In this reality, the challenge extends beyond detecting fake documents, deepfakes, or synthetic identities. Businesses must determine who — or what — is behind an interaction and whether that entity can be trusted.