Less Than Half of Organizations Can Reliably Tell If There‘s a Real Person Behind an Online Identity Check

Regula’s 2026 survey finds a confidence gap in remote identity checks: 76% of organizations have human-presence controls, but only 48% consider them reliable, and more than half cannot confidently prove a real person is behind an online check. The report also shows weak biometric assurance, with 52% unable to fully verify live capture and 41% unable to consistently detect manipulated identity signals (e.g., deepfakes/replay attacks). Net: AI-driven identity threats are expanding beyond face matching toward full-session trust, likely reinforcing demand for stronger identity verification solutions across the customer lifecycle.

Analysis

This reads more like an adoption catalyst for the identity-verification stack than a near-term earnings event. The spend migration should favor vendors that can combine liveness, signal provenance, and ongoing monitoring; single-point face-match or document-check providers are the most vulnerable to budget scrutiny because buyers will demand fewer false accepts without adding manual-review headcount. Public-market read-through is clearest for niche IDV names and broader identity-security platforms that can bundle continuous trust into existing workflows.

The immediate market impact is likely overstated. A survey of concern does not equal budget release, and procurement teams usually defer platform swaps until a visible fraud incident or regulator audit creates urgency. Over the next 1-3 months, the key catalyst is whether any large bank, fintech, crypto venue, or gaming operator discloses elevated synthetic-id losses or higher fraud-prevention spend; absent that, this stays a thematic narrative rather than a revenue inflection.

Contrarianly, the consensus may be underestimating how slowly trust-stack budgets move. A lot of buyers already believe deepfakes are a problem, but they will not pay for multi-signal orchestration unless the vendor can prove lower manual-review rates and better conversion, so the first beneficiaries may be incumbents with compliance credentials rather than the most advanced AI narrative. Over 6-18 months, the bigger structural winner could be identity platforms that sit inside account recovery and session monitoring, while point solutions risk pricing pressure as features get commoditized.

Key Decisions for Investors

• No immediate trade in WWRL; treat this as a watch item, not a conviction event. Require independent evidence of revenue acceleration or new logo wins before expressing the theme.
• Initiate a small starter long in MITK on a 5-10% pullback over the next 1-3 months, with a 15-20% upside target if management cites AI-fraud-driven demand and a stop if billings/ARR fail to reaccelerate.
• If channel checks confirm budget rotation into identity assurance, put on a 1-3 month pair: long MITK / short HACK to isolate IDV-specific spending versus the broader cybersecurity basket. Risk is thesis dilution if the spend remains narrative-only.
• Consider OKTA call spreads only if upcoming commentary shows Auth0 or identity-security cross-sell into customer identity and recovery flows. Otherwise skip; the read-through is too indirect to pay option premium.
• Set alerts around major fraud disclosures from banks, crypto venues, and gaming operators over the next quarter; those are the events most likely to convert this into a tradable spending cycle.