Identity confidence is the current level of trust a system assigns to a user or session. It is not just a login result; it is a running judgment built from factors such as device state, location, authentication method, carrier changes, and session behavior. In modern security design, that trust should change as new evidence appears.
This matters because attackers often try to weaken identity signals after initial login. For example, a SIM swap can move a phone number to an attacker-controlled device, making SMS codes and recovery flows less reliable. If a system keeps high confidence after a number port, device replacement, or sudden loss of service, it may allow password resets, MFA changes, or sensitive actions to proceed. Defenders use identity confidence to trigger step-up verification, block risky recovery attempts, and prefer phishing-resistant authenticators such as passkeys or security keys.