Fintech has solved authentication. Okta, Auth0, Firebase — there are a dozen mature products that verify a user’s identity when they log in. Session tokens, MFA, passkeys. The login problem is handled.
But logging in and authorizing a specific action are fundamentally different problems. And almost no one treats them differently.
This human, right now, authorized this specific thing. That sentence is not what login proves. It is what is missing.
The timeline gap
Here’s what actually happens when a user moves money:
The authentication happened at 9 AM. The action happened at 2:15 PM. In between — five hours of blind trust. The platform has no idea who is actually sitting at that screen when the money moves.
An SMS code at 2:15 doesn’t fix this. It proves a phone received a text. It doesn’t prove the account holder is physically present. SIM swaps, SS7 attacks, and malware on the device all render that code meaningless.
KYC checks the wrong moment too
Identity verification at onboarding has the same structural problem. Jumio, Onfido, Persona — they verify a user is real when they sign up. That’s important. But it’s a point-in-time check that says nothing about what happens six months later when that account initiates its first large withdrawal.
KYC proves you were a real person on March 1st. It doesn’t prove you’re the person sitting at the keyboard on September 15th when $200K leaves the account.
Authentication checks identity at login. KYC checks identity at signup. Nobody checks identity at the moment of the action.
What action-level verification means
The missing layer is verification that’s scoped to a specific action, at the exact moment it happens. Not “this user logged in today.” Not “this user passed KYC last quarter.” Instead: this human, right now, authorized this specific thing.
That’s what Lorica’s JWT carries. When a developer calls our API before a high-risk action, the token that comes back contains the user identity, the action context, the confidence score, the liveness method, and the exact timestamp — all signed and independently verifiable.
The JWT doesn’t say “user authenticated.” It says “user_jane authorized wire_transfer_50k at 2026-03-22T14:15:03Z with 0.96 confidence via motion liveness.”
That’s a fundamentally different statement. One is about a session that started hours ago. The other is about a human who is present right now.
Different problems, different solutions
Okta is excellent at what it does. So is Auth0. They solve authentication — confirming identity at the boundary. That problem is solved.
The unsolved problem is what happens after authentication. The hours between login and action. The moment a session token is trusted to authorize something it was never designed to authorize.
Your login session proves you authenticated hours ago. Lorica’s JWT proves you’re here now.
These are different problems. They need different solutions.