Identification is not the same as authentication: Why is the difference important?

Most users think that logging into a system is a single process, but two different processes take place in the background: identification and authentication.

Everyday use that often goes unnoticed

Every day, we log into online banking, use e-mail, access healthcare portals, public services, or social networks. Most users think that logging into a system is a single process, but two different processes take place in the background: identification and authentication.

Although the terms are often used as synonyms, they have completely different meanings. Understanding this difference is important for everyone who uses digital services.

What is identification?

Identification means that the user tells the system who they are.

Examples include:

• a username,
• an e-mail address,
• a card number,
• a tax identification number,
• a health insurance card number,
• a national personal identification number,
• a digital identity.

At this stage, the system does not yet know whether the person is really who they claim to be.

If someone enters your username, the system still cannot know whether it is really you or someone else.

What is authentication?

Authentication means verifying a person’s identity.

The system checks whether the person claiming to be a particular individual really is that person.

This can be done in several ways:

• with a password,
• with a one-time password or code (OTP),
• with a smart card,
• with mobile confirmation,
• with biometric data,
• with multi-factor authentication.

Only after successful authentication does the system grant access.

An everyday example

Imagine arriving at a hotel.

At reception, you say:

“I am Janez Novak.”

This is identification.

The receptionist then asks you to provide an identity document.

When the receptionist checks that the name on the document matches the person standing in front of them, they perform authentication.

Only then do you receive the room key.

Digital systems work in a very similar way.

Why do abuses occur?

Many cyberattacks are not aimed at breaking encryption, but at stealing login credentials.

Attackers often use:

• phishing and fake websites,
• fraudulent e-mails,
• SMS scams,
• telephone scams,
• password theft,
• data leaks from different databases.

If an attacker obtains only a username and password, they may be able to access the user’s account in many cases.

For this reason, modern systems increasingly use additional methods of identity verification.

“The most secure digital identity is not the one that reveals the most data, but the one that reliably confirms, with the least possible data, that you really are who you claim to be.” — Institute 1. april

Why is a password alone no longer enough?

Twenty years ago, a password was often considered sufficient.

Today, however, users rely on dozens of different online services, which often leads them to reuse the same passwords.

If one website is compromised, attackers may try the same username and password combination on other services.

This is known as credential stuffing, and it is one of the most common forms of login credential abuse.

Multi-factor authentication

For this reason, many organisations are introducing multi-factor authentication (MFA).

The user must prove their identity using several independent factors.

For example:

• something they know, such as a password,
• something they have, such as a phone or security key,
• something they are, such as a biometric characteristic.

If an attacker obtains only one factor, this is often still not enough to gain access.

Where does the QEI initiative fit in?

At Institute 1. april, we believe that the future development of digital identity should be based on:

• the protection of privacy,
• the principle of Privacy by Design,
• reducing the amount of personal data being processed,
• several independent methods of identity verification,
• the traceability of access,
• the responsible use of modern technologies.

The QEI (Quantized Encrypted Identity) initiative represents a concept that encourages discussion about safer approaches to digital identity and the protection of personal data. Its purpose is to contribute to professional debate on how future systems can combine security, privacy, and user trust.

Looking to the future

In the coming years, digital identity will become one of the most important foundations of the digital society.

The question will no longer be only who you are, but above all:

• how your identity is verified,
• how much personal data is required,
• who is allowed to access it,
• how it is protected,
• and how abuses are prevented.

Understanding the difference between identification and authentication is therefore the first step towards a safer digital future.