Two different questions, easy to conflate
Identity proofing happens once, at enrollment, and establishes whether the person creating an account is genuinely who they claim to be. Authentication happens on every subsequent login and confirms the credential presented matches the one established for that account. A system can authenticate flawlessly forever on top of an identity that was never actually proofed — the login always matches the account, but the account itself was never verified to belong to a real, specific person in the first place.
How much proofing effort is warranted scales with the stakes of what the account can do — a low-stakes account might reasonably need almost none, while an account with access to sensitive systems, financial authority, or the ability to affect other people's accounts typically needs meaningfully more.
The weakness of relying on knowledge alone
A common but weak proofing method asks something 'only the person would know' — a security question, a memorable detail. Much of this information turns out not to be private at all: it's discoverable through public records, social media, or leaked in unrelated breaches, which means knowledge-based checks are frequently guessable by anyone motivated to research the target rather than by the legitimate account holder specifically. Verification methods that rely on documentary or independently-checkable evidence close this gap that knowledge-based approaches leave open.