The part where you guarantee to your users that the person you authenticated is who they seem to be. In this particular example: "Is this invoice I'm about to

The part where you guarantee to your users that the person you authenticated is who they seem to be. In this particular example: "Is this invoice I'm about to pay for the service I purchased, or is it fraud?" Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.