Why do passwords and one-time codes still leave organisations exposed to identity fraud?

Passwords and SMS or email codes can confirm possession of a secret, but they do not reliably prove who is behind the keyboard. Attackers reuse compromised credentials, intercept codes, and exploit account recovery paths. Identity-based controls reduce this gap by tying access to verified identity evidence, so the trust decision is based on who the user is, not just what they know or receive.

Why Passwords and One-Time Codes Still Fail Identity Fraud Tests

Passwords and one-time codes prove that someone has access to a secret, but they do not reliably prove the person is legitimate. That gap matters because modern fraud rarely starts with guessing a password; it starts with phishing, session theft, SIM swapping, recovery abuse, and help desk manipulation. NHI Mgmt Group notes that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, which shows how often trust is broken at the credential layer rather than the application layer. See the Ultimate Guide to NHIs for the broader identity risk pattern.

This is also why fraud teams and security teams should treat OTPs as a weak signal, not a final assurance mechanism. Attackers routinely replay or intercept codes, then pivot into account recovery flows where the organisation has fewer controls and more human discretion. In practice, many security teams discover this only after a mailbox takeover, help desk reset, or payment diversion has already occurred, rather than through intentional fraud testing.

How Identity Fraud Exploits Secrets, Recovery Paths, and Session Trust

The core issue is that passwords and one-time codes authenticate a factor, not a trustworthy identity context. A valid code can be obtained through phishing proxies, malware on the endpoint, carrier-level attacks, or social engineering against recovery channels. Once the session is established, attackers often do not need to re-enter the password at all, because the real target becomes the session cookie, token, or delegated recovery path.

Current guidance suggests that stronger fraud resistance comes from combining phishing-resistant authentication with evidence about device, posture, and behaviour. That means tying access to verified identity assertions and session risk, not just a shared secret. For NHI and agentic workloads, the same logic applies even more strongly: static credentials and fixed roles do not match dynamic execution. The 52 NHI Breaches Analysis shows how frequently exposed identities and weak credential handling become the first step in compromise.

• Use phishing-resistant authentication where possible, and reduce reliance on SMS or email codes for step-up trust.
• Bind sessions to device or workload identity so a stolen code alone is not enough to continue access.
• Harden recovery workflows with out-of-band verification, approval thresholds, and fraud monitoring.
• Continuously evaluate risk at login and during the session, not only at the point of initial authentication.

Standards such as NIST SP 800-53 Rev 5 Security and Privacy Controls support stronger access control, authentication, and recovery design, but implementation still depends on how well identity proofing and session protection are enforced in practice. These controls tend to break down in high-volume service desks and consumer-facing recovery flows because humans remain the easiest bypass around technical authentication.

Where Organisations Still Get Caught Out

Tighter authentication often increases user friction and support overhead, requiring organisations to balance fraud resistance against recovery speed and usability. That tradeoff becomes most visible when organisations rely on one-time codes as a universal backstop, because the code becomes a convenience layer that attackers can target directly. Best practice is evolving toward step-up checks, risk scoring, and stronger identity proofing, but there is no universal standard for every recovery scenario yet.

Identity fraud also expands when organisations treat humans and machines the same way. Passwords and OTPs are especially weak for service accounts, automation, and AI agents, where the real control plane should be workload identity, ephemeral secrets, and runtime policy decisions rather than a user-centric login pattern. NHI Mgmt Group documents that 97% of NHIs carry excessive privileges, which is why the same trust failure that affects people often becomes more severe for machines. The practical lesson is reinforced by Top 10 NHI Issues and recent reporting such as the Anthropic report on AI-orchestrated cyber espionage, where automation and identity misuse converge. In practice, organisations get exposed when recovery, session, and delegation trust are all treated as “good enough” after the first factor is validated.

Related resources from NHI Mgmt Group

• Why do passwordless logins still leave organisations exposed to impersonation risk?
• Should organisations still use one-time passwords for MFA?
• Why do MFA deployments still leave organisations exposed to identity risk?
• Why do identity platforms with good login controls still leave organisations exposed?