How should financial institutions replace passwords without making online banking harder for customers to use?

Financial institutions should move toward phishing-resistant, passwordless authentication that reduces dependence on reusable passwords while preserving a smooth customer journey. Methods such as FIDO-based authentication and adaptive risk checks can strengthen access decisions without adding constant friction. The practical goal is to match stronger verification to the level of risk, so users only face extra steps when session behavior or device signals look suspicious.

Why Password Replacement Has to Preserve Customer Trust

Financial institutions are not just replacing a login method. They are replacing a behaviour customers understand, support teams can explain, and fraud teams can evaluate. If the new flow adds repeated prompts, device confusion, or unclear fallback paths, customers often route around it or abandon it entirely. The better test is whether stronger authentication can be introduced without making ordinary account access feel exceptional.

Phishing-resistant approaches such as FIDO-style authenticators work best when the institution designs for the full customer journey, including enrollment, device change, recovery, and high-risk step-up events. NIST’s Digital Identity Guidelines are useful here because they frame identity assurance as a service experience as well as a control problem. When passwordless access is poorly designed, the burden shifts from password memorisation to recovery friction, which customers experience as the same problem under a different name.

In practice, many banks discover that authentication fails less from the chosen technology than from weak recovery design, inconsistent channel treatment, and poorly explained fallback rules.

How It Works in Practice

The most usable replacement for passwords in online banking is usually a layered model: a phishing-resistant primary factor, a device-bound or credential-bound assertion, and adaptive checks that only intervene when the session looks unusual. That combination matters because customers do not experience “authentication” as a single event. They experience login, account recovery, transaction approval, device migration, and support-assisted reset as one connected journey.

For routine access, a customer should authenticate with a method that does not depend on reusable shared knowledge. FIDO-based authenticators, passkeys, or similarly phishing-resistant mechanisms reduce the chance that a stolen password can be replayed elsewhere. For higher-risk actions, such as adding a payee or changing contact details, the bank can require step-up verification based on device posture, geolocation anomalies, transaction value, or session pattern changes. NIST SP 800-63 is relevant because it emphasises assurance, binding, and recovery in a way that helps institutions avoid designing for login only.

The operational challenge is to make recovery safe without making it easy for attackers. That means recovery cannot be treated as a shortcut around the primary control. Institutions need clear rules for lost-device events, new-device enrollment, and support-channel identity proofing. It also means accessibility matters: if the passwordless path is not usable on a customer’s preferred device or assistive technology, the institution will see more help-desk escalations and more fallback use than intended. For a broader control view, NIST guidance on security controls can help map the authentication change into account management, logging, and incident response expectations. The NHIMG guide on non-human identities also reinforces a related lesson: long-lived credentials become hard to govern at scale, and replacement only works when lifecycle control is built in from the start.

Use a phishing-resistant primary factor for everyday login.
Reserve step-up checks for anomalous sessions or sensitive actions.
Design recovery as a controlled security process, not a convenience path.
Support device change and accessibility without reintroducing password dependence.

These controls tend to break down when recovery channels are inconsistent across products, because attackers look for the weakest fallback rather than the strongest login method.

Common Variations and Edge Cases

Tighter authentication often increases onboarding and recovery overhead, so institutions have to balance fraud resistance against abandonment risk. That tradeoff is especially visible for customers who change phones often, use shared household devices, or rely on call-center support. Best practice is evolving toward risk-based access rather than one universal step-up rule for every customer and every session.

Some institutions try to keep passwords as a backup indefinitely, but that can preserve the very attack surface the project is meant to remove. A better pattern is to phase passwords out for normal access while retaining tightly governed exception paths for edge cases, with short-lived recovery tokens and strong auditability. Where account recovery is the weak point, the institution should treat it as a first-class security control, not an afterthought. In the same way, institutions should measure success by reduced fraud exposure and lower password reset volume, not by whether every interaction feels invisible.

When institutions serve older devices, international customers, or high-support populations, the right answer is often not “more prompts.” It is a cleaner mix of stronger default authentication, clearer recovery, and narrower exception handling. A usable replacement is one that customers can complete reliably the first time and that attackers cannot convert into a reusable access path.

Risk and Threat Considerations

Password replacement changes the attack surface rather than removing it. The main risk is shifting from password theft to recovery abuse, device enrollment fraud, session hijacking, or social engineering of help-desk processes. In banking, those secondary paths can be just as damaging as password compromise because they lead to account takeover without requiring the original password at all.

Failure mechanism: Attackers target the weakest fallback control, such as account recovery, SMS-based reset flows, or support-assisted identity verification. If the institution weakly binds the new authenticator to the customer, a malicious actor can enroll a device, intercept a step-up prompt, or exploit inconsistent treatment across channels.

Impact: The result is unauthorized account access, fraudulent transfers, reputational harm, and higher support burden. Poor recovery design also creates hidden friction that drives customers back to insecure workarounds, which undermines the passwordless programme over time.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	IAL/AAL/FAL — Identity Assurance, Authenticator Assurance, Federation Assurance	Covers strong authentication, binding, and recovery for online access
Recommendation — Use assurance and binding rules to replace passwords without weakening recovery.
NIST CSF 2.0	PR.AA — Identity Management, Authentication and Access Control	Directly addresses access control and authentication design
	PR.DS — Data Security	Protects sensitive account and session data used in authentication flows
Recommendation — Apply PR.AA to enforce phishing-resistant authentication and controlled step-up access. Protect authentication data and session tokens with strong handling controls.
CIS Controls v8	6 — Access Control Management	Relevant to reducing risky authentication paths and managing access lifecycle
Recommendation — Remove weak login paths and govern account recovery as a controlled access process.
MITRE ATT&CK	T1110 — Brute Force	Passwords are a common target for guessing and credential attacks
Recommendation — Prioritise phishing-resistant login methods to reduce credential attack exposure.

Practitioner Guidance

What to prioritise: Treat recovery and device re-binding as the critical controls, not the login screen. If those paths are weak, the customer experience may improve while the security posture gets worse.

Decision rule: If the customer can regain access without proving control of a bound device or a comparably strong factor, treat the process as too permissive and tighten it before broad rollout.

What good looks like: Customers can sign in with little routine friction, but high-risk events trigger visible, explainable step-up only when the session, device, or transaction truly warrants it.

Practitioner takeaway: The winning design is not “passwordless at any cost,” but a customer journey where the easiest path is also the one the bank can defend under fraud pressure.