Why do stolen credentials and OTP phishing create outsized risk for banks and other financial organisations?

Because they give attackers valid access rather than just a suspected intrusion. Once an attacker captures a password or one-time passcode, they can log in directly, move to other users, deploy malware, or stage ransomware. In financial environments, that can trigger consumer harm, regulatory scrutiny, account lockouts, and broader operational disruption across interconnected systems.

Why Stolen Credentials and OTP Phishing Create Such Large Exposure

Financial organisations are prime targets because a captured password plus a one-time passcode often looks like legitimate customer or employee activity at the point of entry. That means the attacker does not need to bypass the front door; they can use the account as intended, which makes detection slower and response harder. The result is not just fraud, but trust abuse across payment, identity, support, and settlement workflows.

What makes the risk outsized is the chain reaction. A single successful login can enable account takeover, session hijacking, beneficiary changes, internal pivoting, and impersonation of staff or clients. In banking, even brief access can create losses that exceed the original compromise because downstream systems assume authenticated users are authorised users. In practice, many institutions discover the damage only after abnormal transfers, lockouts, or complaint volume has already spread beyond the initial account.

For broader identity abuse patterns, NHIMG’s 2024 ESG Report on Managing Non-Human Identities found that two-thirds of enterprises had suffered a successful cyberattack tied to compromised non-human identities, which is a useful reminder that valid credentials routinely turn into broad operational exposure once trust is established.

OTP phishing works because the code is treated as proof of fresh intent, even though the attacker is actively relaying the session in real time. When a user hands over a password and passcode, the adversary can often complete authentication before the code expires, establish a session, and immediately use the authenticated channel to change recovery details, add payment beneficiaries, or enrol a new device. That is why banks see this as a control failure in the authentication journey, not just a user training problem.

Several design choices make the blast radius worse:

Long-lived sessions let attackers stay present after the original login event.
Weak step-up controls allow high-risk actions to occur without fresh verification.
Fragmented monitoring across mobile, web, call centre, and core banking systems hides linked abuse.
Shared support workflows can be manipulated to reset access or override customer friction.

In high-value environments, the attacker’s goal is usually to convert access into durable control before the institution can revoke the session or freeze movement. That is why banks increasingly treat phishing-resistant authentication and transaction-specific approval as separate problems. NIST’s Digital Identity Guidelines are useful here because they distinguish authentication strength from the need to bind higher-risk actions to stronger assurance. The risk escalates further when the same credentials can reach both customer-facing and internal tools, because the breach then becomes an access-path problem rather than a single account event. This guidance tends to break down when legacy channels, exception handling, or account recovery processes can still be abused as alternate entry points.

Where the Risk Becomes Operationally and Financially Disproportionate

Tighter authentication often increases user friction and support load, so organisations must balance fraud reduction against conversion, service continuity, and recovery complexity. The disproportionate impact appears when credential theft intersects with high-trust financial actions, weak segmentation, or operational dependencies that assume the user is already vetted.

Current guidance suggests focusing on the places where valid access creates irreversible or fast-moving consequences. That includes payments, beneficiary changes, account recovery, privileged staff functions, and third-party integrations that can be reached through the same identity path. The main issue is not simply that an attacker can log in; it is that one authenticated session can be reused to establish legitimacy across multiple business processes before anomaly detection catches up.

For this reason, banks and financial firms should treat OTP phishing as an access-layer compromise with fraud, resilience, and trust impacts, not as a narrow authentication nuisance. When organisations rely on single-factor recovery paths, broad session lifetimes, or inconsistent step-up requirements, the compromise scales faster than the individual account. In practice, teams often learn this only after a fraudulent transfer, a customer support escalation, or a coordinated lockout has already exposed the weakness.

Risk and Threat Considerations

The material risk is account takeover that converts authenticated access into fraud, lateral movement, or operational disruption. In financial organisations, the exposure is amplified because valid credentials can unlock customer value transfer, internal administration, and support workflows that are designed to trust signed-in users.

Failure mechanism: OTP phishing defeats the assumption that possession of a passcode proves the legitimate user is present. Attackers relay the login in real time, reuse the session, and then exploit weak recovery, beneficiary management, or transaction approval controls to extend control beyond the original sign-in.

Impact: The consequence is not limited to one compromised account. It can include fraudulent transfers, account lockouts, recovery hijacks, customer harm, incident response load, and regulatory scrutiny when trust in authentication is undermined across connected systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Management	Stolen credentials and OTPs are machine-style secrets that enable direct abuse.
Recommendation — Inventory, protect, and rotate high-value credentials with phishing-resistant controls.
NIST SP 800-63	AAL — Authenticator Assurance Level	OTP phishing exploits weak assurance when authentication is not phishing resistant.
Recommendation — Require stronger authenticator assurance for banking actions and recovery flows.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	The question centers on authentication trust and access misuse across services.
Recommendation — Strengthen identity proofing, authentication, and access rules around high-risk transactions.
CIS Controls v8	5 — Account Management	Account takeover risk rises when identity lifecycle and recovery paths are weak.
Recommendation — Harden account lifecycle, recovery, and deprovisioning to reduce takeover paths.
MITRE ATT&CK	T1110 — Brute Force	Phishing for passwords and OTPs is a credential-access technique used to gain valid logins.
Recommendation — Detect credential harvesting and relay activity as credential-access behaviour.

Practitioner Guidance

What to prioritise: Treat the highest-risk paths as those where a valid session can change money movement, recovery settings, or device trust. If those actions do not require fresh, phishing-resistant verification, the organisation is accepting a known abuse path rather than a residual risk.

What to verify: Confirm that session duration, step-up authentication, and transaction approval are independently enforced for high-impact actions. Verify that support staff cannot bypass those checks through informal recovery or exception handling, because that is where attackers often convert a temporary login into durable control.

Practitioner takeaway: The key judgement is to separate “can log in” from “can move value or change trust,” because in financial environments the second permission is what turns stolen credentials and OTP phishing into outsized loss.