How should banks reduce fraud without making online banking unusable?

Use layered authentication that combines verified identity, device trust, and transaction-specific approval. The goal is to reduce reliance on passwords alone while keeping the approval step tied to the actual banking action. That balance matters because effective fraud control in banking is about proving the right person is present at the right moment, not just making every login harder.

How to lower fraud without turning banking into a hurdle

Fraud reduction works best when banks separate authentication from transaction approval and raise assurance only when the action warrants it. That means the login experience should stay fast for routine access, while higher-risk payments, payee changes, and device changes trigger stronger checks. Done well, customers feel guided rather than blocked.

The practical design question is not whether to add more friction everywhere, but where extra confidence actually changes the fraud outcome. A bank can tolerate a lightweight login if it still has strong confidence before money moves, limits change, or new devices become trusted.

What layered authentication should actually prove

Effective fraud control is built around three signals: who is trying to act, whether the device or session looks trustworthy, and whether the specific transaction deserves extra confirmation. That approach is stronger than passwords alone because it binds approval to context, not just to a remembered secret. It also helps banks distinguish a routine return customer from a takeover attempt.

For practitioners, the important shift is from static access checks to step-up decisions based on risk and action type. A low-risk balance inquiry does not need the same friction as a first-time beneficiary transfer or a password reset from an unfamiliar device. That is how banks reduce fraud without making every interaction feel suspicious.

Where usability fails, and how to avoid it

Usability usually breaks when banks make every security control behave like a login problem. If the same challenge appears too often, on low-value actions, or without clear user feedback, customers start to predictably route around it, abandon tasks, or call support. The result is weaker security in practice, even if the policy looks stricter on paper.

Another common failure is over-reliance on one factor that is easy to replicate at scale, such as passwords or one-time codes alone. Better designs use device recognition, phishing-resistant authentication where possible, transaction signing or approval binding, and risk-based step-up only when the event justifies it. That keeps the control targeted instead of universal.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-63, NIST CSF 2.0, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	Digital Identity Guidelines	Phishing-resistant authentication and assurance levels fit banking login and step-up approval.
Recommendation — Use assurance levels and phishing-resistant authenticators for higher-risk banking actions.
NIST CSF 2.0	PR.AA-05 — Authenticator Management	Layered authentication depends on managing authenticators beyond passwords alone.
Recommendation — Manage authenticators so stronger verification can be applied to sensitive banking actions.
OWASP ASVS	V10 — OAuth and OIDC	Federated login and step-up flows often rely on robust auth protocols in online banking.
Recommendation — Harden authentication flows so step-up checks remain reliable and usable.
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Strong identity proofing and authentication are central to reducing fraud in access flows.
Recommendation — Require strong authentication before granting access to sensitive account functions.

Practitioner Guidance

What to prioritise: Put the strongest controls on actions that move money, add payees, alter credentials, or change trusted devices. Keep routine browsing and low-risk account access as low-friction as possible so customers do not experience security as a permanent obstacle.

What to verify: Test whether the bank can distinguish a legitimate customer session from a compromised session before the risky action completes. The control should be tied to the exact transaction, not just to a successful login earlier in the day.

Decision rule: If the event can create financial loss or durable account takeover, require step-up approval; if it is informational or reversible, avoid unnecessary friction and preserve speed.

Practitioner takeaway: The best fraud controls in banking are selective, contextual, and transaction-aware, because broad friction protects systems only if customers still reach the right action without finding ways around the control.