They often assume accessibility and anti-automation are separate goals, then build controls that fail both. In practice, the same interaction must support legitimate users, including assisted AI users, while denying easy machine bypass. The right design recognises that usability, identity confidence, and behavioural signal are linked.
Why This Matters for Security Teams
Accessibility and fraud prevention are often treated as competing objectives, but that framing creates avoidable failure. If controls are tuned only to block bots, legitimate users can be locked out, including users relying on assistive technologies or delegated digital support. If controls are tuned only for convenience, automation abuse becomes easier, especially where sign-up, login, recovery, and transaction flows expose predictable steps. NIST’s control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it separates access, identification, monitoring, and response into distinct control decisions rather than a single user-experience choice.
The real problem is that fraud teams and accessibility teams often optimise different layers of the same journey without a shared model of trust. That leads to brittle CAPTCHAs, excessive step-up prompts, confusing recovery steps, and false positives that punish the very populations the service is meant to serve. Stronger design starts by asking what must remain usable, what must be challenged, and what must be measured. In practice, many teams discover this only after abandonment, support escalation, or account abuse has already exposed the gap, rather than through intentional control design.
How It Works in Practice
Effective controls work best when they are layered and risk-based. The goal is not to make every interaction harder, but to make suspicious automation more expensive while preserving a clear path for legitimate users. That usually means combining session risk signals, device and network context, rate limiting, anomaly detection, and carefully designed step-up checks. Authentication should not be the only fraud control, because attackers often exploit recovery, onboarding, or API flows instead.
Practitioners should distinguish between human access, assisted access, and machine access. For example, a user on a screen reader, a customer using a passkey on a trusted device, and an automation client invoking an API all need different friction profiles. Where AI agents or scripted workflows are involved, identity governance becomes important as well, because non-human actors can accumulate privileges and secrets outside the normal user lifecycle. The OWASP Non-Human Identity Top 10 is relevant when automation has credentials, tokens, or certificates that must be governed separately from people.
- Use adaptive friction, not blanket blocking, so low-risk users are not forced through unnecessary challenges.
- Prefer accessible step-up methods such as passkeys, device binding, or verified recovery paths over visual puzzles alone.
- Instrument the full journey, including sign-up, password reset, MFA recovery, and high-risk transactions.
- Monitor for automation patterns such as velocity, replay, credential stuffing, and repeated failed recovery attempts.
Good design also requires validation with real user journeys, because a control that looks strong in a policy document can still fail under assistive technology, mobile constraints, or cross-border latency. These controls tend to break down when organisations treat login as the only fraud surface and ignore recovery and transactional abuse because attackers simply move to the path with the least resistance.
Common Variations and Edge Cases
Tighter anti-fraud control often increases user friction and support overhead, requiring organisations to balance abuse resistance against accessibility, conversion, and service equity. That tradeoff becomes sharper in high-risk environments such as financial services, benefits platforms, marketplaces, and public-sector portals, where adversaries actively probe the most permissive path. Current guidance suggests that friction should be selective, but there is no universal standard for exactly how much challenge is acceptable across all user groups.
There are also edge cases where common controls misfire. Bot checks can fail for users with disabilities, travel or shared-device patterns can resemble account takeover, and behavioural biometrics may be too noisy for low-volume services. Privacy constraints matter too, because collecting more behavioural data does not automatically improve fraud outcomes and can create governance obligations. For identity-heavy services, step-up controls should also be aligned with recovery assurance and session continuity rather than being bolted on as one-time gates. Where non-human identities are part of the workflow, the fraud model must account for service accounts, API clients, and agentic automation, not just people.
Best practice is to document the exception path as carefully as the default path. If accessibility, privacy, or jurisdictional rules prevent a particular challenge from being used, the fallback should still preserve identity confidence and auditability. Otherwise, the control environment becomes uneven and attackers learn which channels are softest. The strongest programs treat accessibility as a design constraint on fraud control, not as a post-hoc exemption.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA | Risk-based access assurance supports both usability and fraud resistance. |
| NIST AI RMF | AI-assisted users and behavioral scoring both require governance and validation. | |
| OWASP Agentic AI Top 10 | Agentic workflows can bypass human-centric assumptions in access and recovery. | |
| OWASP Non-Human Identity Top 10 | Automation credentials and service identities can become fraud amplification points. | |
| NIST SP 800-53 Rev 5 | AC-7 | Uncontrolled retries and challenge loops directly undermine fraud and accessibility goals. |
Apply adaptive access assurance and monitor for abnormal interaction patterns across critical journeys.
