AI-powered fraud is exposing the limits of traditional MFA

At a glance

What this is: This webinar recap argues that login-only MFA is too narrow for modern fraud patterns and that passkeys plus biometrics need to be applied across the customer journey.

Why it matters: It matters because IAM teams, fraud teams and architects need controls that protect recovery, reactivation and transaction flows, not just initial authentication.

Context

Traditional MFA is often designed as a single decision at the point of sign-in, but many fraud paths happen after the login has succeeded. That creates a governance gap for customer identity programmes: the control is placed at the front door while the attack surface extends into session use, recovery and transaction approval.

The article frames this as a shift from one-time authentication to journey-based assurance. For IAM and identity architects, the practical question is no longer whether MFA exists, but whether it still provides assurance when the user, device and transaction context all change after entry.

Key questions

Q: What breaks when MFA is used only at sign-in and not for privileged actions?

A: The main failure is stale trust. A user may authenticate once and then remain authorized for hours or days, which is too broad for account deletion, payment approval, or access to secrets. Without re-authentication at the point of action, an attacker who inherits the session can complete high-risk operations without facing a fresh challenge.

Q: Why do passkeys reduce phishing risk compared with passwords?

A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret. That means a fake site cannot harvest a password and replay it later. The phishing benefit is real, but it only holds if the organisation also limits weak fallback methods that attackers can abuse instead.

Q: How should teams use biometrics in customer identity journeys?

A: Use biometrics at trusted enrolment and at high-risk recovery or reactivation points, not as a universal login factor. That gives security teams a higher-assurance identity anchor when the device is lost, the account is dormant or the customer needs recovery.

Q: How should organisations choose between passkeys and facial biometrics?

A: Choose based on assurance, not convenience. Passkeys are strong for phishing resistance and device-bound authentication, but facial biometrics can provide a stronger link between the presenting person and the account in high-risk journeys. Use biometrics where impersonation would be especially costly, and reserve passkeys for lower-risk flows that still need modern passwordless protection.

Technical breakdown

Why login-only MFA breaks under session hijacking and replay

Traditional MFA often authenticates only the initial access event, then treats the session as trusted until it ends. That model is weak when attackers steal active sessions, replay tokens or abuse secondary channels such as SMS and contact-centre workflows. The failure is architectural: the assurance boundary sits at sign-in, but fraud frequently occurs later in the journey, after the credential check has already succeeded. Journey-based authentication extends trust decisions to the transaction and recovery phases, where risk actually materialises.

Practical implication: Move assurance checks to the point of transaction and recovery, not just the login screen.

How passkeys change phishing and domain-binding risk

Passkeys rely on public-private key cryptography bound to the legitimate domain, which means the credential cannot be reused on a lookalike phishing site. That is materially different from passwords, OTPs or knowledge-based prompts, which can be relayed, stolen or socially engineered. The important control property is origin binding: the authenticator releases a signature only to the real relying party, reducing the value of phishing infrastructure and man-in-the-middle relay attacks.

Practical implication: Prioritise passkeys where phishing and credential replay are the dominant failure modes.

Why biometric assurance belongs in onboarding and recovery

Biometrics in this model are not a replacement for possession factors. They are a way to re-establish identity when the account relationship has already been established, especially during onboarding, account recovery and dormant account reactivation. By binding biometric evidence to a trusted enrolment event, teams can compare later interactions against that high-assurance baseline. The control is strongest when it is tied to identity proofing and reused at higher-risk moments rather than deployed as a generic convenience feature.

Practical implication: Bind biometric enrolment to trusted onboarding and reuse it for recovery and high-risk step-up flows.

Threat narrative

Attacker objective: The objective is to bypass account assurance and complete fraudulent account access or transaction activity without triggering step-up controls.

1. Entry begins when attackers use phishing, social engineering or SMS interception to get past a sign-in control that only protects the front door.
2. Credential or session abuse follows when the attacker hijacks an active session, relays an OTP or exploits a weaker recovery or contact-centre path.
3. Impact occurs when the attacker completes transactions, resets access or reactivates dormant accounts without a journey-level trust check.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Front-door MFA is a broken assumption, not just a weak control: It was designed for a world where authentication happened once and remained valid for the rest of the interaction. That assumption fails when fraud is distributed across login, session use, recovery and support channels. The implication is that identity governance has to follow the journey, not the first checkpoint.

Passkeys shift the problem from secret validation to origin binding: In phishing-heavy environments, the critical question is not whether a credential can be copied, but whether it can be replayed on a hostile domain. Passkeys answer that better than OTPs or shared secrets because the credential is cryptographically tied to the relying party. Practitioners should treat this as a control boundary change, not a UX upgrade.

Biometrics are most valuable when anchored to trusted enrolment: Their strongest use is not continuous surveillance, but proving continuity of the same person across high-risk lifecycle events such as recovery and reactivation. That makes onboarding a governance moment, not just a registration flow. Teams that separate enrolment trust from recovery trust will miss where fraud actually concentrates.

Fraud-as-a-service turns authentication design into a resilience problem: The article shows how attack tooling is becoming cheaper, more accessible and easier to operationalise. That means identity programmes can no longer assume fraud is rare, manual or high-effort. The practical consequence is that authentication assurance must be designed to absorb repeated, commoditised abuse at scale.

Journey-based authentication is now the right governance model for customer identity: The old split between login security and downstream transaction security no longer matches attacker behaviour. Controls need to vary by risk, device state, account age and transaction value. The organisations that keep treating MFA as a sign-in feature will keep underestimating the real attack surface.

What this signals

Journey-based assurance: The useful design shift is to stop treating authentication as a binary yes-or-no event. In customer identity programmes, the right question is which step in the journey creates the highest fraud value and what assurance is needed there.

Passkeys and biometrics solve different problems, and they work best when the programme separates phishing resistance from identity continuity. That distinction matters for fraud teams, IAM leads and architects planning recovery, reactivation and support-channel controls.

For practitioners

• Map authentication controls to the full customer journey Identify where login, session, recovery, reactivation, support and transaction approval each create a distinct assurance requirement. Document which steps still rely on front-door MFA alone and which need stronger step-up controls.
• Deploy passkeys where phishing and replay dominate Prioritise passkey rollout for journeys that are repeatedly targeted by phishing, OTP relay and session hijacking. Ensure the relying party and credential manager are enforcing domain binding rather than treating passkeys as a cosmetic login replacement.
• Bind biometric enrolment to high-trust onboarding Capture biometric evidence during initial identity proofing or onboarding, then reuse that binding for account recovery and dormant account reactivation. Keep the enrolment event distinct from routine authentication so the trust chain remains auditable.
• Replace knowledge-based recovery with risk-based recovery Remove support flows that depend on static knowledge questions or loosely verified callbacks. Use transaction context, device state and prior enrolment evidence to decide when a customer can regain access without manual intervention.

Key takeaways

• Login-only MFA leaves recovery, session and support-channel abuse outside the main trust boundary.
• Passkeys reduce phishing and relay risk by binding the authenticator to the legitimate domain.
• Biometrics add the most value when tied to trusted enrolment and reused for higher-risk journey steps.

Key terms

• Journey-based authentication: An authentication model that evaluates trust across the full customer interaction, not only at login. It assigns different assurance levels to onboarding, recovery, support, device changes, and transactions so that security follows risk instead of a single entry point.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Biometric Binding: Biometric binding links a captured biometric sample to the person who submitted the identity evidence. It matters because a biometric alone is not proof of identity unless the system can show it was collected from the right individual under controlled conditions.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.