Authentication failures become fraud prevention failures in ATO

At a glance

What this is: Alloy’s analysis says account takeover is amplified when authentication and fraud prevention are siloed, because risk signals collected across channels never get evaluated together.

Why it matters: For IAM and fraud teams, the lesson is that point-in-time authentication cannot contain lifecycle-spanning ATO unless identity signals, fraud outcomes and step-up logic share the same decision context.

By the numbers:

• 39% of banking professionals said siloed systems were their most painful authentication challenge, according to Alloy research cited in the article.
• 39% said fraudsters are exploiting the gaps between those silos, according to Alloy research cited in the article.
• 81% of decision-makers at financial organizations with at least one physical branch invest equally across physical and digital channels, according to Alloy research cited in the article.
• 87% of consumers say they would lose trust in their bank if it failed to notify them immediately of a scam attempt, according to Alloy research cited in the article.

Context

Authentication and fraud prevention are often treated as separate disciplines, but the attack path does not respect that split. In financial services, the practical problem is not whether a login event succeeds, but whether the institution can connect identity evidence, device signals, behavioral patterns and downstream fraud indicators before an attacker changes account recovery details or moves money.

That gap matters most where customer identity and access management meets fraud operations. When onboarding data, contact centre verification, session context and transaction monitoring live in separate systems, teams end up certifying or challenging events without the full picture. The article argues that account takeover thrives in exactly that blind spot, which is common across banking and fintech environments.

For organisations with branch, digital and call centre channels, the starting position described here is unfortunately typical: controls are organised around channels and functions, while attackers organise around outcomes.

Key questions

Q: What breaks when fraud and identity teams work in silos?

A: When fraud and identity teams work in silos, policy decisions diverge, exceptions are handled inconsistently, and no one owns the full trust lifecycle. That creates both over-blocking and under-blocking. The business then absorbs the cost as manual review, lost conversion, and weak auditability.

Q: Why do cross-channel account takeover attacks bypass normal controls?

A: Because attackers use one channel to prepare another. Compromised identity data can pass a call centre script, change recovery details and then weaken later OTP or notification controls. Each step may appear legitimate if the institution evaluates it in isolation. The risk comes from the sequence, not any single check.

Q: How should security teams measure whether authentication controls are actually working?

A: Measure the full path, not just successful login. Teams should track completion rates, latency, recovery effort, suspicious attempts, and downstream fraud or support load. For NHIs, add provisioning, rotation, revocation, and offboarding completion. If the metric does not change a control decision, it is not yet useful for governance.

Q: Should banks connect onboarding identity data to later fraud decisions?

A: Yes, because onboarding usually captures the richest identity evidence the institution will ever have. Device signals, behavioural biometrics and KYC checks should inform later recovery, login and transaction workflows. Without that continuity, every later interaction is judged from scratch, which helps attackers and creates unnecessary manual review for legitimate customers.

Technical breakdown

Why siloed authentication creates fraud blind spots

Authentication systems usually answer a narrow question: does the presented credential or identity proof match what is on file? Fraud systems ask a different question: did this interaction produce loss or look abnormal enough to investigate? When those functions operate separately, neither can see the full attack chain. A caller who passes knowledge-based authentication in a contact centre may still be acting on compromised personal data, while a digital session may show device or behavioural anomalies that never reach the agent. That separation turns multi-channel fraud into a coordination problem, not a single control failure. Practical implication: design decisioning so identity evidence and fraud context are evaluated together, not in isolated workflow silos.

Practical implication: unify identity and fraud signals at decision time so the control stack can see cross-channel risk.

How cross-channel account takeover bypasses point-in-time checks

Modern account takeover is not confined to a login page. Attackers can start with breached personal data, use call centre reset procedures to change recovery attributes, then move into payment flows where step-up challenges and notification controls are already weakened. Each step may look legitimate in isolation because the previous signal never flowed forward. The real failure is lifecycle fragmentation: onboarding, recovery, session management and transaction monitoring are assessed as separate events rather than as one evolving trust story. Practical implication: treat account recovery, credential reset and payee addition as a single risk sequence, not unrelated transactions.

Practical implication: correlate recovery, authentication and payment events so a successful reset does not reset the risk picture.

Risk-based authentication depends on accumulated context, not static prompts

Risk-based authentication only works when the system can carry forward context such as device history, IP reputation, behavioural biometrics, KYC results and prior suspicious activity. If every interaction is scored from scratch, the institution keeps issuing the same challenge regardless of how much evidence has already accumulated. That creates two failures at once: good customers face avoidable friction, and bad actors receive predictable controls that can be engineered around. In practice, the architecture needs entity-level risk, not just session-level checks, so step-up intensity changes as confidence falls. Practical implication: feed authenticated and fraud outcomes into a shared trust profile that persists across the customer lifecycle.

Practical implication: move from session-only checks to persistent entity-level trust scoring with adaptive step-up.

Threat narrative

Attacker objective: The attacker’s objective is to take control of the customer account, defeat step-up controls and move money before the institution can connect the signals.

1. Entry begins when a fraudster acquires compromised personal data from phishing, a prior breach or a dark web marketplace and uses it to satisfy weak identity checks.
2. Credential access occurs through contact centre recovery flows, where the attacker passes knowledge-based authentication and resets the account while changing the authorised phone number.
3. Escalation follows when the attacker disables alerts, adds a new payee and exploits the newly changed recovery channel to pass an OTP challenge.
4. Impact is account takeover with funds transferred before the institution can correlate the authentication event with the fraud signals already present across other channels.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Siloed authentication is now a governance failure, not just an architecture choice. When authentication and fraud teams operate with different metrics, the organisation loses the ability to answer a basic question: which control actually failed? That is why account takeover persists even when each team believes it has covered its own part of the process. The practical conclusion is that identity governance must span the whole customer journey, not only the login event.

Account takeover is a lifecycle problem, and that makes onboarding data operationally valuable long after opening. Device fingerprints, IP reputation, behavioural signals and KYC evidence should not be treated as disposable onboarding artefacts. They are the trust baseline for later recovery, login and payment decisions. Organisations that fail to carry that context forward force every later decision to be made blind, which is exactly where attackers benefit.

Shared decisioning is the named control gap this article exposes. The issue is not merely weak authentication or weak fraud detection, but the absence of a shared risk model across both disciplines. In identity governance terms, that means the trust boundary is being drawn too narrowly. Practitioners should treat every recovery flow, step-up prompt and payment action as part of the same control chain.

Continuous, contextual trust scoring is becoming the practical minimum for fraud-resilient IAM. Session-level checks alone cannot absorb cross-channel abuse when attackers can pivot from one channel to another. The field is moving toward persistent trust profiles and adaptive decisioning because static authentication outcomes are too easy to game once attackers understand the workflow.

Shared trust context is the concept this article sharpens. It describes a model where identity signals, fraud outcomes and recovery actions inform each other instead of living in separate operational silos. For practitioners, the implication is straightforward: if the same customer can pass one channel and fail another without those outcomes meeting, the governance model is incomplete.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Shared trust context: account takeover controls fail when the institution treats onboarding, authentication and fraud investigation as separate problems. Practitioners should expect attackers to chain contact centre, digital and payment actions together, so the control model has to be lifecycle-wide rather than channel-specific.

The operational shift is from static verification to persistent risk memory. If device history, recovery changes and fraud outcomes do not influence later decisions, the organisation is repeatedly forced to rediscover the same customer and the same attacker, which is exactly the dynamic fraudsters exploit.

For practitioners

• Unify authentication and fraud decisioning Create a shared risk model that combines login, recovery, device and transaction signals before step-up or approval decisions are made.
• Preserve onboarding trust signals Carry KYC data, device fingerprinting, IP reputation and behavioural biometrics forward into later login and transaction workflows instead of resetting context after enrolment.
• Correlate contact centre and digital activity Join call centre resets, credential changes and mobile or web sessions so an apparently valid support interaction cannot clear the fraud view on its own.
• Scale step-up to accumulated risk Escalate authentication friction only when the combined pattern warrants it, rather than issuing the same OTP challenge after multiple high-risk signals have already stacked up.
• Measure authentication against confirmed fraud outcomes Review how often successful authentications later correlate with confirmed ATO or scam cases, and use that evidence to recalibrate policy and detection thresholds.

Key takeaways

• Authentication failures become fraud prevention failures when teams cannot share the same view of customer risk across channels.
• The article’s core evidence is that attackers can use breached personal data, contact centre resets and weakened step-up flows to move from compromise to monetary loss.
• The practical fix is not more isolated controls but a shared trust model that carries onboarding context into recovery, login and transaction decisions.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.
• Knowledge-based authentication: A verification method that asks a person to prove identity by answering facts such as past addresses, account details, or other shared information. It is operationally convenient but weak against social engineering, breach data, and impersonation, which is why it performs poorly in high-risk support flows.
• Trust Profile: A trust profile is a reusable set of assurance materials that presents a vendor’s security, privacy, and compliance posture in one place. It typically includes policies, certifications, notices, and resilience information. The purpose is to reduce repetitive questionnaires and make review easier for requestors.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity and identity lifecycle fundamentals that help practitioners connect authentication controls to broader access decisions. It is designed for security and identity teams that need a shared vocabulary for governance across the customer and workforce estate.