Behavioral biometrics alone cannot stop modern account takeover fraud

At a glance

What this is: Feedzai argues that modern fraud can bypass successful login and MFA by manipulating legitimate users during an active session, so continuous authentication needs behavioral, event and transaction signals.

Why it matters: For IAM and fraud teams, the lesson is that identity verification at login is no longer enough when the real attack happens after authentication and inside the session.

By the numbers:

• Annual identity fraud losses reached $27 billion, according to data from Javelin Strategy & Research.

Context

The core problem is a security gap between authentication and actual user intent. A session can look valid at the login layer while the person behind it is being manipulated into making risky actions, which means point-in-time verification misses the fraud that unfolds after access is granted.

In financial services, this matters because the trust decision is no longer finished at the front door. MFA still helps, but it cannot distinguish a genuine customer from a coerced one once the attacker is controlling the conversation and the user’s behaviour inside the session.

Key questions

Q: How should financial institutions detect fraud after a user has already passed MFA?

A: They should treat MFA as only one checkpoint and continue monitoring the session for behavioural change, risky non-monetary actions and transaction anomalies. The key is to correlate signals in real time so that coerced users and legitimate customers can be separated after login, before the attacker reaches the cash-out stage.

Q: Why do disconnected fraud tools miss account takeover scams?

A: Because each tool sees only a slice of the journey. A device check may look clean, biometrics may show a small deviation and the transfer may appear normal on its own, but the attack becomes visible only when those signals are joined across the session. Fragmentation creates context gaps and weakens decision quality.

Q: What are the signs that a logged-in customer may be under social engineering pressure?

A: Look for hesitation while completing fields, unusual copy and paste behaviour, screen-sharing software, background phone calls and activity that does not match the customer’s normal rhythm. Those signals do not prove fraud on their own, but they become meaningful when they appear alongside account changes or new payment intent.

Q: What should teams do when a session is authenticated but the user behaviour looks abnormal?

A: Escalate the session for step-up review or intervention before the next high-risk action, because the attack may already be in progress. The aim is to interrupt the sequence early enough that the fraudster cannot reach beneficiary setup, transfer confirmation or other cash-out steps.

Technical breakdown

Why point-in-time authentication misses coerced-session fraud

Traditional authentication answers whether credentials are valid at login. Continuous authentication answers a different question: whether the session still looks like the same legitimate user as activity unfolds. In the scenario described by Feedzai, a criminal does not need to defeat MFA if the victim is already authenticated and can be guided through the workflow. That is why typing cadence, navigation pauses, device signals and concurrent communications become relevant evidence. The control problem shifts from identity proofing to runtime session trust, where static checks are too early to see the fraud pattern. See the MFA Guide.

Practical implication: Treat login success as the start of monitoring, not the end of it.

How behavioural biometrics gain value from non-monetary event context

Behavioural biometrics on their own only show that something looks unusual. Their value rises when they are correlated with non-monetary events such as balance checks, new payee setup, profile changes or repeated login activity. Those events often occur before the transfer that causes loss, so they provide an earlier fraud signal than payment monitoring alone. The operational issue is context fusion: without the surrounding account and transaction state, a small anomaly may be noise. With it, the same anomaly can become a high-confidence indicator of account takeover or social engineering. Read Fraud Prevention Guide for Digital Businesses.

Practical implication: Correlate behaviour with pre-transaction account actions before you decide to block or step up.

Why isolated tools create context gaps and false decisions

A fragmented fraud stack produces separate snapshots instead of a continuous memory of the session. One system sees the device, another sees biometrics, and another sees the transaction, but none of them can interpret the full sequence alone. That creates two failure modes: false declines when benign behaviour looks suspicious in isolation, and missed fraud when a real attack is only visible across multiple signals. Continuous authentication is therefore less about one stronger signal and more about joining signals at the decision layer so the system can judge intent, not just activity. See the Fraud Prevention Platform Buyer's Guide.

Practical implication: Design fraud decisions around fused signals, not disconnected point products.

Threat narrative

Attacker objective: The attacker wants to control a legitimate session long enough to move money or enable account takeover without triggering the usual front-door defences.

1. Entry occurs when the attacker reaches the victim through social engineering or a remote access scam rather than by breaking the bank’s perimeter.
2. Credential_harvested and session-used when the legitimate user enters correct credentials and passes MFA while being coached or coerced.
3. Escalation follows as the attacker drives risky account actions such as balance checks, registration changes or adding a new beneficiary to prepare withdrawal.
4. Impact occurs when the transfer is executed before the institution detects the fraud, unless continuous monitoring creates an earlier kill point.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous authentication is now a governance requirement, not a UX enhancement. The article makes a clear case that modern fraud happens after successful sign-in, not before it. That changes the control conversation for IAM and fraud teams, because the trust decision must extend through the session rather than stop at MFA. The practical implication is that identity assurance should be measured at runtime, not only at authentication.

Context gaps are the real failure mode in fraud detection. When behavioural biometrics, account events and transaction data sit in separate tools, each one sees only a fragment of the attack. That is not just an integration problem, it is a control failure because the system loses the sequence needed to distinguish intent from noise. Practitioners should treat signal fusion as part of the control design, not as a reporting layer.

Session trust gap: the article describes a gap between successful authentication and trustworthy user intent, and that gap is where coerced fraud thrives. This is the right name for the problem because the session is technically authenticated while the human is not exercising free, normal intent. Teams that still measure security only at login are managing the wrong boundary.

Behavioural biometrics become materially stronger when linked to account lifecycle and transaction controls. The value is not in the typing pattern alone but in the pattern plus the surrounding event context. That makes this an identity governance issue as much as a fraud detection issue, because the decision logic now depends on how access is used after it is granted. Practitioners should align fraud monitoring with the full customer journey, not with isolated checkpoints.

Fraud programmes need early kill points, not just final transfer blocks. If detection waits for the payment step, the attacker has already achieved too much. The article shows that non-monetary events can expose risk earlier, which means the control architecture should interrupt risky sessions before the cash-out stage. The practitioner takeaway is to move intervention upstream into the account activity sequence.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Identity fraud is moving from access compromise to intent compromise. That shift changes how practitioners should think about trust, because the account may be genuine while the action is not. The control boundary now sits inside the session, where the combination of behaviour and event context can expose coercion before loss is final.

Continuous authentication should be measured by how early it creates intervention opportunities. If a programme only blocks at payment execution, it is still reacting too late. The more useful question is whether the control can identify risk at the beneficiary, profile or behavioural stage, when the attacker still has limited room to finish the job.

For practitioners

• Build continuous session monitoring Correlate behavioural signals, device telemetry, non-monetary events and transaction data during the full customer session, not just at login.
• Use non-monetary events as early risk markers Flag actions such as new beneficiary creation, repeated balance checks and profile changes as risk-bearing events that can trigger step-up or blocking.
• Tune decisioning for coerced-user patterns Look for hesitation, unusual copy and paste use, screen-sharing activity and concurrent phone calls when the session appears authenticated but unusual.
• Reduce context loss across fraud tools Eliminate disconnected login, biometrics and transaction reviews so a risk signal can persist across the whole account journey.

Key takeaways

• Modern fraud can succeed after a valid login, which means MFA alone no longer establishes enough trust for the full session.
• The article’s main evidence is that behavioural anomalies, non-monetary actions and transaction data are more effective when analysed together.
• Practitioners should move fraud controls upstream so they can intervene before the transfer stage rather than after money is already at risk.

Related NHI Mgmt Group resources: MFA Guide · Fraud Prevention Guide for Digital Businesses · Fraud Prevention Platform Buyer's Guide · IAM and Identity Provider Buyer's Guide

Key terms

• Continuous authentication: A model where access is re-evaluated after the initial login instead of being trusted for the full session. It uses live signals such as posture, telemetry, and policy to detect when a session should be stepped up, constrained, or revoked.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.
• Non-Monetary Events: Non-monetary events are account actions that do not move money but often precede fraud, such as adding a beneficiary, changing profile details or checking balances repeatedly. They are valuable because they expose attacker preparation earlier than the final transfer step.
• Context Gap: The context gap is the distance between a rule that looks correct on paper and the real meaning of a request inside an AI workflow. It appears when language changes meaning through history, sequence, or social engineering, and it is one reason fixed filters struggle with agentic abuse.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity controls to real operational risk across programmes.