Consumer MFA vulnerabilities expose the limits of trust signals

At a glance

What this is: This analysis shows that consumer MFA can still be undermined by weak phone-identity evidence, with non-fixed VoIP use, low Trust Score, and low SIM tenure all appearing in the data.

Why it matters: It matters because IAM teams cannot treat MFA as a binary control for consumer access; the quality of the identity evidence behind the factor now shapes fraud exposure and authentication assurance.

By the numbers:

• 10% of multi-factor authentication transactions were over Non-Fixed VoIP lines.
• 2.5% of mobile MFA transactions were found to have low Trust Score.
• 5% of mobile MFA transactions were found to have low SIM tenure.

Context

Consumer MFA depends on more than possession of a phone number or OTP channel. When the underlying phone identity is weak, the MFA step can still be technically correct while remaining fraud-prone, because the system is authenticating a low-confidence identity signal rather than a well-established customer identity.

Prove Identity's analysis focuses on what trust indicators reveal about that gap, especially in sectors where account abuse and onboarding fraud are already material risks. The key issue is not whether MFA exists, but whether the evidence used to support it is strong enough to resist SIM swaps, VoIP abuse, and synthetic identity patterns.

Key questions

Q: What should identity teams do when MFA succeeds but phone identity is low confidence?

A: They should not treat OTP success as sufficient on its own. Low-confidence phone signals such as low Trust Score, low SIM tenure, or non-fixed VoIP use should trigger stronger verification, tighter transaction controls, or step-up checks before access is granted.

Q: Why do weak phone signals increase consumer account takeover risk?

A: Because they let an attacker satisfy the MFA step without proving a durable customer identity. When the number is virtual, recently swapped, or poorly trusted, the authentication factor can be present while identity assurance remains weak.

Q: What are the signs that consumer MFA is relying on poor evidence?

A: The most obvious signs are elevated use of non-fixed VoIP, a rising share of low Trust Score transactions, and low SIM tenure in transactions that still pass authentication. Those patterns indicate the control is succeeding mechanically but failing to separate trusted users from risky ones.

Q: How can teams tell whether MFA is actually reducing fraud?

A: Look beyond login success rates and measure account takeover frequency, proxy use, anomalous device changes, and the share of high-risk transactions blocked after step-up. If authentication is working, it should reduce abuse without shifting the problem into recovery, support, or manual review queues.

Technical breakdown

Why SMS and voice OTP can still be weak consumer MFA signals

SMS and voice OTP prove channel access, not identity certainty. A phone number can be virtual, recently reassigned, or exposed through social engineering or telecom abuse, which means the factor can validate a device path without validating a trustworthy customer. In consumer environments, the authentication event and the identity confidence score are not the same thing. That distinction matters because fraudsters do not need to break MFA if they can present a channel that the system already treats as acceptable.

Practical implication: treat OTP success as one signal in a broader trust model, not as proof that the user is low risk.

What low Trust Score and low SIM tenure indicate

Trust indicators combine behavioural and phone-intelligence signals to estimate whether a number, device path, or account is likely to be legitimate. Low Trust Score suggests the surrounding signals do not support a stable identity, while low SIM tenure can indicate a recent swap or a newly established line. Those are not the same failure mode, but they both weaken assurance because the authentication step is being driven by conditions that often appear in fraud or takeover attempts.

Practical implication: route low-confidence transactions to step-up checks, tighter verification, or manual review before granting access.

Why non-fixed VoIP numbers matter for consumer authentication

Non-fixed VoIP numbers are not anchored to a physical subscriber line in the same way as traditional mobile numbers, which makes them harder to rely on as a durable identity anchor. In consumer MFA, that matters because a reusable phone number can be separated from a stable customer relationship. When authentication assumes the number itself is inherently trustworthy, the control becomes easier to abuse in large-scale fraud and account takeover workflows.

Practical implication: score or restrict non-fixed VoIP usage in high-risk authentication paths rather than treating it as equivalent to a standard mobile number.

Threat narrative

Attacker objective: The attacker wants to gain fraudulent access to consumer accounts by exploiting weak phone-based trust signals rather than defeating MFA directly.

1. Entry occurs when an attacker presents a consumer authentication flow through a non-fixed VoIP line, a low-confidence phone number, or a recently swapped SIM.
2. Credential access follows when the OTP or MFA challenge is satisfied even though the underlying identity evidence is weak, allowing the attacker to pass the control.
3. Impact is account takeover or fraud exposure in customer environments where the authentication step was accepted despite a poor trust signal.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Consumer MFA is only as strong as the identity evidence behind it. The article shows that a completed OTP challenge does not necessarily mean a trusted customer was present. When phone numbers are non-fixed, newly swapped, or otherwise low-confidence, MFA becomes a channel check rather than an identity assurance control. Practitioners should treat trust scoring as part of authentication design, not as a separate fraud feature.

Low-confidence phone identity creates an identity assurance gap, not just a fraud gap. That matters because IAM teams often separate authentication from fraud operations even when both depend on the same signal quality. The analysis makes clear that consumer authentication decisions are increasingly inseparable from phone intelligence, device reputation, and lifecycle context. Programmes that ignore those inputs are certifying access on evidence they cannot defend.

Non-fixed VoIP reveals a named concept we should call trust-signal fragility. The issue is not simply that attackers use alternate channels, but that organisations often overestimate the durability of a phone number as an identity anchor. Once that assumption fails, the MFA step can be satisfied by a weak proxy for the customer, and the control boundary shifts from factor possession to identity confidence.

Consumer MFA governance needs to distinguish verification strength from verification success. A successful OTP flow can still represent a weak decision if the underlying phone data, SIM tenure, or trust score is poor. That distinction should drive policy thresholds, risk-based step-up, and operational review. Teams should measure assurance quality, not just completion rates.

Phone identity intelligence is becoming part of the access decision, not a downstream enrichment field. The article's findings show that consumer identity programmes now need to treat phone reputation and SIM stability as first-class governance inputs. That elevates the role of identity analytics in access policy and makes weak evidence a board-level fraud and assurance problem.

What this signals

Trust-signal fragility: Consumer MFA programmes fail when organisations assume that a verified OTP channel equals a verified customer. In practice, phone identity quality has to be governed as part of authentication policy, because weak evidence can satisfy the factor while still leaving the account exposed.

Fraud and IAM teams should converge on the same assurance question: does the authentication event prove the right person, or only the right phone path? That distinction is now central to consumer identity governance.

Where phone intelligence is available, it should influence step-up thresholds, risk scoring, and exception handling rather than sit outside the access decision. Otherwise, MFA completion can conceal a low-confidence identity underneath.

For practitioners

• Define risk thresholds for low-confidence phone signals Set policy thresholds for Trust Score, SIM tenure, and non-fixed VoIP use so that weak signals trigger stronger checks before MFA succeeds.
• Separate standard and high-risk consumer authentication paths Use different assurance paths for routine logins and sensitive account actions, especially where phone identity confidence is low or recent.
• Treat VoIP as a risk input, not a neutral channel Score non-fixed VoIP lines in consumer authentication workflows and block or step up only where the business risk justifies it.
• Review fraud telemetry alongside MFA success rates Compare authentication completion with downstream fraud outcomes so that high success rates do not hide weak identity evidence.

Key takeaways

• Consumer MFA can complete successfully while the underlying identity evidence remains weak, which means factor presence is not the same as trust.
• The article's data highlights non-fixed VoIP, low Trust Score, and low SIM tenure as warning signs that phone-based assurance is too thin for high-risk consumer flows.
• Teams should govern authentication around evidence quality, using risk thresholds and step-up logic instead of assuming every passed OTP deserves the same level of trust.

Key terms

• Trust Score: A composite governance indicator that summarises whether an AI system has enough evidence to be reviewed and approved. It typically combines signals such as documentation, lineage, lifecycle maturity, and compliance status, but it should never replace the underlying evidence that produced it.
• Non-Fixed VoIP: Non-fixed VoIP is a virtual phone number not tied to a physical address or stable mobile line. It can be legitimate, but in authentication flows it often reduces confidence because the number may be easier to obtain, recycle, or use outside normal consumer identity expectations.
• SIM Tenure: SIM tenure is the length of time a SIM has been active in a device or account context. Short tenure can indicate a recent swap, a fresh device binding, or an identity path that should be treated as higher risk before allowing sensitive authentication or recovery.
• Consumer MFA: Consumer MFA is multi-factor authentication used for external users such as customers, subscribers, or account holders. In consumer environments, the control depends not only on the factor itself but on the strength of the identity evidence behind the factor and the channel carrying it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.