Financial identity security confidence is outrunning real protection

At a glance

What this is: This 2026 survey of 200 IAM leaders in US and Canadian financial organisations finds a sharp mismatch between perceived account-takeover protection and the actual strength of authentication controls.

Why it matters: It matters because financial IAM teams are still relying on partial MFA coverage and phishable methods while phishing pressure is rising, leaving the real attack surface wider than leadership confidence suggests.

By the numbers:

• 82% of IAM leaders are confident their current controls can mitigate account takeover risk.
• 94% of financial firms report more phishing.
• Only 28% of MFA is phishing-resistant.
• Only 15% of authentication flows are passwordless.

Context

Financial identity security in this survey means the controls that protect workforce authentication across banks, credit unions, investment firms, and loan providers. The core problem is not the absence of MFA, but the gap between having MFA and having phishing-resistant authentication that can actually withstand modern account takeover pressure.

The article’s central finding is a confidence gap: leaders believe current controls are sufficient, while the measured coverage shows partial protection, uneven legacy coverage, and heavy dependence on methods attackers routinely target. In identity governance terms, this is a control-assurance problem, not just an authentication feature problem.

The sector is also carrying a large legacy footprint, which matters because identity control maturity is only as strong as the least modern path into the estate. That makes this a finance-specific IAM and authentication issue, not a generic cybersecurity trend piece.

Key questions

Q: What breaks when account takeover defences rely only on MFA?

A: MFA alone fails when the attacker avoids the strongest sign-in path and pivots to password reset, reused passwords, or automation that makes many attempts cheaply. Account takeover becomes a journey problem, not a single checkpoint problem, so recovery, bot defence, and device trust all have to be governed together.

Q: Why do legacy authentication paths create more risk than modern SaaS logins in financial services?

A: Legacy paths often cannot support modern federation, device-bound methods, or other phishing-resistant options, so organisations fall back to weaker controls. That means the oldest applications become the easiest way to bypass the stronger posture elsewhere. The risk is concentrated where the business still depends on old authentication design.

Q: What signs show that an authentication programme is not truly phishing resistant?

A: Look for shared secrets, OTP dependence, push fatigue risks, and exceptions for privileged users. If the strongest methods are not required on the most sensitive paths, the programme is likely describing resilience it does not actually enforce.

Q: Should financial firms prioritise passwordless over expanding traditional MFA coverage?

A: They should prioritise the highest-risk paths first, but passwordless matters because it removes the reusable password from the flow rather than layering another factor on top. If the environment still depends on phishable methods for critical applications, more MFA coverage alone may improve appearance without materially reducing takeover risk.

Technical breakdown

Why phishable MFA still leaves finance exposed

MFA only reduces account takeover risk when the second factor cannot be socially engineered, replayed, or intercepted. SMS one-time passwords and push notifications add a checkpoint, but they do not remove the attacker’s ability to coerce approval, redirect the flow, or exploit session recovery paths. In financial environments, that distinction matters because attackers are not trying to defeat every factor equally; they look for the weakest enrolled path. When only a minority of workforce MFA is phishing-resistant, the control stack remains vulnerable even if it looks complete on paper.

Practical implication: Treat MFA type, not MFA presence, as the security decision variable.

Legacy applications create the weakest authentication perimeter

Legacy applications are difficult because they often cannot natively support modern federation, device-bound authenticators, or phishing-resistant methods. That creates a split environment where SaaS can be better protected while older systems remain open to phishable logins. The survey’s 50% average MFA coverage for legacy apps shows that the practical boundary of identity security is still defined by architecture age, not policy intent. In finance, that means authentication risk concentrates where business dependency is highest and modernization is hardest.

Practical implication: Map which critical applications still depend on legacy authentication paths and prioritise those for control redesign.

Passwordless is a control change, not a convenience feature

True passwordless authentication removes the reusable password from the flow rather than merely hiding it from the user. That matters because a password that still exists behind the scenes can still be phished, reused, or recovered through adjacent channels. The article’s 15% passwordless figure shows that most organisations are still relying on secret-based authentication, even when they believe they have modernised. For IAM programmes, passwordless is best understood as a reduction in credential attack surface, not just a better login experience.

Practical implication: Separate genuine passwordless deployments from password-masked workflows before you report maturity.

Threat narrative

Attacker objective: The attacker aims to take over user accounts and move through financial applications using stolen or socially engineered authentication.

1. Entry begins with phishing campaigns that reach workforce users across financial organisations and exploit phishable authentication methods.
2. Credential access occurs when attackers capture passwords, OTPs, or push approvals that can be reused to impersonate the user.
3. Escalation follows when stolen authentication is used to enter internal applications or recovery flows that were assumed to be protected by MFA.
4. Impact is account takeover, with the attacker inheriting legitimate user access inside systems that leadership believed were already covered.

Breaches seen in the wild

• Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
• Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant coverage, not MFA presence, is now the real control line in financial identity security. The survey shows that organisations can feel protected while still leaning on SMS, OTP, and push-based flows that attackers know how to defeat. The governance mistake is treating MFA as a binary achievement instead of measuring whether the enrolled methods actually resist phishing. Practitioners should read this as a control-quality problem, not a coverage checkbox.

Financial identity programmes now need to distinguish authentication modernisation from authentication completion. Legacy applications often remain the true perimeter because they block modern methods and force weaker fallback patterns. That means identity governance has to account for architectural exceptions, not just policy intent, or else the weakest login path becomes the default path. The practical conclusion is that legacy coverage must be measured separately from SaaS coverage.

Passwordless adoption is a maturity marker because it removes the password attack surface rather than disguising it. Many environments call themselves modern while leaving recoverable secrets in the background of the authentication process. That creates confidence without structural reduction in credential risk. Financial firms should treat passwordless as a governance outcome tied to account takeover resilience, not as a user-experience upgrade.

Confidence bias is now a security variable in its own right. When IAM leaders believe controls are stronger than the evidence shows, remediation slows, exceptions accumulate, and legacy carve-outs persist longer than they should. The result is a governance lag between actual exposure and reported assurance. Practitioners should challenge any programme where perceived resilience is materially ahead of phishing-resistant coverage.

Phishing-resistant MFA is the relevant control objective for financial services because account takeover is the threat the sector is actually managing. That framing aligns authentication policy with the adversary model instead of with generic MFA adoption language. For practitioners, the implication is to govern methods, not labels, and to make legacy fallback paths visible in security reporting.

What this signals

Financial identity security now hinges on method quality and exception handling, not on whether MFA exists at all. Programmes that keep phishable methods in place for legacy paths will keep producing assurance gaps even when leadership reports broad deployment. The governance question is whether the authentication estate has been segmented tightly enough to expose weak methods before attackers do.

Passwordless is the clearest marker separating cosmetic modernisation from real reduction in credential exposure. When passwords still exist behind the scenes, the attack surface remains intact even if the user experience changes. Financial IAM teams should expect board-level scrutiny to move from adoption counts to the proportion of flows that have actually removed the password dependency.

For practitioners

• Inventory authentication by method, not just by application Break out SMS OTP, push, FIDO2, biometrics, and passwordless by workforce population and by application so the real phishable surface is visible.
• Separate SaaS and legacy MFA coverage in reporting Report coverage for legacy apps independently from SaaS because blended averages hide where older systems are still the weakest path into the estate.
• Define passwordless as password removal Treat any flow that still depends on a reusable password behind the scenes as password-based, even if the user no longer types it.
• Prioritise high-value legacy applications for phishing-resistant upgrades Start with the applications that carry the most business exposure and the least native support for modern federation or device-bound authentication.

Key takeaways

• Financial firms are not short on authentication controls so much as short on controls that resist phishing in practice.
• The gap between confidence and coverage is wide enough to matter operationally, especially where legacy systems still anchor critical access.
• IAM teams should report method quality, legacy exceptions, and passwordless progress together or the real exposure will stay hidden.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.