Identity security standards for banks are failing under agentic AI

At a glance

What this is: This is an analysis of why bank identity security standards are failing as agentic AI, phishing, and fraud push authentication beyond one-time verification.

Why it matters: It matters because banking IAM now has to govern both human and autonomous behaviour across login, recovery, and transaction approval without adding friction that drives customers away.

By the numbers:

• 91% of global customers rate a bank’s customer experience as important as its products.
• 28% of global customers say customer experience is more important than a bank’s products.
• 47% of global customers said they would leave a bank over poor user experience.
• 81% of businesses have experienced attempted or successful AI-powered fraud, according to KPMG research cited by OneSpan.

Context

Banks are moving from a world where identity was checked once at login to one where the identity signal can be faked, stolen, or automated mid-session. Agentic AI adds a new layer because software entities can now participate in banking workflows with their own identity, which makes static trust decisions increasingly brittle.

The governance gap is not just stronger authentication. Banks have to preserve customer experience while binding access, recovery, and payments to signals that are harder to replay, phish, or automate. That puts phishing-resistant authentication, device binding, and session-level scrutiny at the center of bank IAM strategy.

Key questions

Q: What breaks when banks rely on login controls to stop AI-assisted account takeover?

A: Login-only defence breaks when attackers can reuse valid credentials, vary their behaviour, and keep testing until one account path looks legitimate enough to pass. That leaves authentication as a thin gate rather than a risk decision. Banks need correlated device, behavioural, and identity signals so the control can distinguish human customers from automated abuse.

Q: Why do passwords and shared secrets create so much fraud risk in banking?

A: Passwords and shared secrets are easy to phish, replay, or trick users into revealing, especially when attackers can generate convincing bank impersonations at scale. Once a secret is stolen, it can open the door to account takeover, session hijacking, or fraudulent payments. Phishing-resistant methods reduce that replay value.

Q: How should financial institutions reduce account takeover risk without blocking legitimate customers?

A: Use layered controls that combine phishing-resistant authentication, risk-based step-up checks, bot mitigation, and behavioral analytics. The goal is to challenge suspicious activity, not every user. Institutions also need post-login monitoring, because many ATO attacks succeed after the session is already authenticated.

Q: When does transaction binding become necessary in banking identity control?

A: Transaction binding becomes necessary when authenticating the user is no longer enough to trust the action. If attackers can survive login and then alter or trigger payments, the bank needs a separate trust signal for the transaction itself. This is especially important for payments, beneficiary changes, and other high-risk actions.

Technical breakdown

Why static authentication fails in agentic banking workflows

Static authentication assumes the risk decision is complete once the user crosses the login boundary. In bank environments, that assumption breaks because the session, the recovery path, and the payment action can all become separate attack surfaces. Agentic AI makes this worse by allowing software actors to participate in workflows with their own identities, so the trust problem is no longer limited to a human user typing credentials. Once identity can be replayed, stolen, or simulated at runtime, the security model has to move from point-in-time trust to continuous signal validation.

Practical implication: banks should stop treating login as the main control boundary and extend identity assurance into recovery and transaction flows.

How phishing-resistant authentication changes the control plane

Phishing-resistant authentication reduces reliance on shared secrets by tying authentication to cryptographic proof rather than knowledge factors that can be copied. Passkeys are one example because they use public-key cryptography, which makes credential theft and replay materially harder than passwords. The important point is not that passwords disappear overnight, but that the control plane shifts toward signals that attackers cannot easily steal, fake, or reuse. That shift matters most where fraud teams, IAM teams, and customer experience teams all depend on the same session trust model.

Practical implication: prioritise phishing-resistant methods where account takeover and recovery abuse create the highest fraud exposure.

Why transaction binding matters more when fraud is AI-assisted

Transaction binding means linking an action, such as a payment or beneficiary change, to a trusted device, cryptographic proof, or another context signal that an attacker cannot easily move to a different session. This becomes more important when AI can produce convincing impersonation, accelerate social engineering, and orchestrate fraud at scale. In that setting, identity verification at the front door is not enough because the attacker’s goal is often to survive long enough to trigger the transaction itself. The banking control problem is therefore not just access, but the integrity of the action being authorised.

Practical implication: bind high-risk banking actions to device-bound or cryptographic signals rather than relying on prior login confidence.

Threat narrative

Attacker objective: The objective is to turn a trusted banking identity moment into fraudulent account access or a payment that appears legitimate to the victim.

1. Entry occurs when attackers use phishing, stolen credentials, malware, or session hijacking to obtain access to a legitimate banking account.
2. Credential access and abuse follow when AI helps the attacker disguise communications, impersonate the bank, and reuse stolen or replayed trust signals.
3. Impact occurs when the attacker uses that trusted session or recovery path to trigger account takeover or push a victim into an authorised payment fraud event.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static identity verification is now a broken banking assumption: the article shows that one-time login trust was designed for a world where credentials, sessions, and user intent stayed stable long enough to be evaluated once. That assumption fails when attackers can fake signals, steal credentials, or automate the next step of the interaction after login. The implication is that banks must treat identity as a continuing trust state, not a completed event.

Agentic AI turns identity governance into a multi-actor problem: banks are no longer governing only human customers and staff. Autonomous agents can enter workflows with their own identity, which means the governance model has to account for software entities that act, re-act, and scale faster than human review loops. Practitioners should recognize that the identity perimeter now includes machine-driven action, not just human authentication.

Phishing resistance is now a control-plane requirement, not a nice-to-have: passwords and other shared secrets are structurally weak when identity theft and social engineering are AI-accelerated. Passkeys and device-bound authentication matter because they reduce the replay value of stolen trust signals, especially in account recovery and payments. The practitioner conclusion is that banks should judge controls by whether they survive phishing plus automation, not by whether they satisfy a login policy.

Transaction integrity has become the real fraud boundary: the article makes clear that the banking loss often happens after authentication, when the attacker persuades the customer or hijacks the session to approve a payment. That is where the control model must bind the action itself to trustworthy context. For practitioners, the decisive question is whether a transaction can still be trusted after identity has already been compromised.

Ephemeral trust debt: banking programmes now carry a trust debt created by controls that assume a valid login remains valid enough to protect the rest of the session. Agentic behaviour and AI-assisted fraud shorten that trust window dramatically. Security leaders should treat that shrinking window as a governance problem, not just an authentication problem.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Banks are moving toward a trust model where the important decision is no longer who logged in, but whether the current session, recovery step, or payment action still deserves trust. That is why identity programmes should now be measured by their ability to survive phishing plus automation, not just by login success rates.

Ephemeral trust debt: controls built around a single authentication event accumulate risk as soon as an attacker can act after the login boundary. Banking teams should treat that shrinking trust window as a governance issue that spans fraud, IAM, and customer experience.

Passkeys, device binding, and stronger recovery controls are becoming the practical response because they reduce the value of stolen or replayed signals without forcing every customer into a brittle manual step-up flow.

For practitioners

• Bind high-risk transactions to stronger signals Require cryptographic or device-bound confirmation for payments, beneficiary changes, and other high-risk actions so a stolen session alone is not enough to authorise movement of money.
• Shift priority from passwords to phishing-resistant authentication Accelerate passkey or equivalent phishing-resistant rollout for customer and workforce journeys where password replay, credential theft, and social engineering drive the highest loss exposure.
• Harden account recovery as a fraud path Review recovery flows with the same scrutiny as primary authentication because attackers increasingly target the path that resets trust rather than the path that proves identity.
• Separate human and agent trust decisions Define where autonomous agents can participate in banking workflows, then require distinct identity assurance, logging, and approval rules for software entities versus human users.
• Measure friction against fraud exposure Track where stronger identity controls reduce account takeover and payment fraud without pushing customers into unsafe fallback paths or support-heavy workarounds.

Key takeaways

• Banks now face a control gap where login success no longer guarantees safe session or transaction behaviour.
• AI-assisted fraud makes account takeover and push-payment scams easier to run at scale, which increases the value of stronger identity signals.
• The most durable response is to bind sensitive banking actions to phishing-resistant, device-aware controls that survive replay and impersonation.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Transaction binding: Transaction binding links a user's identity, the document they approved, and the workflow state into a single evidence record. This matters in digital lending because a signature alone is not enough to prove the right person approved the right version at the right stage.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.