Persistent device intelligence is now core to banking identity risk

At a glance

What this is: Fingerprint says banking fraud persists because authentication alone cannot prove whether the device, session, or enrollment path behind a login is trustworthy.

Why it matters: IAM and fraud teams need to treat device intelligence as a governance layer, because persistent trust signals now matter as much as credential proof for NHI, autonomous, and human-led interactions.

By the numbers:

• Fraud losses are projected to cost financial institutions $58.3 billion globally by 2030, a 153% surge from 2025 levels.
• Losses from account takeover fraud in the U.S. totaled $15.6 billion in 2024, up from $12.7 billion the year prior.
• Every dollar lost to a fraudster costs North American financial institutions $4.41, according to the LexisNexis True Cost of Fraud Report cited by Fingerprint.

Context

Banking authentication has improved, but it still solves only part of the fraud problem. The security gap is now about whether a device, session, or enrollment flow should be trusted across the customer lifecycle, not just whether a login matches a stored credential.

This is an identity governance issue as much as a fraud issue. When passkeys, MFA, biometrics, and behavioral scoring all authenticate a user at a point in time, attackers can still exploit the trust boundary before or after that check and keep operating on a legitimate-looking device profile.

For Tier 1 banking environments, that makes persistent device intelligence a control plane for account trust rather than a niche fraud signal. The article’s starting position is typical of modern banking, where authentication maturity has improved faster than lifecycle trust visibility.

Key questions

Q: What breaks when banking authentication is strong but device trust is not persistent?

A: A strong login only proves that a check passed at one moment. If device trust is not persistent, attackers can reuse sessions, bind new credentials to hostile devices, or operate from environments that look legitimate at sign-in but are fraudulent across the rest of the journey. The control failure is continuity, not factor strength.

Q: Why do passkeys still leave account takeover risk in place?

A: Passkeys remove reusable secrets from login, but they do not eliminate weaker alternate paths attached to the same account. Attackers target those fallback paths because they are usually easier to socially engineer or intercept than the passkey itself. The account is only as secure as the weakest recovery method.

Q: How can banks tell whether device intelligence is actually working?

A: It should surface repeat device patterns across accounts, flag suspicious enrollment and recovery flows, and reduce the number of high-risk actions that rely only on a single authentication event. If the same device environment repeatedly shows up in onboarding, login, and payment abuse, the signal is working; if not, the control is too shallow.

Q: Should fraud teams prioritise device intelligence over stronger identity proofing?

A: They should treat them as complementary controls, but prioritise device intelligence when the dominant risk is session replay, botting, or verification interception. Stronger proofing helps at enrolment, yet it does not stop a verified session from being reused elsewhere. Device intelligence closes the gap between proofing and ongoing trust.

Technical breakdown

Why point-in-time authentication misses modern fraud

Point-in-time authentication proves that a user or device satisfied a check at one moment, not that the environment remains trustworthy afterwards. That matters because fraud now moves across enrollment, login, payment, and recovery flows. If an attacker can obtain temporary access, register a new passkey, hijack a session token, or reuse a compromised device profile, the authentication layer may still report success. The technical weakness is not the strength of the factor. It is the narrowness of the trust decision. Banking teams increasingly need a continuity model that carries identity and device context across sessions, not a one-time verdict.

Practical implication: Treat authentication as an input to ongoing risk decisions, not as the final trust decision.

How persistent device intelligence differs from cookie-based tracking

Cookie-based tracking ties recognition to a browser session or a stored identifier, which is easy to delete, block, or compartmentalise. Persistent device intelligence instead correlates hardware, browser, session, and behavioural signals across repeated interactions to create a more durable device profile. That makes it possible to see whether the same device environment appears at onboarding, login, payee creation, and high-value transfer events, even when the account details change. In fraud operations, the point is not just to recognise a returning browser. It is to surface coordinated reuse patterns that suggest automation, mule activity, or device takeover.

Practical implication: Use persistent device signals to link account events that would otherwise look unrelated.

Where AI-powered fraud breaks biometric and passkey assumptions

AI changes the economics of impersonation. Deepfake imagery can weaken liveness checks, social engineering can steer users into enrolling attacker-controlled devices, and session attacks can bypass the credential entirely after authentication has already succeeded. Passkeys reduce phishing risk, but they do not stop fraudulent enrollment if the attacker wins control before binding the credential to the device. Biometrics also depend on environmental checks that become less reliable when synthetic media is convincing enough to imitate motion, texture, and expression. The architectural lesson is that a strong factor can still be surrounded by a weak lifecycle.

Practical implication: Add device and enrolment-risk controls around passkeys and biometrics instead of relying on the factor alone.

Threat narrative

Attacker objective: The attacker wants to convert temporary access into durable trust so they can move money, authorise transactions, and avoid detection inside legitimate banking flows.

1. Entry begins with phishing, social engineering, SIM swap, or session interception that gives the attacker temporary access to the customer account or device context.
2. Credential or enrollment abuse follows when the attacker registers a passkey, reuses a valid session token, or authenticates from a trusted-looking device that has already been compromised.
3. Impact occurs when the attacker uses the trusted session or enrolled device to move funds, add payees, or operate inside banking workflows without triggering traditional authentication alarms.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Persistent device intelligence is now part of identity governance, not just fraud analytics. Banks have spent years hardening login assurance, but the article shows that lifecycle trust now depends on whether the same device environment keeps reappearing across onboarding, recovery, and transactions. That changes the governance question from "Did the user authenticate?" to "Can this device profile be trusted over time?" Practitioners should treat device continuity as a core control surface.

Enrollment fraud is the overlooked control gap in phishing-resistant authentication. Passkeys and biometrics reduce old attack paths, but they do not solve the moment when a new device becomes trusted. If an attacker can win a short-lived compromise and bind a credential to their own device, the security model has already failed before the next login. That makes enrollment governance, not just authentication strength, the decisive control boundary.

Device reuse is the named concept this article makes visible. Fraud operations can fabricate identities and automate sessions, but they struggle to hide hardware and environmental repetition at scale. When the same device pattern appears across many accounts or transactions, the signal is often stronger than any single identity proof. Practitioners should build detection around repeated device environments, because that is where coordinated abuse becomes measurable.

Banking teams need to reframe trust as a continuous property of the customer journey. Authentication controls are still necessary, but they are no longer sufficient as a security boundary for high-value accounts. Device intelligence, session context, and behavioural linkage together define whether a transaction should be allowed to proceed. The practical conclusion is that trust must be evaluated continuously, not only at login.

AI has shortened the time between compromise and credible impersonation. Deepfake media, synthetic identities, and social engineering now compress the window in which fraud can look legitimate. That means the control challenge is moving earlier in the lifecycle, before the system can rely on a clean authentication event. Teams should therefore prioritise controls that retain memory across sessions, devices, and accounts.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Device trust decay is now the practical gap in banking identity controls. Banks do not need another point-in-time check as much as they need a durable way to see whether the same device environment is still safe after enrollment, recovery, or payment authorization. That is the control shift the article captures: trust must survive the session boundary, not end at it.

Persistent device intelligence gives fraud teams the missing correlation layer. The value is not simply better detection at login. It is the ability to connect onboarding, device binding, payee changes, and high-value transfers into one behavioural picture, which is exactly where synthetic identity, mule activity, and account takeover become visible.

For identity programmes, the implication is clear: lifecycle controls matter more than isolated authentication wins. If your programme still treats MFA, passkeys, biometrics, and session risk as separate problems, you will keep missing the way attackers chain them together. The next control investment should make trust durable across sessions, devices, and recovery paths.

For practitioners

• Strengthen enrollment controls for trusted devices Require additional verification when a new device is bound to a passkey, biometric profile, or recovery path, especially after a recent account recovery or SIM change.
• Correlate device reuse across accounts Join onboarding, login, payee creation, and payment events to spot the same device environment appearing across unrelated accounts or high-risk actions.
• Treat session continuity as a fraud signal Flag token reuse, session takeover indicators, and abnormal concurrent control patterns so that a valid login does not automatically imply a trustworthy transaction.
• Tune step-up decisions to device trust decay Increase challenge intensity when device reputation changes, when a trusted account appears from a new environment, or when enrollment and payment activity cluster suspiciously.
• Feed persistent device signals into fraud and AML models Use long-lived device attributes to enrich model inputs so investigators can link suspicious behaviour across cases, accounts, and payment flows.

Key takeaways

• The article shows that modern banking fraud is no longer limited by weak passwords, because attackers now exploit the gap between a successful login and an actually trustworthy device.
• Financial institutions are facing a projected $58.3 billion in global fraud losses by 2030, which shows how expensive point-in-time authentication failures have become.
• The control lesson is to move from isolated authentication checks to persistent device intelligence that can track trust across sessions, enrollment, and account recovery.

Key terms

• Persistent Device Intelligence: Persistent device intelligence is a control approach that identifies and scores a device or device family across sessions, even when cookies, browser settings, or network attributes change. It gives platforms a more durable signal for fraud detection and repeat abuse enforcement.
• Enrollment Fraud: Enrollment fraud occurs when an attacker gets a new trusted credential, such as a passkey or device binding, attached to a device they control. The danger is that the system then treats the attacker’s device as legitimate in later sessions, even though the initial trust decision was compromised.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Device Reuse Signal: A device reuse signal is evidence that the same hardware or device profile is appearing across multiple accounts, enrollments, or transactions. In fraud analysis, repeated reuse can indicate coordinated abuse, mule activity, automation, or synthetic identity operations that point-in-time identity checks miss.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It is designed for practitioners who need to connect identity controls to broader security and fraud programmes.