Strong customer authentication rules are tightening across regions

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OneSpan's blog post: New and pending strong-authentication rules in the EU, UAE, Philippines and NIS2 guidance point to a clear trend away from SMS OTP and toward phishing-resistant MFA.

Why it matters: It matters because IAM, PAM and security teams must align customer and workforce authentication roadmaps with tightening regulatory expectations, especially where access is remote, privileged or transaction-sensitive.

Context

Strong customer authentication is moving from a policy preference to a regulatory requirement. Across banking and critical infrastructure, the common theme is that weak second factors are no longer treated as acceptable protection for high-risk access and transactions.

For identity teams, the practical issue is not whether MFA exists, but which factors are still allowed, where they are allowed, and whether they are phishing-resistant. That question now spans customer authentication, workforce access, and privileged access programmes.

Key questions

Q: What breaks when organisations rely on SMS or email MFA for sensitive access?

A: The control breaks when the second factor can be intercepted, relayed, or socially engineered. SMS, email, and OTP-based MFA improve security over passwords, but they still leave room for SIM swapping and man-in-the-middle phishing. For sensitive access, that means the organisation is still authenticating through a phishable channel rather than using a proof method that resists interception.

Q: Why do banks need phishing-resistant authentication instead of stronger MFA?

A: Stronger MFA still fails if the second factor can be relayed, intercepted, or approved under pressure. Phishing-resistant authentication matters because it binds the credential to the real relying party and removes the shared secret that makes phishing economical. For banks, that reduces account takeover risk and improves the evidence story for regulators.

Q: How can organisations tell whether their MFA programme is actually strong enough?

A: Look for coverage gaps, exception paths, and methods that can be reset, replayed, or coerced through user interaction. A strong programme has consistent enforcement, phishing-resistant options for high-risk access, and monitoring for fallback methods that quietly weaken assurance. If users can get to sensitive systems through a weaker route, the programme is not truly resistant.

Q: Should customer and workforce authentication be governed the same way?

A: They should be governed under the same risk framework, but not with identical controls. Customer journeys often need accessibility and channel flexibility, while workforce and privileged access can usually support stronger device-bound methods. The practical goal is consistent policy logic with different factor thresholds by use case.

Technical breakdown

Why SMS OTP is being pushed out

SMS OTP remains widely deployed because it is simple to deliver, but it is also vulnerable to interception, SIM swap abuse, and phishing relay attacks. Regulators are increasingly treating it as an interim control rather than a durable trust mechanism. In the article, the UAE and Philippines both move to limit SMS and email OTP for sensitive banking actions, while the EU guidance points to phishing-resistant methods as the strongest category. Practical implication: teams should stop treating SMS OTP as a long-term control for sensitive journeys.

Practical implication: reclassify SMS OTP as a constrained fallback, not a preferred authentication factor, for sensitive access and transaction flows.

Phishing-resistant MFA and FIDO-based authentication

Phishing-resistant MFA binds authentication to a trusted device or cryptographic authenticator so the user cannot simply be tricked into replaying a code. FIDO-based methods are referenced in the article as the clearest example of this model, especially for workforce and privileged access scenarios. This matters because the risk is no longer only password theft, but session hijacking and credential relay through fake login pages. Practical implication: phishing-resistant MFA should be the default control target wherever remote access or privileged action is in scope.

Practical implication: prioritise phishing-resistant MFA for remote workforce access, privileged accounts and any workflow that can trigger material financial or operational impact.

Regulatory alignment now spans customers and personnel

The article shows a convergence that IAM teams cannot ignore: customer-facing banking authentication, mobile banking controls, and workforce MFA expectations are all moving in the same direction. The governance challenge is that one policy set may no longer satisfy both consumer journeys and staff access patterns. For financial institutions and critical sectors, this means authentication design now sits at the intersection of fraud reduction, access governance and compliance evidence. Practical implication: map each journey to the strongest acceptable factor set, rather than standardising on one weak baseline.

Practical implication: maintain separate authentication policies for customers, employees and privileged users, with explicit factor requirements for each risk tier.

Threat narrative

Attacker objective: The objective is to complete fraudulent transactions or gain unauthorized access to sensitive banking and workforce systems by bypassing weak second-factor controls.

1. Entry begins when an attacker captures a reusable OTP or tricks a user into presenting one during a phishing session or interception event.
2. Credential access follows when the intercepted factor is replayed against a login or transaction flow that still trusts weak second factors.
3. Escalation occurs when the attacker uses that foothold to approve payments, access sensitive banking functions, or move into privileged account workflows.
4. Impact is the unauthorised completion of transactions or account actions that the weaker authentication method was supposed to prevent.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant authentication is becoming the regulatory floor, not an advanced option. The article shows a clear shift across banking and critical-sector guidance away from SMS OTP and toward stronger, possession-bound or cryptographic factors. That matters because compliance programmes built around weak fallback factors will increasingly fail policy review even when they still pass technical login checks. Practitioners should treat this as a baseline reset for authentication design.

Customer authentication and workforce MFA are converging on the same control logic. The EU, UAE and Philippines updates point in the same direction even though they apply to different user populations and operating contexts. That convergence means teams can no longer maintain a comfortable split between consumer-facing convenience controls and staff-facing security controls. Practitioners should align authentication governance across both populations, then vary factor strength by risk.

SMS OTP persistence now creates governance debt. Where regulations still tolerate SMS for limited use cases, the control is already being narrowed by function, channel and risk. The more a programme depends on SMS for broad login or transaction approval, the more it accumulates compliance friction and fraud exposure. Practitioners should treat every remaining SMS dependency as a future remediation item, not a stable design choice.

FIDO-style authentication is being normalised through regulation. The article’s references to FIDO-based methods in both banking and critical-sector guidance show that phishing resistance is becoming the practical benchmark for strong authentication. That does not eliminate the need for device assurance, recovery design or customer accessibility, but it does change the control target. Practitioners should plan for phishing resistance as the expected default in higher-risk journeys.

Strong authentication policy is now part of access governance, not just security architecture. When regulations specify who must use MFA, when SMS is insufficient, and what counts as acceptable assurance, authentication becomes a governance problem with audit consequences. That pushes IAM, PAM and compliance teams into the same operating model. Practitioners should manage authentication as a governed lifecycle decision across users, devices and channels.

What this signals

Weak-factor retirement is becoming an authentication programme milestone. Identity teams should expect more policy pressure to move SMS OTP and email OTP into exception-only status for banking and privileged workflows. The operational question is no longer whether stronger MFA exists, but where weak factors are still tolerated and how quickly that tolerance can be removed.

Authentication policy now needs channel-specific governance. Customer banking, mobile access, workforce login and privileged access cannot all be governed with the same factor profile if the programme wants to stay aligned with emerging rules. Practitioners should separate convenience-driven journeys from assurance-driven journeys and document the policy rationale for each.

For practitioners

• Replace broad SMS OTP dependence Identify customer and workforce flows that still rely on SMS or email OTP as the primary or only factor, then set a removal timetable for sensitive actions and remote access.
• Prioritise phishing-resistant MFA for high-risk access Use cryptographic or FIDO-based authentication for remote login, privileged access and transaction approval where replay, phishing or interception would create material loss.
• Separate authentication policy by journey risk Define different factor requirements for customers, employees and privileged users so low-risk convenience settings do not leak into high-risk access paths.
• Build device trust checks into mobile banking access Block non-secure, rooted, jailbroken or emulated devices from sensitive banking apps and pair that with device fingerprinting for unknown-device detection.
• Document regulatory exceptions and fallback paths Track any remaining weak-factor exceptions by jurisdiction, business line and channel so audit teams can see where weaker authentication is still temporarily permitted.

Key takeaways

• Strong customer authentication is tightening across multiple regions, and weak second factors are being pushed toward the edge of acceptable use.
• The regulatory direction is converging on phishing-resistant MFA for higher-risk banking and workforce scenarios, especially where remote access and transaction approval are involved.
• IAM and compliance teams should rework authentication policy by journey and risk tier now, because SMS OTP-heavy designs will create avoidable remediation debt.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
• Strong Customer Authentication: A regulated authentication requirement that demands more than a single password or code. Under PSD2, it requires at least two factor types and must support the payment context, so the approval is tied to the specific transaction rather than a reusable login event.
• FIDO Authentication: A passwordless authentication method that uses asymmetric cryptography instead of shared secrets. The authenticator keeps the private key and proves possession through a challenge-response flow, which reduces phishing and replay risk because nothing reusable is transmitted across services.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.