Behavioral biometrics and continuous authentication: what teams miss

TL;DR: Behavioral biometrics alone cannot stop modern fraud when attackers coerce legitimate users through social engineering, and Feedzai says that silos between biometrics, non-monetary events and transaction data create context gaps that weaken detection. Continuous session monitoring becomes the control point, because front-door MFA does not stop a victim who is already acting inside a compromised session.

Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “Why the Future of Fraud Prevention Belongs to Connected Data Layers”.

By the numbers:

• Annual identity fraud losses reached $27 billion, according to data from Javelin Strategy & Research.

Key questions

Q: How should financial institutions detect fraud after a user has already passed MFA?

A: They should treat MFA as only one checkpoint and continue monitoring the session for behavioural change, risky non-monetary actions and transaction anomalies.

Q: Why do disconnected fraud tools miss account takeover scams?

A: Because each tool sees only a slice of the journey.

Q: What are the signs that a logged-in customer may be under social engineering pressure?

A: Look for hesitation while completing fields, unusual copy and paste behaviour, screen-sharing software, background phone calls and activity that does not match the customer’s normal rhythm.

Practitioner guidance

• Build continuous session monitoring Correlate behavioural signals, device telemetry, non-monetary events and transaction data during the full customer session, not just at login.
• Use non-monetary events as early risk markers Flag actions such as new beneficiary creation, repeated balance checks and profile changes as risk-bearing events that can trigger step-up or blocking.
• Tune decisioning for coerced-user patterns Look for hesitation, unusual copy and paste use, screen-sharing activity and concurrent phone calls when the session appears authenticated but unusual.

Bottom line: Modern fraud can succeed after a valid login, which means MFA alone no longer establishes enough trust for the full session.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →