Topic starter
15/08/2026 6:07 pm
TL;DR: Authentication gains have not stopped fraud because attackers now exploit enrollment, session, and device-trust gaps across the customer lifecycle, according to Fingerprint, while Juniper Research projects financial fraud losses will reach $58.3 billion globally by 2030. The real control boundary has shifted from credential verification to persistent device intelligence that can survive across sessions.
Editorial analysis by NHI Mgmt Group, based on content published by Fingerprint: “Device intelligence for banking: Strengthening identity and trust”.
By the numbers:
- Fraud losses are projected to cost financial institutions $58.3 billion globally by 2030, a 153% surge from 2025 levels.
- Losses from account takeover fraud in the U.S. totaled $15.6 billion in 2024, up from $12.7 billion the year prior.
- Every dollar lost to a fraudster costs North American financial institutions $4.41, according to the LexisNexis True Cost of Fraud Report cited by Fingerprint.
Key questions
Q: What breaks when banking authentication is strong but device trust is not persistent?
A: A strong login only proves that a check passed at one moment.
Q: Why do passkeys still leave account takeover risk in place?
A: Passkeys remove reusable secrets from login, but they do not eliminate weaker alternate paths attached to the same account.
Q: How can banks tell whether device intelligence is actually working?
A: It should surface repeat device patterns across accounts, flag suspicious enrollment and recovery flows, and reduce the number of high-risk actions that rely only on a single authentication event.
Practitioner guidance
- Strengthen enrollment controls for trusted devices Require additional verification when a new device is bound to a passkey, biometric profile, or recovery path, especially after a recent account recovery or SIM change.
- Correlate device reuse across accounts Join onboarding, login, payee creation, and payment events to spot the same device environment appearing across unrelated accounts or high-risk actions.
- Treat session continuity as a fraud signal Flag token reuse, session takeover indicators, and abnormal concurrent control patterns so that a valid login does not automatically imply a trustworthy transaction.
Bottom line: The article shows that modern banking fraud is no longer limited by weak passwords, because attackers now exploit the gap between a successful login and an actually trustworthy device.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:16 pm
Persistent device intelligence is now part of identity governance, not just fraud analytics. Banks have spent years hardening login assurance, but the article shows that lifecycle trust now depends on whether the same device environment keeps reappearing across onboarding, recovery, and transactions. That changes the governance question from "Did the user authenticate?" to "Can this device profile be trusted over time?" Practitioners should treat device continuity as a core control surface.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should fraud teams prioritise device intelligence over stronger identity proofing?
A: They should treat them as complementary controls, but prioritise device intelligence when the dominant risk is session replay, botting, or verification interception. Stronger proofing helps at enrolment, yet it does not stop a verified session from being reused elsewhere. Device intelligence closes the gap between proofing and ongoing trust.
👉 Read our full editorial: Persistent device intelligence is now core to banking identity risk