Topic starter
01/08/2026 8:55 pm
TL;DR: Transaction fraud is rising fast, with phishing attacks up 58.2% year over year and financial services losses averaging $4.61 for every $1 lost to fraud, according to OneSpan and LexisNexis research. The real control issue is that transaction verification must resist both credential theft and message manipulation, not just authenticate a user.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “The phishing-resistant future of banking security”.
Key questions
Q: What fails when transaction signing is not tied to the exact payment details?
A: The control fails because the customer may authenticate successfully while approving altered data.
Q: When should banks prioritise transaction signing over stronger login controls?
A: Banks should prioritise transaction signing whenever the main risk is payment manipulation, beneficiary redirection or session interception rather than simple account access.
Q: What are the signs that transaction approval controls are failing?
A: Common signs include fraud that occurs after successful login, customer complaints that approved details do not match what later executed, and repeated reliance on OTPs even where phishing and replay risk are high.
Practitioner guidance
- Strengthen transaction-level verification Separate login authentication from transaction approval so the bank confirms the exact amount, destination and context at signing time, not only at session start.
- Adopt phishing-resistant authenticators Prioritise authenticators that reduce replay risk and resist credential theft for customer flows that can move money or change beneficiary details.
- Bind approval to displayed transaction data Use dynamic linking or WYSIWYS-style display controls so the signed payload cannot differ from the data the customer reviewed on screen.
Bottom line: Transaction fraud can succeed even when login security holds, because attackers may alter the payment details after authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:03 pm
Transaction integrity has become the real banking identity control: authentication no longer provides enough assurance if the transaction payload can still be modified after login. Banks now need proof that the approved action is the same action that reaches execution. That makes signing controls part of identity governance, not just fraud tooling. Practitioners should reframe approval as an integrity control, not a session extension.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should security teams balance customer experience and phishing resistance in banking?
A: They should remove avoidable friction from low-risk steps while adding strong verification where money or account changes are involved. The goal is not to make every interaction harder, but to concentrate friction at the point where transaction integrity matters most. That gives banks a better balance between usability, fraud resistance and regulatory assurance.
👉 Read our full editorial: Phishing-resistant transaction signing is becoming core banking control