Topic starter
14/09/2026 10:10 am
TL;DR: Banks are facing a wider identity threat surface as autonomous agents, phishing-resistant authentication gaps, and AI-amplified fraud erode trust in static login models, according to OneSpan. The governing assumption that identity can be verified once and then trusted no longer holds when attackers can fake, steal, or automate their way through every step of the session.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Why yesterday’s identity security standards no longer work for banks”.
By the numbers:
- 91% of global customers rate a bank’s customer experience as important as its products.
- 28% of global customers say customer experience is more important than a bank’s products.
- 47% of global customers said they would leave a bank over poor user experience.
Key questions
Q: What breaks when banks rely on login controls to stop AI-assisted account takeover?
A: Login-only defence breaks when attackers can reuse valid credentials, vary their behaviour, and keep testing until one account path looks legitimate enough to pass.
Q: Why do passwords and shared secrets create so much fraud risk in banking?
A: Passwords and shared secrets are easy to phish, replay, or trick users into revealing, especially when attackers can generate convincing bank impersonations at scale.
A: Use layered controls that combine phishing-resistant authentication, risk-based step-up checks, bot mitigation, and behavioral analytics.
Practitioner guidance
- Bind high-risk transactions to stronger signals Require cryptographic or device-bound confirmation for payments, beneficiary changes, and other high-risk actions so a stolen session alone is not enough to authorise movement of money.
- Shift priority from passwords to phishing-resistant authentication Accelerate passkey or equivalent phishing-resistant rollout for customer and workforce journeys where password replay, credential theft, and social engineering drive the highest loss exposure.
- Harden account recovery as a fraud path Review recovery flows with the same scrutiny as primary authentication because attackers increasingly target the path that resets trust rather than the path that proves identity.
Bottom line: Banks now face a control gap where login success no longer guarantees safe session or transaction behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
Static identity verification is now a broken banking assumption: the article shows that one-time login trust was designed for a world where credentials, sessions, and user intent stayed stable long enough to be evaluated once. That assumption fails when attackers can fake signals, steal credentials, or automate the next step of the interaction after login. The implication is that banks must treat identity as a continuing trust state, not a completed event.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When does transaction binding become necessary in banking identity control?
A: Transaction binding becomes necessary when authenticating the user is no longer enough to trust the action. If attackers can survive login and then alter or trigger payments, the bank needs a separate trust signal for the transaction itself. This is especially important for payments, beneficiary changes, and other high-risk actions.
👉 Read our full editorial: Identity security standards for banks are failing under agentic AI