Topic starter
11/07/2026 8:36 pm
TL;DR: AI has driven the cost of phishing, voice cloning and deepfake document fraud against knowledge-based authentication toward near zero, according to IDlayr, while mobile possession factors offer structural resistance because they depend on something physically held and verified at the device or network layer. Passwords, PINs, SMS OTP and even biometrics no longer hold the trust boundary together when attackers can replicate the human side of authentication at scale.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “La IA ha cambiado las reglas del fraude: es hora de replantearse la identidad digital”.
Key questions
Q: What should teams do first when replacing SMS OTP?
A: Start with the single user journey that has the highest fraud loss or abandonment rate, then run the replacement in shadow mode before changing the live experience.
Q: Why do knowledge-based factors fail so quickly under AI-enabled fraud?
A: They fail because the attacker no longer needs to break the secret directly.
Q: What are the signs that consumer authentication is too easy to socially engineer?
A: Look for repeated OTP interception, support-team bypasses, recovery abuse and fraud attempts that succeed without malware.
Practitioner guidance
- Replace SMS OTP on high-risk flows Move the most fraud-sensitive consumer journeys away from SMS codes and other user-entered secrets.
- Bind authentication to device possession Use device- or SIM-verified checks for step-up authentication so the trust decision is tied to something the attacker cannot copy remotely.
- Rework fraud controls for AI-generated deception Assume callers, documents and support interactions can be synthetically generated at production quality.
Bottom line: AI-enabled fraud is breaking consumer authentication models that rely on secrets, human recognition or user-entered codes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:04 pm
AI has collapsed the economics of identity fraud by turning the human trust step into the primary attack surface. When authentication still depends on the user spotting deception, attackers only need to produce something convincing enough to trigger a response. That shift invalidates consumer IAM designs that assume people can reliably distinguish real prompts from synthetic ones. The implication is that identity programmes must stop pricing in human vigilance as a control.
A question worth separating out:
Q: What is the difference between possession-based authentication and passkeys in practice?
A: Possession-based authentication proves control of a specific device or SIM at the moment of verification. Mainstream passkeys often sync through the cloud, so they reduce password risk but do not always create the same hard device binding. For fraud-prone consumer journeys, the difference matters because only the stronger binding resists replay and social engineering.
👉 Read our full editorial: AI-enabled fraud is breaking identity assumptions in consumer auth