Topic starter
11/07/2026 8:36 pm
TL;DR: Phishing, voice cloning and deepfake document fraud have driven attack costs toward near zero, IDlayr argues, against knowledge-based authentication. Consumer authentication now needs controls that bind high-risk actions to a verified device or SIM instead of secrets or human recognition.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “La IA ha cambiado las reglas del fraude: es hora de replantearse la identidad digital”.
Key questions
Q: Why do knowledge-based factors fail so quickly under AI-enabled fraud?
A: They fail because the attacker no longer needs to break the secret directly.
Q: What are the signs that consumer authentication is too easy to socially engineer?
A: Look for repeated OTP interception, support-team bypasses, recovery abuse and fraud attempts that succeed without malware.
Q: What should teams do first when replacing SMS OTP?
A: Start with the single user journey that has the highest fraud loss or abandonment rate, then run the replacement in shadow mode before changing the live experience.
Practitioner guidance
- Replace SMS OTP on high-risk flows Move the most fraud-sensitive consumer journeys away from SMS codes and other user-entered secrets.
- Bind authentication to device possession Use device- or SIM-verified checks for step-up authentication so the trust decision is tied to something the attacker cannot copy remotely.
- Rework fraud controls for AI-generated deception Assume callers, documents and support interactions can be synthetically generated at production quality.
Bottom line: AI-enabled fraud is breaking consumer authentication models that rely on secrets, human recognition or user-entered codes.
Glossary terms: Knowledge-based authentication, Possession-Based Authentication, Silent Network Authentication, Agentic Commerce
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 9:04 pm
AI has collapsed the economics of identity fraud by turning the human trust step into the primary attack surface. When authentication still depends on the user spotting deception, attackers only need to produce something convincing enough to trigger a response. That shift invalidates consumer IAM designs that assume people can reliably distinguish real prompts from synthetic ones. The implication is that identity programmes must stop pricing in human vigilance as a control.
A question worth separating out:
Q: What is the difference between possession-based authentication and passkeys in practice?
A: Possession-based authentication proves control of a specific device or SIM at the moment of verification. Mainstream passkeys often sync through the cloud, so they reduce password risk but do not always create the same hard device binding. For fraud-prone consumer journeys, the difference matters because only the stronger binding resists replay and social engineering.
👉 Read our full editorial: AI-enabled fraud is breaking identity assumptions in consumer auth