Topic starter
11/07/2026 8:29 pm
TL;DR: Login-only MFA leaves recovery, session and support-channel abuse outside the main trust boundary, Authsignal and iProov show. Journey-based authentication has to move beyond sign-in so high-risk actions get fresh, resistant checks.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Webinar July 2025 - Building high-trust in the age of AI-powered fraud”.
Key questions
Q: Why do passkeys reduce phishing risk compared with passwords?
A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret.
Q: How should teams use biometrics in customer identity journeys?
A: Use biometrics at trusted enrolment and at high-risk recovery or reactivation points, not as a universal login factor.
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Practitioner guidance
- Map authentication controls to the full customer journey Identify where login, session, recovery, reactivation, support and transaction approval each create a distinct assurance requirement.
- Deploy passkeys where phishing and replay dominate Prioritise passkey rollout for journeys that are repeatedly targeted by phishing, OTP relay and session hijacking.
- Bind biometric enrolment to high-trust onboarding Capture biometric evidence during initial identity proofing or onboarding, then reuse that binding for account recovery and dormant account reactivation.
Bottom line: Login-only MFA leaves recovery, session and support-channel abuse outside the main trust boundary.
Glossary terms: Journey-based authentication, Passkey, Biometric Binding, Session Hijacking
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
11/07/2026 8:58 pm
Front-door MFA is a broken assumption, not just a weak control: It was designed for a world where authentication happened once and remained valid for the rest of the interaction. That assumption fails when fraud is distributed across login, session use, recovery and support channels. The implication is that identity governance has to follow the journey, not the first checkpoint.
A question worth separating out:
Q: How should organisations choose between passkeys and facial biometrics?
A: Choose based on assurance, not convenience. Passkeys are strong for phishing resistance and device-bound authentication, but facial biometrics can provide a stronger link between the presenting person and the account in high-risk journeys. Use biometrics where impersonation would be especially costly, and reserve passkeys for lower-risk flows that still need modern passwordless protection.
👉 Read our full editorial: AI-powered fraud is exposing the limits of traditional MFA