Topic starter
11/07/2026 8:29 pm
TL;DR: Traditional MFA that stops at login no longer covers the full customer journey as phishing, session hijacking, contact center fraud, and SMS man-in-the-middle attacks shift risk beyond the front door, according to Authsignal and iProov. The practical lesson is that authentication must become journey-based, risk-aware, and resistant to replay, not just stronger at sign-in.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Webinar July 2025 - Building high-trust in the age of AI-powered fraud”.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why do passkeys reduce phishing risk compared with passwords?
A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret.
Q: How should teams use biometrics in customer identity journeys?
A: Use biometrics at trusted enrolment and at high-risk recovery or reactivation points, not as a universal login factor.
Practitioner guidance
- Map authentication controls to the full customer journey Identify where login, session, recovery, reactivation, support and transaction approval each create a distinct assurance requirement.
- Deploy passkeys where phishing and replay dominate Prioritise passkey rollout for journeys that are repeatedly targeted by phishing, OTP relay and session hijacking.
- Bind biometric enrolment to high-trust onboarding Capture biometric evidence during initial identity proofing or onboarding, then reuse that binding for account recovery and dormant account reactivation.
Bottom line: Login-only MFA leaves recovery, session and support-channel abuse outside the main trust boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:58 pm
Front-door MFA is a broken assumption, not just a weak control: It was designed for a world where authentication happened once and remained valid for the rest of the interaction. That assumption fails when fraud is distributed across login, session use, recovery and support channels. The implication is that identity governance has to follow the journey, not the first checkpoint.
A question worth separating out:
Q: How should organisations choose between passkeys and facial biometrics?
A: Choose based on assurance, not convenience. Passkeys are strong for phishing resistance and device-bound authentication, but facial biometrics can provide a stronger link between the presenting person and the account in high-risk journeys. Use biometrics where impersonation would be especially costly, and reserve passkeys for lower-risk flows that still need modern passwordless protection.
👉 Read our full editorial: AI-powered fraud is exposing the limits of traditional MFA