Topic starter
22/06/2026 4:59 pm
TL;DR: Financial institutions now need phishing-resistant authentication that works across web, mobile, contact centres, branches, wire approvals, and payment rails, because passwordless web login alone leaves the highest-loss channels exposed, according to Scramble ID. The real control gap is not authentication at the login page but cryptographic identity binding across every customer and employee touchpoint.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “Authentication for Financial Services: Defending Banks, Wealth, and Payments Against AI-Era Fraud”.
Key questions
Q: What breaks when authentication is not phishing-resistant?
A: The trust boundary between the user and the system becomes easy to impersonate.
Q: Why do knowledge-based questions fail as a banking authentication control?
A: Because the answers are often available from breach data, social engineering, or publicly available records, so they do not reliably distinguish the real customer from an impersonator.
Q: How do banks know if accessible authentication is actually working?
A: Look for completion rates across user groups, support-assisted sign-in volume, exception requests, and the number of flows that fail under assistive technology testing.
Practitioner guidance
- Map authentication by channel Inventory every customer and employee touchpoint, including contact centre, branch, wire approval, mobile recovery, and payment rails, then assign a phishing-resistant method to each path.
- Replace KBA as primary trust Move security questions to read-only fallback only and require cryptographic caller verification before any sensitive customer action or account change.
- Bind credentials to devices Issue device-held cryptographic credentials that survive across web and mobile, and make recovery paths use the same assurance level as primary authentication.
Bottom line: Financial services cannot rely on passwordless web login alone because the real exposure sits in contact centres, branches, wire approvals, and payment workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:12 pm
Omnichannel authentication is now the real baseline, not web passwordless. Financial institutions do not lose money only at the login page, so a web-only passkey deployment leaves the most lucrative fraud paths untouched. The authentication control has to travel with the customer or employee across call centres, branches, wires, and payment rails. Practitioners should treat channel coverage as the core governance question.
Cryptographic identity binding: banks should expect authentication programmes to shift from channel-specific MFA projects to lifecycle-controlled identity binding across the customer and workforce journey. The operational question is whether recovery, branch verification, and wire authorisation use the same assurance level as sign-in, because otherwise fraud simply relocates to the weakest exception path.
A question worth separating out:
Q: What is the difference between identity verification and transaction approval?
A: Identity verification answers who or what appears to be asking. Transaction approval answers whether the action should happen. Fraud often works when organisations collapse those two steps into one, allowing a convincing identity signal to trigger an irreversible business outcome without separate control over the decision itself.
👉 Read our full editorial: Phishing-resistant authentication is now a financial services baseline