Topic starter
10/06/2026 11:11 pm
TL;DR: A phishing campaign targeting RBC Direct Investing clients used a fake W-8BEN renewal flow to harvest credentials and tax data, then relied on the fact that authentication still leaves post-login authority largely unchecked, according to EnforceAuth. The hard problem is not entry, but continuous authorisation after the login event has already succeeded.
Editorial analysis by NHI Mgmt Group, based on content published by EnforceAuth: “Credential Harvesting and the Authorization Gap in Financial Services”.
By the numbers:
- 22% of breaches start with stolen credentials, according to Verizon DBIR 2025 research cited by EnforceAuth.
- 246 days is the mean time to identify and contain credential breaches, according to IBM 2025 research cited by EnforceAuth.
- The ratio of machine identities to human identities reached 144:1 in some environments, according to Entro Labs H1 2025 NHI Risk Report cited by EnforceAuth.
Key questions
Q: What breaks when phishing succeeds but post-login authorisation is weak?
A: The failure is not the login event itself, but the assumption that authentication is enough to govern what happens next.
Q: Why do stolen credentials create such a large risk in financial services?
A: Stolen credentials are dangerous in financial services because one login often reaches multiple applications, data sets, and delegated workflows.
Q: What are the signs that runtime authorization is failing?
A: Look for inconsistent access behaviour across services, repeated policy logic in code, slow manual change cycles when rules move, and decision logs that cannot explain allow or deny outcomes.
Practitioner guidance
- Define post-login decision points Place authorisation checks at application, data, and workload boundaries so a stolen session is evaluated at each request, not trusted for the life of the login.
- Inventory inherited trust paths Map where human sessions automatically inherit access into APIs, service accounts, and AI workloads, then separate those trust paths from the initial authentication event.
- Move to policy-as-code Version, test, and deploy authorisation rules so response to active phishing or credential abuse can happen without waiting for manual change windows.
Bottom line: The article argues that the main weakness exposed by the RBC Direct Investing phishing campaign is not credential capture itself but the lack of continuous control after login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 5:01 am
Authorization gaps are now the decisive failure mode in financial services identity security. The RBC Direct Investing campaign shows that the sector’s hardest problem is no longer whether a user can be made to log in, but whether the identity can be constrained after login. Authentication is necessary, yet it is only a front-door control. The practitioner conclusion is that financial services identity programmes must be judged on runtime enforcement, not login success rates.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should organisations treat human and non-human SaaS access the same way?
A: They should apply the same governance standard, even if the operational details differ. Human users, service accounts, and application identities can all accumulate excess permissions, so approval, review, and revocation discipline should cover each of them. The key difference is frequency and automation, not whether least privilege applies at all.
👉 Read our full editorial: Authorization gaps in financial services are the real post-phish risk
This post was modified 1 day ago by NHI Mgmt Group