Topic starter
11/07/2026 8:37 pm
TL;DR: 10% of 385,000 retroactive SMS and voice OTP transactions used non-fixed VoIP lines, 2.5% of mobile MFA traffic had low Trust Score, and 5% showed low SIM tenure, exposing weak identity evidence behind consumer MFA, according to Prove Identity analysis. The lesson is that added factors do not fix weak trust signals when the underlying identity proofing is thin.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “New Study by Prove Unveils Large-Scale Consumer Multi-Factor Authentication Vulnerabilities”.
By the numbers:
- 10% of multi-factor authentication transactions were over Non-Fixed VoIP lines.
- 2.5% of mobile MFA transactions were found to have low Trust Score.
- 5% of mobile MFA transactions were found to have low SIM tenure.
Key questions
Q: What should identity teams do when MFA succeeds but phone identity is low confidence?
A: They should not treat OTP success as sufficient on its own.
Q: Why do weak phone signals increase consumer account takeover risk?
A: Because they let an attacker satisfy the MFA step without proving a durable customer identity.
Q: What are the signs that consumer MFA is relying on poor evidence?
A: The most obvious signs are elevated use of non-fixed VoIP, a rising share of low Trust Score transactions, and low SIM tenure in transactions that still pass authentication.
Practitioner guidance
- Define risk thresholds for low-confidence phone signals Set policy thresholds for Trust Score, SIM tenure, and non-fixed VoIP use so that weak signals trigger stronger checks before MFA succeeds.
- Separate standard and high-risk consumer authentication paths Use different assurance paths for routine logins and sensitive account actions, especially where phone identity confidence is low or recent.
- Treat VoIP as a risk input, not a neutral channel Score non-fixed VoIP lines in consumer authentication workflows and block or step up only where the business risk justifies it.
Bottom line: Consumer MFA can complete successfully while the underlying identity evidence remains weak, which means factor presence is not the same as trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:06 pm
Consumer MFA is only as strong as the identity evidence behind it. The article shows that a completed OTP challenge does not necessarily mean a trusted customer was present. When phone numbers are non-fixed, newly swapped, or otherwise low-confidence, MFA becomes a channel check rather than an identity assurance control. Practitioners should treat trust scoring as part of authentication design, not as a separate fraud feature.
A question worth separating out:
Q: How can teams tell whether MFA is actually reducing fraud?
A: Look beyond login success rates and measure account takeover frequency, proxy use, anomalous device changes, and the share of high-risk transactions blocked after step-up. If authentication is working, it should reduce abuse without shifting the problem into recovery, support, or manual review queues.
👉 Read our full editorial: Consumer MFA vulnerabilities expose the limits of trust signals