Topic starter
11/07/2026 8:37 pm
TL;DR: Non-fixed VoIP lines, low Trust Score, and low SIM tenure showed up in consumer MFA flows that still completed, according to Prove Identity. Phone-based assurance needs risk thresholds and step-up logic, not blanket trust in OTP success.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “New Study by Prove Unveils Large-Scale Consumer Multi-Factor Authentication Vulnerabilities”.
By the numbers:
- 10% of multi-factor authentication transactions were over Non-Fixed VoIP lines.
- 2.5% of mobile MFA transactions were found to have low Trust Score.
- 5% of mobile MFA transactions were found to have low SIM tenure.
Key questions
Q: Why do weak phone signals increase consumer account takeover risk?
A: Because they let an attacker satisfy the MFA step without proving a durable customer identity.
Q: What are the signs that consumer MFA is relying on poor evidence?
A: The most obvious signs are elevated use of non-fixed VoIP, a rising share of low Trust Score transactions, and low SIM tenure in transactions that still pass authentication.
Q: What should identity teams do when MFA succeeds but phone identity is low confidence?
A: They should not treat OTP success as sufficient on its own.
Practitioner guidance
- Define risk thresholds for low-confidence phone signals Set policy thresholds for Trust Score, SIM tenure, and non-fixed VoIP use so that weak signals trigger stronger checks before MFA succeeds.
- Separate standard and high-risk consumer authentication paths Use different assurance paths for routine logins and sensitive account actions, especially where phone identity confidence is low or recent.
- Treat VoIP as a risk input, not a neutral channel Score non-fixed VoIP lines in consumer authentication workflows and block or step up only where the business risk justifies it.
Bottom line: Consumer MFA can complete successfully while the underlying identity evidence remains weak, which means factor presence is not the same as trust.
Glossary terms: Consumer MFA, Trust Score, Non-Fixed VoIP, SIM Tenure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
11/07/2026 9:06 pm
Consumer MFA is only as strong as the identity evidence behind it. The article shows that a completed OTP challenge does not necessarily mean a trusted customer was present. When phone numbers are non-fixed, newly swapped, or otherwise low-confidence, MFA becomes a channel check rather than an identity assurance control. Practitioners should treat trust scoring as part of authentication design, not as a separate fraud feature.
A question worth separating out:
Q: How can teams tell whether MFA is actually reducing fraud?
A: Look beyond login success rates and measure account takeover frequency, proxy use, anomalous device changes, and the share of high-risk transactions blocked after step-up. If authentication is working, it should reduce abuse without shifting the problem into recovery, support, or manual review queues.
👉 Read our full editorial: Consumer MFA vulnerabilities expose the limits of trust signals