Notifications
Clear all
Topic starter
22/06/2026 4:55 pm
TL;DR: A major US credit bureau reported that deploying phishing-resistant cryptographic authentication across voice, web, agent, people, and frontline surfaces cut password reset tickets by more than 90% in sixty days and improved caller verification by 34%, according to Scramble ID. The result shows that omnichannel identity design can reduce both fraud exposure and operational friction at the same time.
NHIMG editorial — based on content published by Scramble ID: phishing-resistant authentication across five surfaces at a major US credit bureau
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams replace knowledge-based authentication in contact centres?
A: Security teams should replace knowledge-based authentication with phishing-resistant proof that is tied to the caller or user, not to memorised facts.
Q: Why do multi-surface identity programmes reduce fraud and support burden at the same time?
A: They reduce fraud and support burden because the same trust model applies across voice, web, workforce, and device channels.
Q: What breaks when support verification still depends on security questions?
A: Support verification breaks when the organisation assumes personal information is private enough to prove identity.
Practitioner guidance
- Remove KBA from high-risk support flows Eliminate security questions from contact-centre and helpdesk verification where cryptographic proof can be used instead.
- Unify assurance across all access surfaces Map voice, web, workforce, agent, people, and frontline channels to the same identity assurance policy so one surface does not become a bypass for another.
- Track reset tickets as a control metric Measure password reset volume, recovery turnaround, and repeat-contact rates after rollout so you can see whether the new authentication model is actually reducing burden.
What's in the full article
Scramble ID's full article covers the operational detail this post intentionally leaves for the source:
- The five-surface deployment pattern across voice, web, agent, people, and frontline access.
- The customer quote and outcome context behind the published 90%-plus reset-ticket reduction.
- The architecture notes that explain how one identity rail supports multiple access surfaces.
- The implementation references that map the deployment to caller authentication, passkeys, and device-proof workflows.
👉 Read Scramble ID's analysis of five-surface phishing-resistant authentication →
Five-surface passwordless authentication: what it changes for IAM?
Explore further
22/06/2026 5:06 pm
Five-surface authentication is an identity governance problem, not a login feature. Once voice, web, agent, people, and frontline access all depend on different trust checks, the organisation creates policy seams that attackers can route through. The useful lesson here is that assurance has to be governed as a cross-channel control plane, not as a collection of isolated point solutions. Practitioners should treat cross-surface consistency as a governance requirement, not a convenience.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to NHI Mgmt Group research.
A question worth separating out:
Q: Who is accountable when phishing-resistant authentication still leaves recovery gaps?
A: Accountability sits with the identity, support, and security owners jointly, because recovery design is part of the authentication control. If recovery still relies on weak evidence, the programme has only moved the risk from login to fallback paths, which is still an IAM governance failure.
👉 Read our full editorial: Phishing-resistant authentication across five surfaces cuts reset friction
