Topic starter
04/07/2026 10:15 pm
TL;DR: Passwords remain one of the top two initial access vectors, while banks face account takeover fraud, credential stuffing, and relay attacks that bypass SMS and push-based MFA, according to RSA Security and the 2026 Verizon DBIR. FIDO2 passkeys and post-quantum planning shift the control point from shared secrets to cryptographic assurance and regulatory readiness.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Passwordless Banking in 2026: FIDO2, PSD3 Compliance, and Post-Quantum Security”.
Key questions
Q: Where do phishing-resistant banking controls fail in practice?
A: They fail when the bank hardens primary login but leaves recovery, help desk, or fallback authentication paths exposed.
Q: Why do banks need phishing-resistant authentication instead of stronger MFA?
A: Stronger MFA still fails if the second factor can be relayed, intercepted, or approved under pressure.
Q: How do IAM teams know whether passwordless adoption is actually working?
A: They should look for fewer lockouts, fewer reset requests, shorter time to access, and lower dependence on help desk intervention.
Practitioner guidance
- Replace shared-secret login paths Prioritise FIDO2 or equivalent phishing-resistant authentication for customer and staff flows where account takeover risk is highest, especially online banking and privileged access.
- Eliminate weak recovery back doors Review enrollment, account recovery, and help desk verification paths for password resets, SMS fallback, and manual override steps that undermine the primary authenticator.
- Separate authenticator assurance by user population Use device-bound passkeys or hardware security keys for high-risk roles, while allowing synced passkeys only where recovery and device trust assumptions are acceptable.
Bottom line: Passwords and SMS-based factors still leave banks exposed to phishing, replay, and credential stuffing, even when MFA is present.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/07/2026 10:18 pm
Phishing-resistant authentication is now a banking governance requirement, not a usability upgrade. The article shows that passwords, SMS codes, and push prompts remain exploitable because attackers target the surrounding human and help desk workflows, not just the login field. That means authentication decisions now affect fraud loss, regulatory posture, and assurance design together. For practitioners, the control question is no longer whether MFA exists, but whether the method can survive relay, replay, and coercion.
A question worth separating out:
Q: What should banks do when phishing-resistant authentication meets regulatory scrutiny?
A: They should map the authentication design to PSD3, PSR1, and DORA as one governance problem rather than three separate reviews. That means documenting phishing resistance, dynamic linking where required, alternative authenticator support, and operational continuity evidence before supervisory questions become audit findings.
👉 Read our full editorial: Passwordless banking now depends on phishing-resistant identity