Topic starter
11/07/2026 1:59 pm
TL;DR: Small banks and credit unions remain exposed because passwords, legacy systems, and incomplete MFA coverage still create account takeover paths, while regulators are tightening expectations for stronger authentication across financial services, according to Secret Double Octopus. The real problem is not MFA adoption alone but whether workforce access can be made phishing-resistant across VPN, desktops, and legacy applications.
Editorial analysis by NHI Mgmt Group, based on content published by Secret Double Octopus: “Credit Unions and Small Banks Deserve Phishing-Resistant MFA Too”.
By the numbers:
- 80% of Mastercard’s confirmed data breaches are linked to weak or stolen passwords.
- NYDFS requires MFA for any individual accessing any of its information systems starting November 1st 2025.
Key questions
Q: What breaks when workforce MFA still depends on passwords first?
A: Password-first MFA still leaves attackers a phishable secret to steal, replay, or guess before the second factor is even relevant.
Q: Why do legacy banking applications create phishing-resistant MFA gaps?
A: Older applications may not support modern federation, passwordless flows, or consistent policy enforcement across all access routes.
Q: How can security teams tell whether adaptive MFA is working properly?
A: Look for a lower challenge rate on routine sessions, a higher challenge rate on suspicious transactions, and stable or improved conversion.
Practitioner guidance
- Map authentication coverage by access path Inventory every workforce access route, including VPN, desktops, cloud apps, and legacy on-premise systems, and identify where passwords still remain the first factor.
- Classify legacy systems as formal MFA exceptions Document which banking platforms cannot yet support enterprise SSO or passwordless authentication, then track them as named exceptions with owners and remediation dates.
- Remove password dependence from workforce sign-in Prioritise phishing-resistant flows that eliminate reusable passwords for the access paths most exposed to phishing and replay.
Bottom line: Passwords still create takeover risk in small financial institutions when they remain part of the workforce authentication flow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
Phishing-resistant MFA is only real when the phishable first factor disappears. If passwords still sit at the front of the authentication flow, the control is compensating for a weak secret rather than replacing it. That leaves the same attacker playbook intact, especially in regulated workforce environments where credential replay remains the easiest path. The practitioner conclusion is simple: the first factor matters as much as the second.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Who is accountable when partial MFA deployment leaves regulated access exposed?
A: Identity, security, and application owners share accountability because the failure usually sits at the boundary between policy, legacy architecture, and access operations. In regulated financial environments, that boundary matters because auditors assess whether control coverage matches the actual workforce access model.
👉 Read our full editorial: Phishing-resistant MFA gaps keep small banks exposed to takeover risk