Topic starter
10/07/2026 9:16 pm
TL;DR: A 2026 survey of 200 IAM leaders at US and Canadian financial organisations found 82% believe current controls can stop account takeover, even as 94% report more phishing, only 28% of workforce MFA is phishing-resistant, and just 15% of authentication flows are passwordless, according to Secret Double Octopus. Confidence is now the blind spot, because legacy coverage and phishable methods leave the sector exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Secret Double Octopus: “82% of Financial Firms Feel Protected From Account Takeover. A New 2026 Survey Says Otherwise.”.
By the numbers:
- 82% of IAM leaders are confident their current controls can mitigate account takeover risk.
- 94% of financial firms report more phishing.
- Only 28% of MFA is phishing-resistant.
Key questions
Q: What breaks when account takeover defences rely only on MFA?
A: MFA alone fails when the attacker avoids the strongest sign-in path and pivots to password reset, reused passwords, or automation that makes many attempts cheaply.
Q: Why do legacy authentication paths create more risk than modern SaaS logins in financial services?
A: Legacy paths often cannot support modern federation, device-bound methods, or other phishing-resistant options, so organisations fall back to weaker controls.
Q: What signs show that an authentication programme is not truly phishing resistant?
A: Look for shared secrets, OTP dependence, push fatigue risks, and exceptions for privileged users.
Practitioner guidance
- Inventory authentication by method, not just by application Break out SMS OTP, push, FIDO2, biometrics, and passwordless by workforce population and by application so the real phishable surface is visible.
- Separate SaaS and legacy MFA coverage in reporting Report coverage for legacy apps independently from SaaS because blended averages hide where older systems are still the weakest path into the estate.
- Define passwordless as password removal Treat any flow that still depends on a reusable password behind the scenes as password-based, even if the user no longer types it.
Bottom line: Financial firms are not short on authentication controls so much as short on controls that resist phishing in practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:39 pm
Phishing-resistant coverage, not MFA presence, is now the real control line in financial identity security. The survey shows that organisations can feel protected while still leaning on SMS, OTP, and push-based flows that attackers know how to defeat. The governance mistake is treating MFA as a binary achievement instead of measuring whether the enrolled methods actually resist phishing. Practitioners should read this as a control-quality problem, not a coverage checkbox.
A question worth separating out:
Q: Should financial firms prioritise passwordless over expanding traditional MFA coverage?
A: They should prioritise the highest-risk paths first, but passwordless matters because it removes the reusable password from the flow rather than layering another factor on top. If the environment still depends on phishable methods for critical applications, more MFA coverage alone may improve appearance without materially reducing takeover risk.
👉 Read our full editorial: Financial identity security confidence is outrunning real protection