How is multi-factor authentication used at bank kiosks?

How MFA works at a bank kiosk

At a bank kiosk, MFA is usually a step-up check layered onto a customer’s normal sign-in or transaction flow. The kiosk asks for two or more factors that come from different categories, for example something the customer has, such as a card or account credential, and something they know or are, such as a PIN, passcode or biometric. The goal is to reduce the value of a stolen card or guessed PIN by making one factor alone insufficient.

In practice, the kiosk has to keep the interaction short and predictable. Customers should not be left signed in after they walk away, and any authentication prompt should expire quickly if the session is idle. That matters because kiosks are shared, public-facing endpoints, so the authentication design has to assume distraction, queue pressure and opportunistic misuse.

A strong kiosk design also treats the physical environment as part of authentication. Screen placement, privacy filters, keypad shielding and limited on-screen exposure help reduce shoulder surfing and casual observation of PIN entry or one-time codes. If a biometric is used, the bank must make sure the device is both reliable for the intended customer population and resistant to simple replay or spoofing attempts.

What can make kiosk authentication fail

Authentication can fail even when the factors themselves are sound. The weak point is often the flow around them: reused credentials, a kiosk that stays unlocked too long, an exposed keypad, or a peripheral device that is not securely managed. Because the kiosk is a shared access point, the bank has to defend both the login step and the device that collects it.

The same principle applies to fraud and impersonation attempts. If repeated failed attempts are not rate-limited or if the kiosk does not lock after suspicious behavior, an attacker can keep probing until they find a weak factor, exploit a customer’s convenience pattern, or abuse a distraction-based attack. The kiosk should therefore fail closed, not fail open.

A bank should also secure the kiosk software stack and attached peripherals as part of the authentication control. If an attacker can tamper with the kiosk application, card reader, camera, fingerprint sensor or PIN pad, they may bypass the intended factor check entirely or capture the material used to complete it. That is why kiosk authentication is never just a user interface concern; it is also endpoint hardening and device trust.

Using kiosk MFA without turning the kiosk into a weak link

Good MFA at a bank kiosk is not only about which factors are accepted. It is also about which factors are appropriate in a public, supervised or semi-supervised environment. One-time codes and PINs are convenient, but they need careful handling because they can be observed, relayed or captured if the kiosk experience is sloppy. Phishing-resistant methods are stronger where the bank can support them, especially for higher-risk transactions.

For broader guidance on factor choices, bypass patterns and rollout trade-offs, the MFA Guide is useful because the same weaknesses that affect remote sign-in, such as fatigue, relay and token theft, can also show up at shared banking touchpoints. For a bank-owned kiosk, that means the control design should assume both user error and deliberate abuse.

Operationally, the bank should decide when the kiosk is only for low-risk tasks and when it is allowed to complete higher-risk actions. That distinction matters because stronger MFA reduces account takeover risk, but it does not automatically make a kiosk suitable for every transaction type. Risk-based step-up checks should be aligned to the value of what the kiosk can do, not just to whether a factor prompt exists.

Practitioner Guidance

What to verify: Confirm that the kiosk session times out fast enough for a public environment, that failed attempts trigger lockout or alerting, and that the authentication path cannot be bypassed through exposed peripherals or unattended sessions.

Decision rule: If the kiosk handles anything beyond low-risk customer servicing, require a stronger factor combination and tighter device hardening than you would for a generic shared terminal. If the kiosk cannot support that reliably, narrow its function rather than weakening the control.

Common mistake: Treating MFA as solved once a PIN or one-time code is added. On a kiosk, the physical exposure, session handling and device integrity are part of the authentication control, not separate concerns.

Practitioner takeaway: The real measure of kiosk MFA is not whether the prompt exists, but whether the kiosk remains trustworthy after the customer starts interacting with it, and just as importantly, after they step away.

Related resources from NHI Mgmt Group

• Should organisations extend multi-factor authentication to personal devices used for work?
• What happens when multi-factor authentication is not used on corporate networks?
• Why is it crucial to adopt new authentication methods in MCP usage?
• What is the difference between WebAuthn and multi-factor authentication?