How should banks adapt IAM controls for AI-driven phishing attacks?

Why This Matters for Security Teams

AI-driven phishing changes the bank attacker playbook by increasing volume, personalization, and speed at the same time. The real risk is not only credential theft at the login page, but also push fatigue, help desk impersonation, and reset-flow abuse that can bypass strong authentication entirely. Guidance from CISA cyber threat advisories consistently shows that adversaries exploit whichever control path is weakest, not just the primary sign-in flow. Banks that stop at MFA upgrades without hardening recovery and support operations leave a blind spot. NHIMG research on Microsoft Midnight Blizzard breach and Salt Typhoon US telecoms breach underscores how stolen credentials and trusted workflows remain a durable entry point even when perimeter controls are present. One relevant NHIMG data point is that The 2024 Non-Human Identity Security Report found 59.8% of organisations see value in dynamic ephemeral credentials, which is the direction bank identity teams are increasingly forced to consider. In practice, many security teams encounter phishing resistance gaps only after a help desk reset or push approval has already been abused.

How It Works in Practice

Banks should treat phishing resilience as an identity lifecycle problem, not a front-door authentication problem. The goal is to make stolen secrets, replayed approvals, and social-engineered resets useless. That means using phishing-resistant authenticators for employees and contractors, especially privileged users and exposed service desks, while tightening out-of-band recovery paths to the same assurance level as primary login. Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls supports strong authentication and account management controls, but banks must operationalize them against fast-moving social engineering, not just annual compliance checks.

Practical implementation usually includes:

• Hardware-backed phishing-resistant authentication for staff with elevated access, such as FIDO2 security keys or equivalent proof-of-possession methods.
• Step-up verification for high-risk actions, including beneficiary changes, wire approvals, device enrollment, and recovery requests.
• Strict help desk identity proofing, with verified callbacks, ticket correlation, and approvals that cannot be satisfied by email alone.
• Monitoring for anomalous reset behavior, new device enrollment spikes, and impossible-travel or session-transfer patterns.
• Short-lived session tokens and rapid revocation when user behavior or recovery activity looks suspicious.

AI increases the quality of lure content, but it also accelerates adversary experimentation across channels. NHIMG’s LLMjacking: How Attackers Hijack AI Using Compromised NHIs research highlights how quickly attackers move once credentials are exposed, which is why banking IAM must assume rapid abuse after first contact. The same lesson appears in the Anthropic report on an AI-orchestrated cyber espionage campaign, where automation amplifies recon and social engineering at scale. These controls tend to break down in banks that still rely on shared recovery desks, inconsistent customer support scripts, or legacy authentication flows that cannot distinguish a legitimate user from an AI-generated impersonation.

Common Variations and Edge Cases

Tighter identity controls often increase friction for customers and call-center staff, requiring banks to balance fraud reduction against service continuity and abandonment risk. Best practice is evolving, especially where consumer banking, private banking, and internal workforce access have very different threat models. For example, a retail customer recovery flow may rely on multiple lightweight signals, while treasury or trading access should demand much stronger proofing and device binding.

Edge cases deserve explicit handling. Shared branch kiosks, outsourced contact centers, contractor access, and bring-your-own-device environments can all weaken phishing resistance if policy is applied unevenly. Banks also need to avoid treating push approval as sufficient assurance, because AI-crafted lures can create urgency and fatigue at scale. The 2024 Non-Human Identity Security Report is a reminder that many organisations still struggle with consistent access management and ephemeral credentials, which matters here because short-lived tokens reduce the blast radius of a successful phish. Where there is no universal standard for recovery assurance yet, the safest approach is to align reset, enrollment, and privileged access on the same phishing-resistant baseline, then layer additional risk signals for high-value transactions.

Related resources from NHI Mgmt Group

• Why do AI-driven attacks change the value of PAM and IAM controls?
• Why is NHI governance critical in the age of AI attacks?
• What is the difference between human IAM controls and NHI governance?
• Why do legacy IAM controls struggle with AI-driven environments?