What breaks when strong customer authentication does not use independent factors?

Why This Matters for Security Teams

strong customer authentication only works when each factor stands on a different failure domain. If the password, reset channel, push prompt, or recovery device all collapse into one compromised path, the control becomes a single point of failure disguised as multi-factor security. That is why control design matters as much as factor count, especially in environments governed by NIST SP 800-53 Rev 5 Security and Privacy Controls and broader identity assurance practices. NHI Management Group has also documented how weak identity recovery and credential sprawl amplify exposure in the Ultimate Guide to NHIs.

The practical risk is false assurance. Teams may believe they have SCA because two prompts appear in the flow, while both are ultimately mediated by the same phone, browser session, email inbox, or support workflow. In those cases, an attacker who compromises one channel often gains the second factor by extension. The result is a successful account takeover that looks compliant on paper but fails under real attack pressure. In practice, many security teams encounter this only after a fraud event or support abuse campaign has already bypassed the intended barrier.

How It Works in Practice

Independence means the compromise of one factor should not realistically expose the others. For customer authentication, that usually requires combining something the user knows with something the user has or is, while ensuring the backup and recovery paths are not just alternate routes to the same secret. Current guidance suggests evaluating the full transaction path, not only the login prompt: enrollment, device binding, reset, step-up, and recovery all need separate trust boundaries.

In practice, organisations should map each factor to its own control plane and failure mode:

• Password or PIN stored and verified separately from the device-bound factor.
• Possession factor anchored to a cryptographic device, not an SMS number alone.
• Recovery protected by a distinct channel with stronger verification than the default login flow.
• Step-up checks applied to high-risk actions such as transfers, payee changes, or profile recovery.

This is where real-world incident patterns matter. The Schneider Electric credentials breach and the Twitter Source Code Breach both reinforce a basic lesson: once identity recovery, secrets handling, or privileged access share the same weak path, an attacker does not need to defeat each factor independently. They only need to find the shared dependency. Controls aligned to ISO/IEC 27001:2022 Information Security Management should treat factor independence as a design requirement, not a cosmetic checklist item.

These controls tend to break down when SMS, email, mobile push, and account recovery all terminate on the same compromised endpoint because the second factor inherits the first factor’s failure domain.

Common Variations and Edge Cases

Tighter authentication often increases user friction and support overhead, requiring organisations to balance fraud resistance against account recovery cost and customer abandonment. That tradeoff becomes more visible in consumer banking, travel, and high-volume SaaS, where step-up prompts and recovery checks can create measurable friction if they are overused or poorly sequenced.

There is no universal standard for this yet, but current guidance is consistent on one point: independent factors must be independently compromise-resistant. A device-bound authenticator is stronger than a shared-channel code, but it still fails if the same compromised handset also receives reset links, push approvals, and support callbacks. Similarly, a second factor is not meaningfully independent if the help desk can override it using the same identifiers an attacker has already stolen.

Teams should pay special attention to edge cases like lost-device recovery, delegated administration, family sharing, and risk-based authentication fallbacks. Those are the moments when control design often regresses into a single recovery path. For organisations with higher assurance needs, the safest pattern is to reduce shared dependencies, harden recovery separately, and verify that one breach does not cascade into all available factors.

Best practice is evolving toward stronger device binding, phishing-resistant authenticators, and explicit review of recovery channels. Where those properties are missing, the factor stack may still look compliant while remaining operationally dependent on one vulnerable channel.

Related resources from NHI Mgmt Group

• What breaks when PDF signing workflows do not use strong authentication and audit trails?
• What breaks when remote MCP authentication is hard to troubleshoot across different clients and servers
• What breaks in practice when organisations keep using public TLS certs for server-to-server and machine authentication?
• What is the difference between public TLS and private PKI for non-browser authentication use cases?