What is the difference between knowledge, possession, and inherence factors in Strong Customer Authentication?

How the Three SCA Factors Differ in Practice

Knowledge, possession and inherence are not just three labels for the same login step. They test different evidence of authentication: something remembered, something held, and something inherent to the person. The practical difference is that each factor type fails differently, so combining them reduces the chance that one stolen secret, one lost device, or one copied biometric will defeat the control.

In a customer journey, the distinction matters because the strongest assurance comes from independence. A password plus SMS code can still collapse if the phone number is hijacked or the code is intercepted. A possession factor only helps if the customer can truly present the device or token at the moment of authentication, while an inherence factor only helps if the biometric check is robust and paired with a secure fallback.

For customer authentication detail, the PSD2/PSD3 Strong Customer Authentication Guide explains how the regulatory model turns those factor types into a practical requirement, and the NIST SP 800-63 Digital Identity Guidelines give the underlying assurance vocabulary used to judge how strong a factor actually is.

Why Independence Between Factor Types Matters

Two factors only buy meaningful resilience if they are genuinely independent. If the same compromise path can defeat both, then the authentication is weaker than it looks. That is why the difference between factor types matters operationally, not just conceptually: a stolen password plus a reused recovery channel is not the same as a password plus a device-bound authenticator.

Knowledge factors are usually easiest to phish, guess, reuse or coerce. Possession factors can be lost, cloned, forwarded or intercepted if the implementation is weak. Inherence factors are tied to the user, but the matching process can still be fooled if the biometric is used as a convenience shortcut rather than part of a well-designed authentication flow.

For that reason, SCA is not satisfied by “two steps” alone. The control is strongest when the second factor is from a different category, is resistant to replay or remote theft, and does not depend on the same recovery path as the first factor.

Where Customer Authentication Breaks Down

In practice, failures often happen at the seams between the factors rather than in the factor itself. Account recovery, fallback authentication, enrolment and help desk resets can silently weaken the overall assurance level if they let an attacker bypass the stronger factor and rebind the account to a new device or channel.

Biometrics also need careful handling. They are best understood as an inherence check, not as a guarantee of identity in isolation. If the biometric is accepted without a strong liveness check or a secure fallback, the process can become convenient but brittle. Possession factors have a similar problem when organisations treat possession of a phone number or SIM as equivalent to possession of a secured device.

The right way to think about the difference is that each factor answers a different question. Knowledge asks whether the claimant remembers the secret, possession asks whether the claimant controls the object or token, and inherence asks whether the claimant can present the characteristic being measured.

Risk and Threat Considerations

Weak factor separation increases exposure to account takeover, fraud and recovery abuse, especially when the same compromise can satisfy more than one step. The main threat is not that a single factor fails, but that the surrounding process lets an attacker convert one stolen credential, one intercepted code or one reset path into full authentication.

Failure mechanism: Attackers commonly target the easiest path into the weakest factor, then use fallback, enrolment or recovery weaknesses to defeat the rest of the flow. If the possession factor is just a phone number, or the inherence factor is accepted without robust verification, the “second” factor may not add real resistance.

Impact: The result can be unauthorised account access, payment fraud, lockout of the real customer, or a false sense of protection that leaves the business exposed even though SCA appears to be in place.

Practitioner Guidance

What to verify: Confirm that the second factor is truly independent from the first, and that recovery, reset and enrolment paths do not quietly collapse the two-factor design into one compromised channel. If a device change, SIM swap or help desk reset can bypass the intended factor split, treat the control as incomplete.

Decision rule: If you cannot explain how the knowledge, possession and inherence factors fail differently, you probably do not yet have a resilient SCA design. Map the primary authentication path, then test the fallback path with the same scrutiny, because attackers usually take the weaker route.

Practitioner takeaway: The factor names matter less than the independence between them, because SCA only delivers real strength when compromise of one factor does not make the other easy to steal, replay or reset.

Related resources from NHI Mgmt Group

• Guide: Customer IAM (CIAM) Guide
• Strong Customer Authentication
• What breaks when strong customer authentication does not use independent factors?
• What is the difference between possession factors and inherence factors in passwordless authentication?
• Why does using the same device for both authentication factors increase risk in Strong Customer Authentication?