What is the difference between knowledge, possession, and inherence factors in Strong Customer Authentication?

How the three factor types differ in practice

Knowledge, possession, and inherence describe three different ways to prove that the same person is presenting the authentication challenge. Knowledge relies on recall, possession relies on control of a device or token, and inherence relies on a physical or behavioural trait. The distinction matters because each factor fails differently, and the control only becomes stronger when the factor types are genuinely independent.

In strong customer authentication, the practical question is not just “is there a second step?”, but “does each step resist the same compromise path?” A password plus SMS code can still collapse if the attacker steals both through phishing or SIM swap, whereas a password plus a device-bound cryptographic factor is harder to defeat with the same attack.

Why independence matters more than the label on the factor

Many implementations look like multi-factor authentication but still depend on one shared secret, one recovery channel, or one device trust relationship. That is a weak design if the attacker can reuse the same foothold to satisfy more than one step. For that reason, SCA should be evaluated by failure mode, not by marketing language or the number of prompts shown to the user.

Knowledge factors are typically easiest to copy, guess, or phish. Possession factors are stronger when they are bound to a specific device or cryptographic key rather than a reusable code. Inherence factors can improve friction and user experience, but they are usually best treated as a complement to another factor rather than as a standalone answer, because they can be noisy, spoofed, or difficult to revoke once compromised.

For customer authentication programs, NHIMG’s Customer IAM (CIAM) Guide is useful background for understanding how authentication choices fit into account recovery, step-up decisions, and customer access risk.

What good SCA looks like across customer journeys

A sound design chooses factor combinations that remain effective across login, payment confirmation, account recovery, and high-risk step-up events. That usually means pairing a memorised secret with a possession factor, or better, a phishing-resistant possession factor with a separate recovery path that does not silently recreate the same weakness. If recovery is weak, the front-door factor mix will not save the program.

In regulated customer environments, the factor mix also needs to be usable enough that customers do not route around it. If a stronger factor is too painful, support teams and exception handling often become the real bypass. NHIMG’s Financial Services Identity Security Guide is relevant here because payment and banking controls often depend on how SCA is applied in real operations, not just in policy text.

Where phishing-resistant sign-in is available, a device-bound possession factor such as a passkey or security key materially improves resilience over codes that can be relayed or stolen. The control objective is not to maximise the number of factors, but to make it hard for one compromise path to satisfy every factor at once. NIST SP 800-63 Digital Identity Guidelines provide a strong external baseline for assurance levels and phishing-resistant authenticators, and the NIST SP 800-63 Digital Identity Guidelines are a useful reference point for that design choice.

Risk and Threat Considerations

The main risk is false confidence: an implementation can appear to satisfy SCA while still relying on factors that fail together under phishing, malware, social engineering, or recovery abuse. A weak possession factor, such as a one-time code that can be relayed, is especially vulnerable because it does not meaningfully separate the attacker from the victim’s session.

Failure mechanism: Attackers defeat the scheme by stealing a password, intercepting or relaying a code, coercing recovery, or compromising the device or session that is supposed to prove possession. If the inheritance check is weak or easily bypassed, it adds little real resistance.

Impact: The result can be account takeover, fraudulent payments, unauthorized profile changes, or abuse of trusted recovery flows. In practice, the highest-loss failures are usually not the first login step, but the point where the organisation lets an attacker reset the account or replace the factor set.

Practitioner Guidance

What to verify: Check whether the chosen factors are truly independent and whether the same recovery channel can re-issue both of them. If one factor can be reset through the same email inbox, help desk flow, or SIM-linked number as another, the authentication design is weaker than it looks.

Common mistake: Treating any two prompts as SCA. A password plus OTP is not automatically strong if both are replayable, phishable, or recoverable through the same weak process. Prefer factor combinations that reduce the attacker’s ability to reuse a single compromise path across both steps.

Practitioner takeaway: The right comparison is not “knowledge versus possession versus inherence” in theory, but “which pair still holds when one factor is phished, stolen, or reset in practice?”

Related resources from NHI Mgmt Group

• What is the difference between possession factors and inherence factors in passwordless authentication?
• What is the difference between strong customer authentication and ordinary MFA?
• What is the difference between customer due diligence and strong customer authentication here?
• What is the difference between Strong Customer Authentication and PCI DSS for payment security?