The biggest risk with knowledge-based authentication (KBA) is that personal history is not a durable secret. Public records, data brokers, social profiles, prior compromises, and information shared across households can expose or narrow the expected answers. Dynamic questions can avoid some weaknesses of fixed security questions, but they still depend…
A successful login can be the last normal event a security stack sees before the damage begins. A password may be correct, and multi-factor authentication (MFA) may succeed from a recognized phone number. From that point forward, however, access depends on sessions, access tokens, refresh tokens, and connected applications. If…
Email risk services can determine whether an email address is valid and estimate how long it has been observed. By themselves, however, they cannot determine whether the person entering the email controls the phone number associated with the account, whether the same address appeared on multiple applications during the past…
Identity security programs tend to protect login more carefully than the paths around it. That leaves identity threat vectors exposed during proofing, account recovery, authenticator enrollment, active sessions, delegated application access, and high-risk transactions. An attacker does not need to defeat the strongest control if another workflow can establish the…
An employee receives a text message warning about unusual activity on a company account. They reply that they don’t recognize it. Minutes later, someone claiming to work in IT calls, references the alert, and guides the employee through an account security process. Was the attack smishing or vishing? It was…
A customer logs into their account from a familiar device using the correct password and successfully completes multi-factor authentication (MFA). Minutes later, they change the account recovery phone number, add a new payout destination, and transfer funds. Did the customer authenticate successfully? Yes. Did the organization make the right access…
SIM swaps can redirect one-time passwords (OTP) to another device, while number porting can move a phone number to another carrier. In both cases, the identity assumptions behind using a phone as an authentication factor are undermined. The National Institute of Standards and Technology (NIST) classifies authentication over the Public…
The contractor you just onboarded to work inside your environment could be a fraudster operating under a stolen identity, even though the vendor they claim to represent is a legitimate, registered company. Registration simply proves that a business entity filed paperwork with a state. It says nothing about who controls…
When a rewards balance disappears, the loss becomes visible at redemption. Miles may be transferred to a partner program, points converted into gift cards, or award travel booked without the account owner’s knowledge. By the time that happens, however, the loyalty program fraud has already succeeded. The real questions arise…
Most vishing defenses assume the attacker is after a password. The campaigns causing the most damage in 2026 rarely ask for one. Instead, they persuade a help desk representative to enroll a new phone number or convince a user to approve a connected application. The login that follows appears legitimate…
