Candescent recently announced the arrival of Intelligent Banking, and as an Enterprise Architect, I've spent a lot of time thinking about what that means for one foundational capability: identity. In truly intelligent banking experiences, authentication should be almost invisible — frictionless when confidence is high, protective when risk is high.
That's a simple idea to state and a hard one to build. It requires rethinking authentication not as a gate account holders pass through once, but as an ongoing judgment the platform makes on their behalf.
Better keys, same problem
A customer once told me: "We keep inventing better keys for our cars, yet people often willingly hand over the keys to their bank accounts." That analogy has stuck with me for a long time — and the numbers back it up.
Stolen credentials remain the leading way into a breach. Verizon's 2025 Data Breach Investigations Report found credential abuse was the initial access vector in 22% of breaches and stolen credentials appeared in 88% of basic web application attacks. More than 2.8 billion passwords were posted for sale (or even for free) on criminal forums in 2024 alone.
Meanwhile, people are being talked out of their keys at record rates. U.S. consumers reported $15.9 billion in fraud losses to the FTC in 2025, up from just over $12 billion the year before. Imposter scams were again the most-reported fraud type, with more than 1 million reports.
And the tools available to fraudsters are getting cheaper and more convincing. Deloitte's Center for Financial Services projects that generative AI could push U.S. fraud losses to $40 billion by 2027, up from $12.3 billion in 2023.
The lesson here isn't that customers and members are careless. It's that anything a person knows or holds can be phished, stolen or socially engineered. That raises an interesting question: What if identity relied less on what users know or possess and more on signals that are difficult to share, forget, lose or imitate?
From a single login to continuous confidence
For a moment, think about the car of the future. One that recognizes you before you even reach the door through your movement, your behavior, your habits and how you interact, all while still validating that you have the proper key. The experience becomes seamless because confidence in your identity is high.
Banking should move in the same direction. Today, most digital banking treats authentication as a single event: prove who you are at the front door, then move freely until the session times out. But fraud rarely happens at the front door. Account takeover, session hijacking and scams often play out after a successful login — when a payee is added, a contact detail changes or money starts to move.
Authentication shouldn't be a single event at login. It should become continuous, contextual and intelligent. Here’s what that looks like, more specifically:
- Continuous: confidence is reassessed throughout the session, not just at sign-in
- Contextual: the same action carries different risk depending on device, location, history and what the user is trying to do. Checking a balance is not the same as sending a first-time wire.
- Intelligent: signals are combined into a single risk judgment and the response is matched to it
In practice, that means a sliding scale. If we are highly confident in who the user is, then experiences should become faster and nearly frictionless. If signals are ambiguous, then a light step-up — such as a passkey prompt or a biometric check — restores confidence. If signals indicate elevated risk or possible fraud, then systems should respond with stronger challenges, hold the transaction for review or deny access entirely.
The goal is not to remove security. It is to spend friction where it buys protection and nowhere else.
The building blocks of intelligent authentication
No single technology delivers this on its own. Intelligent authentication comes from layering signals that are each hard to fake and then letting a risk engine weigh them together. Let’s think about this through our car of the future example once more.
Passkeys: a better key for your car. Passkeys replace passwords with cryptographic credentials bound to the user's device and unlocked with a fingerprint, face or PIN. There is no shared secret to phish or reuse. Adoption is no longer theoretical: the FIDO Alliance's Passkey Index reports more than 3 billion passkeys securing consumer accounts, a 93% sign-in success rate, 73% faster logins and up to 81% fewer login-related help desk incidents. Security and convenience improve together.
Device intelligence: is this the car you usually drive? Device reputation, binding and integrity checks tell us whether a session originates from a known, healthy device — or from an emulator, a remote-access tool or a device associated with prior fraud.
Behavioral signals: how you walk to the car. Typing cadence, swipe patterns, navigation habits and session behavior form a profile that is difficult to imitate at scale, even with valid credentials. Behavioral signals — such as hesitation, unusual navigation or an active phone call during a payment — can also reveal when a genuine customer is being coached by a scammer.
AI-driven risk decisioning: the brain behind the car key. Signals only matter if they are combined in real time. Machine learning models weigh identity, device, behavior and transaction context to produce a risk score that drives the response: allow, step-up or block.
Identity orchestration: one key for every door. An identity platform ties it together, so authentication policy is defined once and applied consistently across web, mobile and assisted channels — instead of being re-implemented in every application.
In combination, these layers turn authentication from a one-time checkpoint into continuous, intelligent confidence.
How we’re building it at Candescent
This is the direction our Identity teams are building toward across authentication and fraud. From an architecture perspective, three principles guide our work:
- Identity is a platform capability, not an app feature. Authentication, step-up and risk policy live in a shared identity layer rather than inside individual applications. That lets institutions apply consistent policy across consumer, business and assisted banking — and adopt new methods like passkeys once, everywhere.
- Authentication and fraud share one view of risk. Historically, login security and fraud detection were separate systems with separate teams. Our Identity & Business Security solution brings identity authentication, KYC/KYB, fraud checks and transaction risk analysis into a unified risk engine, with adaptive authentication that steps up only when risk signals require it and behavioral intelligence that detects abnormal activity early.
- Best-of-breed signals, plugged in natively. No single vendor sees everything. Our platform connects pre-integrated partners for session-level, device and behavioral intelligence so their signals feed the same decision rather than living in separate consoles.
Security that stays out of the way builds the confidence people need to use digital banking more.
Security that knows when to step in
The future isn't just stronger authentication. It’s intelligent authentication — security that stays out of the way when it should and steps in when it matters most.
For banks and credit unions, that is more than a security upgrade. It is a customer experience strategy. Every unnecessary challenge is a moment of friction; every missed signal is a moment of lost trust. Getting that balance right is what turns digital banking into Intelligent Banking.
I'm excited to see how AI, behavioral signals, passkeys and identity platforms continue to mature — and to help build the identity foundation that makes our Intelligent Banking platform both safer and simpler for the people who use it.
If you have any questions related to Candescent’s identity and fraud solutions
Please reach out to your DSM or get in touch with us here.
