An account holder logs in to check their balance. The platform sends a six-digit code. They read it off the lock screen, type it in and get to their account.
So does the attacker sitting in the middle of that exchange.
That is not hypothetical. In April 2026, Microsoft observed a single adversary-in-the-middle (AiTM) campaign that compromised more than 35,000 users across 13,000 organizations in three days. The kits that do this sell as a service for under $200. They proxy the real login page, harvest whatever the consumer types and replay the session cookie against the legitimate provider. The code worked exactly as designed. That was the problem.
We have spent fifteen years treating the one-time passcode as a security control. It isn't. It's a question we ask when we don't know the answer.
Step-up isn't a control. It's a deferred decision.
Think about when step-up actually fires. A new device. A large transfer. A profile change. In every case the platform has arrived at a moment that requires a decision — allow or deny — and discovered it doesn't have enough evidence to make one. So it defers. It pushes the decision out to the account holder's phone and asks the customer or member to vouch for themselves.
That's not a control. That's an escalation path for uncertainty.
Which is why the step-up debate at most institutions aims at the wrong target. SMS or authenticator app, push or passcode, how many attempts, how long the cache should live — all real questions, all downstream of the one that matters. Why didn't we know?
The symptom is getting expensive on three fronts at once
- It no longer counts as strong. NIST's latest digital identity guidance classifies SMS and voice one-time passcodes as a restricted authenticator — the first time NIST has created that category — permitted only alongside a documented risk assessment, a migration plan and notice to users. CISA is more blunt: don't use SMS for two-factor, account recovery or binding codes.
- It isn't stopping the loss. Javelin's 2026 study puts account takeover at 6 million U.S. victims, up 18% year over year, with losses above $15 billion — the costliest identity fraud type, at roughly $2,500 and seventeen hours per victim to resolve. The FBI's IC3 logged $20.9 billion in reported losses across 2025.
- And it's costing you consumers who were never a threat. Entersekt found 43% of consumers would switch financial institutions over authentication methods alone. Capgemini puts digital onboarding abandonment at 47%. Passkeys, which don't have this problem, log people in successfully 93% of the time against 63% for the methods most of us still run.
Weak security, poor economics, worse experience. A rare trifecta.
Transactions don't commit fraud. People do, on devices.
Most fraud stacks are organized around the transaction as the unit of analysis: score the transfer, score the ACH batch, score the payee change. But a transaction has no history. It is born at the instant of submission with no past, no relationships and no reputation. It is the most amnesiac object in your entire system — and we made it the thing we decide about.
The actor is different. A person has a verification record. A device has a binding, a first-seen date and a geographic pattern. A business has formation documents, beneficial owners and authorized signers who are themselves identities. These accumulate. Transactions don't.
Two identical transfers, $4,800 each to an external account. One comes from a verified person on a device bound for three years. The other comes from an identity nobody ever resolved, on a device first seen ninety seconds ago. Byte for byte, the payments are the same. Only the actor differs — and the actor is the entire risk.
The industry has gotten partway here. There's a well-made argument going around that account takeover is a sequence rather than an event and that you need session-level context rather than isolated actions. That's correct and a genuine advance. It also doesn't go far enough — because a single session doesn't tell you enough either. Session context begins at zero every time your account holder opens the app. It's a better memory than no memory. It is still a memory that resets every morning.
Assurance should be a ratchet, not a reset. Every interaction — a login, a device enrollment, a completed transfer, an address change that proved legitimate — should leave you knowing more about that identity than before. What you keep is a record of verification outcomes and device bindings, not a surveillance file: whether this person was verified, when, to what standard and which devices they have proven they control. A narrow ledger — and the difference between a platform that recognizes its consumer and one that interrogates them.
Trust has to start before the first login
The largest single thing most platforms forget is everything they’ve already proved.
At most financial institutions, account opening and digital banking are different systems, often from different vendors, holding different identity records. The applicant is verified to a genuinely high standard — identity document, selfie, PII validation, sanctions screening; for a business, formation documents and beneficial ownership. Then that evidence is filed for compliance and effectively discarded at the handoff. Day one of digital banking begins at zero assurance.
That seam is why the first login, the first device and the first payment all get challenged — to re-establish facts the institution established weeks earlier.
Candescent delivers both account opening and digital banking and that changes what's possible. KYC and KYB performed at onboarding can become durable evidence attached to the identity rather than a compliance artifact. The device that completed the application is a known device. The person verified against a government ID is a verified person and the face captured then is a baseline for later. The business whose documents and beneficial owners were validated is a verified business, carrying its authorized signers as related identities — so the same human isn't treated as a stranger moving between personal and business relationships at one institution.
But having both is an accelerant, not a prerequisite. Plenty of institutions run account opening elsewhere or digital banking elsewhere and they reach the same place on a different curve. The identity, device and verification capabilities are exposed consistently across every experience rather than buried inside one product; and for identities that arrive without a verified history, assurance builds progressively out of interactions. The ratchet still turns. It just starts a notch lower.
When you do have a gap, challenge the thing you actually doubt
You will still have gaps. When you do, stop sending the same challenge for every kind of doubt — because there are two kinds and they need opposite answers.
“I just got a new phone.” Unknown device, ten minutes old. But the navigation pattern, the geography, the typing cadence and the still-bound previous device all say this is the right person. You don't doubt the person. You doubt the hardware. So challenge the hardware: send an approval request to the device that is still bound, inside the trusted app, showing exactly what's being approved. A passcode sent to a phone number proves only that someone can read a text message. For most people, their first encounter with their bank's security posture is being treated as a suspect for buying a new phone. We can do better.
The trusted phone, the brand-new payee. Known device, bound two years. But this session includes a password change, an external payee added four minutes ago and the largest transfer this account has ever attempted. The device is fine. The behavior doesn't match the person.
Here is the whole argument in one sentence: a passcode to a trusted device answers is this the right phone — a question you already answered. It cannot answer is this the right person.
So challenge the identity. A selfie reverification against the face captured at account opening resolves it in seconds, with far less friction than a document-upload flow. One caveat matters: it only holds if you score the capture path, not just the image. Entrust reported injection attacks up 40% and iProov recorded native virtual camera attacks up 2,665%. Presentation-attack certification says nothing about a synthetic video stream injected below the camera. Stream integrity, device binding and session checks have to be part of the check.
A clean decision beats a graceful hedge
There's a better class of response emerging — graduated containment, where instead of freezing an account you narrow what a suspicious session can do. It's a real improvement over the blunt lockout and it spares consumers who would otherwise lose access to their own money on a hunch.
It is also still a decision you couldn't make. You degraded a real customer’s or member's experience as a hedge against your own uncertainty. That's the same tax as the passcode, collected more politely.
Gray areas are a data problem, not an authentication problem. Every gray area you close with evidence is a challenge you never send.
What we're building
That's the platform we're building toward with Votiv Protect: identity, authentication and risk decisioning designed as one system rather than three that pass alerts to each other. Devices, people and businesses as first-class identities that carry relationships. Verification evidence that persists and compounds instead of expiring at a session boundary. Challenges chosen to resolve a specific doubt rather than to cover every doubt at once.
The goal isn't a better prompt. It's a platform that remembers who your customer or member is — so it can say yes with confidence and no without hesitation.
If you have any questions related to Candescent’s identity and fraud solutions
please reach out to your DSM or get in touch with us.
