The ATO prevention shift: from identity to intent

For banks and credit unions, account takeover (ATO) prevention has historically focused on answering a single question: “Is this the customer?” Today, that question is necessary, but insufficient. Modern fraud, fueled by sophisticated social engineering and AI-enabled attacks, has changed the game. Financial institutions (FIs) must now answer a more important question:

“Should this customer be doing this—and do they truly intend to?”

FIs are winning the battle for identity but losing the war on intent. While your systems might successfully confirm who is logging in, they are blind to why. Traditional multi-factor authentication (MFA) is now a friction-heavy tool that attackers have already learned to bypass.

As AI-powered social engineering scales, the next generation of ATO prevention must shift from simple ID verification to contextual intent validation.

ATO fraud losses in the US continue to skyrocket (over $15.6B and climbing) despite hundreds of defense tools on the market. Unfortunately, fraud dollars lost are only a fraction of the cost implications for FIs. The true cost is systemic:

• Eroded trust leads to lost deposits and reduced share of wallet
• Operational bloat creates high call-center volume and fractured diagnostic processes
• Regulatory friction results in heavy compliance penalties and fines

Ultimately, these compounding costs stem from a singular reality: fraud is evolving at a speed that traditional, disparate tools simply cannot match.

Early forms of ATO were thwarted by multi-factor authentication based on SMS one-time passcodes (OTP) to determine a possession factor. Today, 80% to nearly 90% of FIs continue to use SMS OTP as a primary method of fraud prevention. Additionally, risk-based authentication (RBA) by itself can only alert an FI if there were risk conditions met, essentially providing some detection, but no prevention. Neither of these solutions can identify the type of attack, so irrespective of attack type, the response is static and initiated at a 100% challenge rate, leading to high false positives and excessive user friction resulting in a poor customer experience.

Even when used together to detect risk and then initiate a step-up authentication challenge, there is no insight into the type of attack, and the challenge is based on pre-defined, rigid rules. The challenge may be SMS OTP, a push notification, or even a FIDO passkey leveraging biometrics, but that challenge is the always the same—a static step-up regardless of the type of attack. There is no contextual awareness of the individual, the transaction, or the fraud type to initiate the best preventative measure for each instance.

Fortunately, some modern fraud defenses have finally evolved. While legacy systems are busy checking passwords and SMS OTPs, attackers are using generative AI and sophisticated social engineering to manipulate the human behind the device.

FIs can now move beyond identity verification toward intent validation. This shift is powered by contextual awareness, a deeper, real-time understanding of:

• Behavioral patterns
• Device intelligence
• Transaction context
• Historical activity
• Emerging fraud signals (including consortium data)

Now, rather than relying on a single, static challenge, modern platforms dynamically orchestrate the right response for each situation and move from predetermined, step-up authentication to curated authentication.

Today, multiple authentication methods (OTP, push auth, passkeys, device binding, proximity auth, IDV, and more) can be applied when needed, pre- or post-login, to challenge any high-risk transaction, often completely frictionless. Authentication is adaptive, not fixed, and responses are tailored to risk severity, attack type, user behavior or personal preference based on a much wider set of signals that are analyzed in real time. So, even if a customer approves a step-up challenge, the approval is now just another signal and can still be challenged further if the risk is deemed high.

The result is the most advanced protection from the most complex social engineering attacks that ultimately protects the customer from themselves by validating their intent. FIs can separate signals from noise and evolve from static step-up and rigid rules to dynamic defense.

By embracing this shift, FIs can:

• Detect and disrupt sophisticated social engineering attacks
• Reduce false positives and unnecessary friction
• Improve customer trust and experience
• Lower operational costs tied to fraud resolution
• Move from reactive detection to proactive prevention

ATO prevention is no longer about proving who the user is. It’s about understanding what they’re doing, why they’re doing it, and whether it aligns with legitimate intent.

Financial institutions that continue to rely on static authentication and rigid rules will fall further behind. Those that adopt contextual, intent-driven defenses, however, will not only reduce fraud, but strengthen customer trust in an increasingly complex threat landscape.