A login comes from a familiar phone, using the correct credentials and a valid one-time code. Minutes later, a new beneficiary is added and a high-value transfer is sent to an account the customer has never used before.
The login passed the bank’s checks, but valid credentials did not prove that the customer was in control. A criminal had obtained the credentials and may have persuaded the customer to share the authentication code. The gap was the bank’s ability to recognize the compromise and intervene before money left the account.
This is the challenge facing bank fraud prevention teams. Stronger login checks alone cannot prevent every account takeover. Banks need layered authentication that combines identity verification, device and behavioral intelligence, transaction context, and adaptive controls across the customer journey.
The objective is to understand risk more accurately and connect detection to timely action. That means applying additional checks where they can prevent harm, while keeping low-risk activity straightforward.
Account takeover (ATO) fraud begins when a criminal gains unauthorized control of a legitimate account. The initial compromise may involve phishing, credential stuffing, malware, SIM swapping, or social engineering. But the damage often occurs later, when the criminal changes account details, registers a new device, adds a beneficiary, or initiates a payment.
That sequence makes ATO difficult to prevent with login-only controls. A session can pass authentication at 9:00 a.m. and become high risk at 9:05 when contact details change, a new device is registered, and an unusual transfer is attempted.
The FBI warned in November 2025 that its Internet Crime Complaint Center had received more than 5,100 account takeover complaints since January of that year, involving losses exceeding $262 million. The alert also described criminals impersonating financial institution employees to persuade customers to disclose credentials and multifactor authentication codes.
That detail matters. Multifactor authentication (MFA) remains an important control, but a successful authentication check does not always establish that an interaction is legitimate. A criminal who has manipulated a customer into sharing a one-time code may still be able to pass the bank’s authentication process.
Banks therefore need to ask more than whether a credential is valid or a device is present. They also need to assess whether the interaction makes sense for this customer, on this device, in this session, and for this action.
Effective layered authentication brings together three related but distinct questions.
Is this person the legitimate customer?
Identity verification and proofing establish confidence during onboarding, account recovery, and device enrollment.
Does this interaction make sense for this customer?
Device identity, location, network, behavioral patterns, and account activity help assess whether the interaction fits the customer’s usual environment.
Is the customer knowingly authorizing this action?
The recipient, amount, and events leading to a payment provide context for assessing intent beyond the login check.
These questions overlap, but they are not interchangeable. A genuine customer may be using a trusted device while being manipulated by a scammer. That is distinct from account takeover, but it also shows why identity checks alone are insufficient. A biometric match can help verify identity; it cannot, by itself, establish that the customer understands a payment’s purpose or recipient. Likewise, a correct password does not establish who is using it.
This is why modern customer authentication should inform a dynamic trust decision rather than end with a binary “authenticated” or “not authenticated” result. The bank should be able to allow low-risk activity with minimal interruption, request stronger verification when risk rises, and block or hold an action when the combined evidence indicates probable fraud.
The FFIEC guidance on authentication and access supports this layered approach. It explains that risk assessments should inform authentication controls. When single-factor authentication with layered security is inadequate, MFA or controls of equivalent strength, combined with other layered security controls, can more effectively mitigate authentication risks.
Identity verification is often associated with account opening, but it also has a role throughout the relationship between a bank and its customer.
Additional authentication or identity verification may be needed when a customer:
The appropriate control depends on the risk. A bank might use device-based authentication and behavioral signals for a familiar customer making a routine payment. The same bank could request biometric verification or secure out-of-band approval when a new device, an unfamiliar location, and a first-time recipient appear together.
This is where identity proofing and authentication should work together. Proofing establishes confidence in a claimed identity and its connection to the applicant. Authentication verifies control of the authenticators associated with an account. Neither provides permanent assurance that every subsequent action is legitimate.
A document check completed months earlier cannot tell a bank whether a current transfer is being made under coercion. Conversely, a strong transaction control may be undermined if the account recovery process allows a criminal to replace the customer’s contact details without sufficient verification.
Layered bank fraud prevention therefore requires banks to establish identity, maintain confidence in account access, and reassess that confidence when account control may have changed.
A single signal may not reveal an account takeover. The warning signs can emerge through a sequence of events.
A login from a new device may be legitimate, as may a password reset or the addition of a new beneficiary. But when all three occur within a short period, followed by an urgent transfer to an unfamiliar recipient, the combined pattern warrants closer scrutiny.
Banks need risk intelligence that spans channels and stages. A control that sees only the payment may miss what happened during login. A system that monitors only the mobile app may not see a suspicious contact center interaction or a recent change to account recovery information.
Relevant signals can include the device’s identity and security posture, location and network consistency, and the customer’s usual login and transaction patterns. Account age, time since a beneficiary was added, the payment rail, the transfer’s value and destination, and the interval between account changes and money movement can add further context.
The purpose is to connect the signals that change the meaning of an event, rather than collect every possible data point.
Entersekt’s Context Aware™ Authentication reflects this principle by combining fraud data sources with authentication controls and adapting the customer journey to the risk of the interaction. Low-risk activity can remain frictionless, while elevated-risk activity can trigger a more appropriate intervention.
That distinction matters for customer experience. Repeated, identical challenges can become routine inconveniences. Reserving stronger controls for moments that warrant them makes authentication more purposeful and less disruptive.
Bank fraud prevention needs to extend beyond authenticating access to assessing the risk and authorization of each consequential action.
Consider two transfers made from the same customer account. The first is a monthly payment to an established recipient from the customer’s usual device. The second is a large transfer to a newly added beneficiary shortly after the customer’s phone number was changed.
A static authentication policy may apply the same challenge to both transactions. A context-aware policy should account for their differences. The second transaction deserves stronger scrutiny because its surrounding circumstances indicate a higher risk of account takeover or social engineering.
A secure push notification can help when it displays meaningful transaction details and gives the customer a clear way to approve or reject the action. Device-based authentication, biometrics, and passkeys can provide additional assurance without requiring customers to remember another secret. In higher-risk cases, the bank may need to pause the transaction, require additional identity verification, or route the event for review.
The control should match the risk. That may mean silent authentication for a trusted device, a biometric step-up for a suspicious login, or explicit transaction approval for a high-risk payment. The decision should be explainable to fraud teams and, where appropriate, understandable to the customer.
The FBI’s 2025 alert illustrates the limits of relying on codes that customers can be manipulated into sharing. Stronger designs display the payment details and ask customers to approve a specific transaction rather than relay a secret. That approval still needs to be considered alongside risk signals: a customer can be deceived into approving a fraudulent payment.
Adding more security products does not automatically create stronger protection. Disconnected tools can produce conflicting decisions, duplicate customer challenges, and gaps between channels.
The practical test for a layered architecture is whether each layer contributes a distinct type of assurance and whether the bank can coordinate the response in real time.
Identity verification helps establish who the customer is. Device intelligence helps assess whether a request comes from a recognized device; device-bound authentication can provide evidence of control of an enrolled authenticator. Behavioral and transaction signals help identify whether the interaction is consistent with the customer’s normal activity. Authentication orchestration determines which control is appropriate, while monitoring and audit trails support investigation and future improvements.
The layers should reinforce one another rather than operate as isolated checkpoints. Detecting a high-risk event is valuable, but prevention depends on acting on that detection before harm occurs. A fraud platform needs a timely path to intervention, and an authentication system needs meaningful risk context to select the right response.
For banks, this makes integration and decision quality as important as individual authentication methods. Entersekt’s digital banking fraud prevention solution is designed around this connection between authentication, risk, and transaction context, with protection extending beyond initial login to high-risk digital banking activity.
Banks should measure more than blocked fraud. Frictionless authentication rates, false declines, customer drop-off, call center contacts, and investigation time reveal how controls affect customers and operations. Reviewing account recovery and device enrollment controls, alongside fraud losses after authentication, helps identify remaining gaps.
A successful layered strategy makes accurate, timely decisions while minimizing unnecessary customer challenges.
Connect these capabilities into a continuous trust strategy: establish trust at onboarding, reassess it when account conditions change, and evaluate risk before consequential actions.
The goal is to protect customers before funds leave the account while avoiding repeated challenges during familiar, low-risk activity. Coordinated decisions turn layered authentication into a practical way to connect fraud detection with prevention and preserve customer trust.