The use of Buy Now, Pay Later (BNPL) platforms has skyrocketed in the past two years.

 have become household names in their own right, as consumers embrace the idea of being able to purchase expensive items without needing to pay upfront. 

In addition to the obvious benefits of being able to afford items that are normally beyond a person's purchasing power, BNPL platforms have gained significant popularity due to their relatively frictionless approach to providing short-term consumer credit lines. 

BNPL websites rely on scant few details from applicants and, in many countries, don’t require a hard credit check. And despite economical constraints from the ongoing cost of living crisis in the UK and Europe, the BNPL market shows little to no signs of slowing down – with some of the world's most recognized fintechs 

, recently introducing their own BNPL payment schemes.

Unfortunately, as with virtually everything online, the popularity of BNPL has also attracted the attention of nefarious groups. Fraudsters and hackers are exploiting the lack of oversight on these payment platforms. 

BNPL is expected to be a major contributor to global fraud losses, which are forecast to surpass 

. Over the course of this article, we will highlight how BNPL platforms can enhance security and prevent fraud from occurring on their platforms. 

When discussing BNPL fraud, it’s important to understand the 

Generally, onboarding processes for opening BNPL accounts tend to be less rigorous in terms of identity verification when compared to traditional financial institutions which are regulated. 

As such, it's easier for fraudsters to commit identity theft and fraudulently open a BNPL account using stolen personal information. It’s also lucrative for fraudsters to launch account takeover campaigns, aimed at compromising the login credentials and OTPs to hack into existing BNPL accounts. 

According to a recent report from Sift, the leaders in Digital Trust & Safety, account takeover (ATO) 

attacks on BNPL platforms have gone up 54% in the last year

 – with most stemming from compromised passwords and one time passwords (OTPs).

There are several tell-tale signs of BNPL fraud that BNPL platforms should look out for:

Due to most passwords and billing information being saved on a device or web browser that they’ve previously signed into, the majority of end users tend to stick to the same device when making purchases online. If an existing account has login attempts from a number of different devices, there is a greater chance that this account has been compromised. 

When compromising a BNPL account, fraudsters may attempt to order goods to a new address. If purchases are suddenly being sent to a new address, this is a strong sign that a customer’s account may have been hacked.

BNPL platforms should pay close attention to their customers' account order history, while also encouraging end users to review their order history if their personal data has been compromised. 

BNPL platforms should also look to re-authenticate a customer when an unfamiliar transaction occurs. Typically, a radical change in the type and price of the items purchased will indicate that an account has been breached.

There are four types of BNPL fraud that customers and BNPL companies should pay close attention to.

Account takeover (ATO) fraud is where a fraudster uses stolen credentials and personal information to hack into a genuine user's BNPL account. ATO attempts on a BNPL account may be secondary to email ATO and SIM Swapping attacks – which enable fraudsters to capture OTPs sent by the BNPL account during authentication. To make matters worse, many customers typically use similar, easily guessable, or 

Similar to an account takeover, identity theft will involve a criminal using stolen personal information (emails, passwords, identity documents, addresses) obtained from another data breach) to open an account with a BNPL platform like Klarna. Identity theft can go further, in some instances fraudsters use stolen passports, driver’s licenses, bank cards, and mobile phones to set up new BNPL accounts and make purchases using the stolen identification.

This type of fraud is not too dissimilar to identity theft, whereby a fraudster will set up a new account to make illegitimate purchases. However, synthetic fraud differs from identity theft because the information used to set up the account is typically fake.

Friendly fraud refers to BNPL purchases often made by friends, family members, and young children that have accessed a customer’s device and made a purchase without the owner of the account being made aware.

What is Keyless & how can it help prevent BNPL fraud?

While BNPL fraud is alarming, it is possible for BNPL platforms to enhance their fraud prevention strategies by eliminating credentials, which are easily compromised, from the authentication journey. 

One of the best ways to prevent BNPL fraud is 

, the world’s most advanced passwordless authentication solution. Keyless enables BNPL platforms to enhance security by replacing credentials with biometric authentication. 

Biometrics have been proven to be safer and more secure than passwords and OTPs, both of which can be easily compromised with the right technology. With Keyless, customers are authenticated using a combination of 

and background device verification checks that help to ensure that login attempts are coming from a known device.

In this way, Keyless offers frictionless strong authentication during authentication, or 

whenever a high-risk purchase or action is made

Keyless also integrates with major eIDV/KYC vendors, helping to close the assurance gap between identity verification and customer authentication. Thanks to these integrations, Keyless is able to offer high assurance that the real person is logging in or attempting to make a purchase – making it difficult for fraudsters to use stolen personal information to open or hack into an account. 

, now is perhaps the best time to consider enhancing your authentication strategy by switching to a passwordless solution. 

How to Protect Against Buy Now, Pay Later Fraud with Keyless

In recent years, account takeover attacks have become more prevalent than ever, with fraudsters closing in on the financial services sector with new ways to defeat multi-factor authentication challenges.

In this blog, we’ll look at three emerging methods fraudsters are using to bypass multi-factor authentication and execute account takeover fraud, as well as how businesses can effectively mitigate these emerging threats. 

Despite the roll out of strong customer authentication, in 2021, 8

4% of financial services firms experienced account takeover attacks

. According to studies from Juniper, that number is only set to rise, 

with losses forecast to surpass $206 billion by 2025

Rather than being deterred by the improvements to authentication security, attackers are simply inventing new ways to capture multi-factor authentication (MFA) credentials, such as OTPs, to execute attacks. 

We’ll now look at the techniques listed below that fraudsters are frequently using to bypass MFA security:

SIM swapping is a major concern for financial firms and cryptocurrency exchanges, with attacks becoming more frequent and pervasive, increasing by over 400% the last five years in the United Kingdom. 

To carry out a SIM swapping attack, fraudsters exploit compromised and leaked personal information to impersonate legitimate customers and transfer legitimate phone numbers onto new, fraudulent SIMs.

Once a new SIM is activated on a fraudster's device, they will receive OTPs meant for the customer. They will then often use these to bypass and disable MFA, make fraudulent payments, and launch further attacks on the victim’s accounts and contacts.

According to the European Union Agency for Cybersecurity, 

there are specific circumstances that open the opportunity for SIM swapping. These include

It goes without saying that these attacks can have serious financial repercussions for victims. Last year, 

Canadian police arrested a teenager for stealing a staggering $36 million from a single victim through a SIM-swapping attack

, and in Europe, criminals leveraged SIM swapping methods to 

steal over $100 million from US celebrities.

Another advanced method being used to capture OTPs are reverse proxy scams. Reverse proxy scams are a type of man-in-the-middle phishing attack that enable fraudsters to steal (MFA) credentials and session cookies from victims without the victim’s knowledge. 

To execute a reverse proxy scam, attackers intercept a victim’s credentials using a proxy web server that essentially acts as a layer between the victim and the website they’re attempting to login to. 

Microsoft announced this year that approximately 

10,000 organizations had been targeted with fake Microsoft Office login pages

. The campaign led the user to an attacker-controlled proxy site that sat between them and the server they were attempting to log into.

Reverse proxy scams like these use a number of advanced steps to capture genuine MFA credentials:

Unfortunately, these attacks can be especially insidious, as targets are often completely unaware that they’re being hacked, until it’s too late. Exacerbating the problem, b

ad actors can now purchase “phishing kits” online to execute such attacks 

– meaning you do not necessarily have to have the technical skills to launch attacks. 

The popularity of BNPL platforms, like Klarna and Clearpay, has recently exploded, 

with BNPL customers now exceeding 360 million globally

The adoption of BNPL payments has created an unprecedented opportunity for fraudsters, who are taking advantage of weaker security standards adopted by BNPL services and their retail partners.

Bad actors are attracted to BNPL accounts because there’s more opportunity to execute an account takeover attack. 

ATO attacks on BNPL accounts can be executed either by:

The latter method generally requires less effort as online retailers have weaker authentication standards compared to financial platforms and apps – meaning 2FA is often not required. 

Fraudsters can compromise a genuine customer's account either by purchasing compromised credentials online or by running automated credential stuffing or credential cracking attacks. 

According to recent research from Imperva, 

64.1% of account takeover (ATO) attacks make use of bad bots (software applications that run automated tasks such as credential stuffing)

, meaning they can execute these kinds of attacks en masse. 

Luckily, there’s a simple way for financial firms to protect their customers against these emerging threats, and that’s by eliminating passwords entirely – whether temporary or saved – from login and payment authentication flows altogether.

By eliminating all credentials, whether a password, PIN, or one-time code, businesses can effectively reduce account takeover threats caused by compromised credentials, phishing, and man-in-the-middle attacks to zero. 

By replacing passwords and OTPs with our advanced passwordless solutions, Keyless provides the ultimate protection against ATO attacks. Since there’s nothing to steal or phish, we help financial firms protect their bottom line and brand reputation, while simultaneously protecting their customers from the financial repercussions of fraud and cybercrime. 

3 ways hackers are bypassing MFA to commit ATO fraud

Between October 2020 and May 2021, nearly 

7,000 US consumers reported financial losses from cryptocurrency scams that totaled over $80 million

, a 1,000% rise from the previous six months.

Attackers are also becoming bolder, carrying out larger and more complex heists. In December 2021, BitMart – marketed as ‘the most trusted cryptocurrency trading platform’ – experienced a hack where approximately 

$190 million in assets was stolen from user accounts

In this blog, we’ll look at how Keyless can help exchanges stop account takeovers caused by compromised and weak credentials and SIM swapping.

Compared to traditional financial institutions, fraudsters are attracted to crypto exchanges because there’s a greater opportunity to steal funds without being caught, due to a lack of industry and regulatory oversight. 

Despite this oversight, a major attack can still have serious reputational and financial repercussions for an exchange. While not obliged to pay users back, in a bid to restore its reputation, 

BitMart promised to reimburse victims, costing it upwards of US $150 million

As well as this, the hack had operational consequences, with the exchange being forced to halt withdrawals until it identified the source of the attack, disgruntling customers even further. 

Often, the reputational and financial repercussions extend beyond the targeted exchange and its victims, causing a ripple effect that takes a toll on the entire crypto market. 

In 2016, the price of bitcoin fell 20% overnight after hackers stole 120,000 BTC

 (worth approximately US $2.3 billion) from Bitfinex, a Hong Kong-based exchange. 

,  attacks on Binance – the largest exchange in terms of trading volume – caused the price of BTC to fall once again, followed by an SEC probe. 

Likewise, the more recent BitMart attack has led to a probe by the FTC, 

. If the FTC discovers that BitMart misled its users over its security protections or didn’t comply with the law, this will have a major impact on consumer and regulator trust. 

Why authenticator apps and OTPs are failing the cryptocurrency industry

For years, cryptocurrency exchanges have enforced multi-factor authentication to protect users from attacks, mandating the use of authenticator apps, like Google Authenticator, or SMS 2FA. But with the evolving sophistication of cyber fraud and scams, hackers are finding ways around these security layers. 

In a display of this type of 2FA’s fallibility, in January 2022, 

 and stole $36.4 million in user funds, with over 483 accounts being affected.

To execute 2FA attacks, threat actors leverage stolen personal data and credentials to hack into an email account or steal a victim’s phone number, which enables them to fraudulently capture OTPs. Hacks like these are skyrocketing, with the 

FBI reporting over 1,600 SIM swap complaints in 2021, resulting in losses totaling over $68 million. 

In theory, third-party authenticator apps, like Google Authenticator, put a stop to threats from SIM swapping and email account takeovers, as they require the attacker to have access to the user’s mobile phone. However, bad actors have adapted methods to capture OTPs generated by apps.

One approach is to use reverse proxy websites that trick users into imputing genuine OTPs into a scam website, enabling fraudsters to gain access to private accounts by using them in real time. It’s also becoming easier for hackers to implement OTP bots and malware scripts designed for mobiles, which enable hackers to mimic mobile push notifications and applications, and combine them with email or automated phone calls to gain OTPs from unwitting users. 

, in the 2019 attack, hackers were able to bypass its 2FA systems by “

accumulating user account credentials over a long period of time

using Unicode domains, looking very much like binance.com

” that enabled hackers to capture the user’s OTP. 

After acquiring these user accounts, the hacker then simply created a trading API key for each account but took no further actions, until yesterday. Yesterday, within the aforementioned 2-minute period, the hackers used the API keys, and placed a large number of market buys

Passwordless authentication as a solution for crypto exchange security

When done properly, passwordless offers superior protection against account takeover attacks because bad actors have nothing to steal – no passwords, PINs, OTPs, or recovery seeds – that would enable them to otherwise fraudulently bypass authentication. 

Instead, passwordless solutions enable exchanges to:

However, not all passwordless solutions offer the same level of security, privacy, or consistency in terms of user experience. For example, magic links and social login have the same security risks associated with 2FA; and, due to multi-device limitations, passwordless solutions like FaceID don’t stop attackers from using stolen personal data and credentials to enroll for biometric authentication on other devices.  

As mainstream adoption of cryptocurrency increases, account takeovers targeting exchanges will continue to rise. To combat these risks, exchanges need to move away from legacy multi-factor authentication solutions that rely on weak authentication methods.

With our advanced passwordless solutions, Keyless addresses the issues of OTPs, passwords, and magic links by removing them entirely from the authentication journey. 

Instead, we provide strong authentication with a simple look into the camera by combining our patented privacy-preserving facial recognition software with invisible device verification, anti-spoofing, and liveness detection. 

Our privacy-preserving capabilities make it possible for cryptocurrency exchanges to identify genuine users via biometric authentication, without any risk to their biometric data or identity. In doing this, we eliminate the vulnerabilities of knowledge-based authentication and legacy 2FA, helping exchanges to strengthen their compliance posture and protect their brand reputation.

Why 2FA is failing to protect cryptocurrency exchanges from account takeover hacks

 gives decision makers a view of how a technology or application will evolve over time, providing a sound source of insight to manage its deployment within the context of their specific business goals.

This year’s Hype Cycle identifies Keyless as a sample vendor in the field of  Biometric Authentication. You may access a complimentary copy of the report 

According to Gartner, solutions like Keyless will:

Our privacy-preserving biometric authentication solutions enable businesses to seamlessly authenticate users without undermining privacy or security needs. 

Gartner, Hype Cycle for Digital Identity, 2022, 25 July 2022, Felix Gaehtgens. 

GARTNER and Hype Cycle are registered trademarks and service marks of Gartner, Inc. and/or its affiliates in the 

U.S. and internationally and are used herein with permission. All rights reserved. This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from SIFT. 

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Sift's Keyless named in Gartner’s 2022 Hype Cycle for Digital Identity

Account takeovers are becoming more pervasive, costly, and common. In this blog, we’ll explore the key drivers behind ATO attacks, what makes financial institutions higher risk, and what can be done to prevent attacks before it’s too late. 

 account takeover (ATO) attacks rose a staggering 307% between 2019 and 2021 – with the majority of these attacks stemming from compromised login credentials. 

Keyless protects against identity fraud by authenticating the real person with facial recognition biometrics instead of passwords, making it much harder for bad actors to compromise accounts and commit fraud using stolen personal data – we’ll explain how in this article. 

What happens during an account takeover attack?

Account takeovers occur when a bad actor gains access to a legitimate online account and performs benign actions, 

like making changes to a victim’s contact information

, ultimately allowing bad actors to steal funds, or transfer the account ownership to themselves or someone else for a payout.

What do account takeovers look like across different industries?

For a bank, an example of a typical account takeover activity might be:

For an e-commerce platform, a typical account takeover might mean:

ATO attacks are being fueled by the sheer volume of compromised credentials and personally identifiable information (PII) available online that enable bad actors to commit identity fraud. 

This, along with the accelerated pace of digital transformation, weak security, and legacy mindsets are creating a fertile environment for bad actors looking to exploit account security weaknesses that don’t adequately authenticate a customer's identity during high-risk activities.

Most ATO attacks stem from compromised credentials

Unsurprisingly, the root cause of most ATOs stems from compromised login credentials. Once bad actors have access to these, it’s relatively straightforward to launch further attacks against a victim and their accounts. 

According to data, PayPal credentials sell for $161 on average on the dark web. 

Passwords are most often compromised using the below 

Such attacks can and often do lead to serious financial losses as well as increased stress and frustration for victims – 

shows that 45% of those who experienced an ATO attack had money stolen from them directly. 

With switching providers being relatively easy nowadays, it’s important to combat ATO fraud before it has financial consequences for a victim. 

Otherwise, brands risk losing customers to competitors with better reputations and more robust account protections in place.

Because of this, removing credentials from the login equation seems like a sure-fire way to strengthen account protection and ensure customer retention.

Yet despite their obvious pitfalls, many websites and apps still use passwords and PINs as primary authentication methods. This is interesting as 

research shows that cybercriminals are more likely to follow the path of least resistance

 and move onto easier targets if an account has a more robust authentication in place – like facial recognition.  

Beyond password insecurity, modern technologies are enabling bad actors to launch more scalable, under-the-radar ATO attacks that are increasingly difficult to detect without the right tools and technology in place.

For example, fraud syndicates are known to use bots to run automated scripts to launch credential stuffing attacks on masse – this is cost-effective for bad actors while posing a significant risk to victims and businesses. 

Proper account protection requires a combination of technologies and solutions – but strengthening your first line of defense by replacing passwords with more robust authentication solutions can be the difference between a successful and unsuccessful attack. 

By removing passwords from the authentication journey, it’s possible to make your brand immune to ATO attacks stemming from identity fraud and credential theft.

Some of the best means for ATO protection include:

Keyless helps prevent ATO attacks by authenticating the genuine user instead of a set of login credentials like passwords, PINs, or SMS one-time passwords (OTPs).

We do this by combining facial recognition with device recognition. When a user authenticates with Keyless, our technology ensures in real-time that a genuine user is logging in from a trusted device – leaving little threat surface for bad actors trying to breach an account using stolen or compromised credentials. 

Keyless can be used as your first line of defense, or later on during the customer journey when a high-risk action is being taken on an account like changing an address. 

Dynamic Step-Up Authentication for High-Risk Transactions 

In order to strengthen authentication without hurting customer experience, we need to choose authentication methods that are most appropriate to the level of risk, and that won’t drive away and frustrate genuine customers. 

For example, a customer logging in from a recognized device may not need to be authenticated via biometrics to view their balance. 

If however, a customer attempts to add a new payee or order a replacement card after changing their address, it makes sense to authenticate that user using something more reliable than passwords or PINs.

If your fraud solution detects unusual or high-risk activity on an account, Keyless can be dynamically deployed to initiate a seamless step-up authentication flow to ensure it is in fact the genuine account holder attempting the activity. 

Our facial recognition technology will quickly detect whether it is a genuine customer (the same person who originally opened the account) or a bad actor – stopping identity fraud in its tracks while offering a seamless authentication flow for genuine users.

By making it harder to get into a user’s account in the first place, you can dramatically reduce the scope of an ATO attack. 

The threat of ATOs is real. Identity fraud is becoming more sophisticated and pervasive. Without the right tools and solutions in place, ATOs attacks can lead to immense frustration and financial losses for customers – damaging brand reputation and hurting customer retention.  

Luckily, the majority of ATO threats can be prevented simply by replacing passwords, PINs, and OTPs with more robust authentication methods like facial recognition. 

Doing this can stop customers from falling victim to fraud caused by ATO attacks, while also offering seamless authentication journeys for genuine users. In other words, the key to stopping ATO threats is to change how we authenticate users.

Account takeover fraud – what are the key drivers, risks, and what can be done to prevent it

For banks and payment service providers, the rollout of Strong Customer Authentication (SCA) under the revised Payment Services Directive has added a layer of complexity to payment security that has many wondering whether or not payment authentication can still be frictionless.

Intended to make online payments more secure, the rush to implement SCA-compliant solutions has also created a number of challenges for financial institutions, most notably an increase in failed transactions and frustrated customers.

 from Barclaycard Payments highlights that over 43,000 daily transactions, totaling £3.64 million, were declined in February this year alone because of the changes. 

 conducted by Forter in 2019 indicates that approximately one in three transactions are lost owing to complex authentication flows.

In this article, we’ll explore the impact that SCA is having on the financial services sector’s ability to offer secure and frictionless payments to its retail and merchant customers.

In theory, the payment experience for consumers should be one of enhanced security with fewer instances of friction. Instead, the requirement for SCA has seen legitimate customers being treated like they are committing fraud because an online store’s payment partner isn’t PSD2 SCA ready.

And while many banks and PSPs did manage to implement an MFA solution ahead of the SCA deadline, some rushed to do so, and as a result, are now dealing with numerous security and user experience issues caused by complex authentication flows and new security vulnerabilities.

Strong authentication doesn’t always mean better security

Cryptocurrency exchanges, which fall outside of the scope of PSD2 regulation (

), but have championed MFA for years, are still heavily targeted by fraudsters, which begs the question: is adding multiple authentication steps really the best way to prevent payment fraud and account takeover?

Despite mandating MFA for its users, $14 billion was lost to crypto fraud last year (2021), almost 

 from the previous year.  This highlights that preventing fraud is not as simple as PSD2 SCA would make it seem. In fact, adding additional authentication challenges to inherently weak and incumbent security solutions is comparable to putting a newspaper over a broken window. 

What financial services organizations must realize is that merely falling in line with PSD2 SCA is no guarantee of strong security. In fact, choosing a partner that makes authentication more complicated than it needs to be can damage profitability and undermine payment security goals altogether.

This, combined with the data around revenue loss, should be enough to convince the industry to embrace new technologies that enable seamless and compliant payment solutions that make security intuitive for users.

The financial services industry can benefit greatly from solutions that make payment security intuitive for users and the best way to do this is by reducing the number of steps required to authorize a payment.

Many organizations are embracing passwordless solutions, but the financial services industry is partly reliant on PINs, OTPs, and passwords – all of which have been proven to be insecure.

How can this be done? The key to making security intuitive is to eradicate these methods that require conscious user efforts, such as passwords and OTPS. These methods rely on customers being more security-aware than fraudsters whose strategies are only becoming more sophisticated, large-scale, and successful.

By simplifying payment authentication and embracing passwordless, the financial services industry can not only reduce fraud but decrease the volume of failed and abandoned transactions caused by traditional authentication methods.

Can payment authentication be frictionless?

The demand for seamless and secure authentication experiences is growing. With the rise of contactless payments and remote working, our lives are becoming more digital. Thanks to the likes of Face ID and Touch ID, users are increasingly at ease with passwordless solutions, but these popular solutions aren’t perfect. 

Almost all of today's authentication solutions have exploitable gaps – whether in terms of UX, security or privacy. In this blog, we'll not only answer some of your top authentication questions, but we'll explore how Keyless closes these gaps with biometrics.

1. Why are traditional passwords facing obsolescence? 

passwords weaken your organization's security posture

. When individuals reuse or share passwords, users face elevated risks of identity fraud, data leaks and phishing attacks. Given that over 80% of data breaches are due to poor password security, the security flaws of passwords are clear. For users, having to create complex passwords for each account is bad for UX. And for firms, loss of revenue as a result of identity fraud or non-compliance fines makes passwords a costly expense. 

Many organizations are turning to band-aid solutions like password managers and other password-based multi-factor authentication solutions (MFAs) in a bid to strengthen compliance and security. However, password managers can create greater security risks in the event of an account takeover, and legacy MFAs are burdened by poor UX, forcing users to complete multiple challenges in order to authenticate and access their accounts. How do we resolve those issues? The answer lies in moving towards new modalities that are more intuitive, such as biometrics. 

3. Why has it been difficult to make authentication intuitive and secure at the same time? 

The ideal authentication solution should combine great UX with robust security and privacy. In reality, most authentication vendors fail to do this, often sacrificing one feature over the other in a bid to meet market demands. 

Making authentication intuitive and secure at the same time has been difficult, as the traditional way to increase security is to increase authentication challenges and make password requirements more complex  – resulting in increased friction which impacts churn and . 

For example, an MFA solution that combines passwords with one-time codes may offer stronger security, but the user experience can be clunky and result in churn and increased costs. On the other hand, less friction can sometimes create security and privacy gaps – but new authentication modalities, such as biometrics, are changing this. 

4. What does the future of passwordless authentication with biometrics look like? 

Smart devices have popularized biometrics in recent yers – they are intuitive, eliminate the need for remembering passwords and PINs, and are integrated with many popular apps that people use every day.

It’s clear biometrics are the future – however popular solutions such as Apple’s Face ID and Google Touch are not by any means perfect. In fact, these solutions leave much to be desired from an interoperability and security perspective due to the underlying technology they use to secure authentication data like biometrics and PINs. 

The underlying technology powering solutions like FaceID is 

. Local authentication  became the industry standard for biometric authentication because it secures sensitive data within hardware, or "locally" on a device (as opposed to in on-premise or cloud data storage centers) – making it difficult for biometrics to be compromised by opportunistic hackers.

Locking biometrics to a hardware device however, such as a smartphone or token, creates limitations in regards to account recovery, consistency between different device models, and security gaps with device-sharing. When it comes to authenticating customers, businesses that rely on these solutions have little control over the user journey and security features they offer. 

5. How can biometric data be securely stored and protected without using local authentication technology?