Improving liveness detection and anti-spoofing systems has become a key goal in the biometric authentication industry. However, it's important for businesses to note that, when it comes to mitigating account takeover threats, liveness detection can sometimes create a false sense of security.

 the advancement of deepfakes and the ease at which they can now be created is posing serious security threats for both businesses and individuals.  

With biometric authentication becoming more ubiquitous in everyday life, the need to guard against deepfakes is driving discussion around enhancing the security and effectiveness of facial recognition technologies.

In this article, we will explain why liveness detection can sometimes be undependable when it comes to detecting anomalies and threats during biometric authentication.

Liveness detection is an essential part of biometrics. Using AI-based algorithm techniques, liveness detection helps to verify that there is a real person behind the camera rather than a photograph, video, mask, or deepfake.

At present, liveness detection is used to help strengthen security and reliability during both identity verification and authentication processes.

However, while liveness detection can help strengthen security when applied correctly, it’s important to understand that it can sometimes create a false sense of security. The truth is, liveness detection on its own is not enough to ensure that the real person is authenticating.

According to recent reports, biometric spoofing threats are rising and could become increasingly scalable as hacking technology becomes sophisticated. 

highly-scalable biometric spoofing attacks are about to explode

 (otherwise known as deepfakes) that are “injected” directly into a victim’s device. 

 that the Fincrime outlook for 2023 will include more deepfake threats as digital payments using technologies like Apple’s FaceID surpass credit card payments. According to the article, Jumio’s CEO Robert Prigge warned:

To eliminate the risk of spoofing threats, it’s important that biometric authentication solutions combine liveness detection with a secondary, strong authentication factor.

At Keyless, we strengthen the reliability of our biometric authentication solutions by combining liveness detection with device verification software, which runs device background checks to verify that a person is attempting to log in from one of their trusted devices (essentially binding a user’s device to their Keyless account). 

Unlike with solutions like FaceID, users can log in using Keyless facial recognition software to multiple devices. Bound devices can be linked and unlinked at the discretion of the customer, giving them more control over managing their identity online. 

Biometric authentication solutions that combine liveness detection with a strong, second authentication factor, like device verification, are much more secure than those that rely on liveness detection alone or those that combine biometric challenges with knowledge challenges such as passwords, PINs, and OTPs (which can easily be compromised).

currently states that OTPs are a possession factor, but with 

, we advise our customers to view them as knowledge factor authentication challenges.

Is passive or active liveness detection better?

Passive liveness detection requires no prompted action from a user. Instead, the liveness detection systems will look for subtle observations in facial movements, such as eye & lip movement and blinking. Active liveness detection methods require users to consciously make physical gestures, such as looking from left to right or blinking. This is known as a "challenge-response" approach.

, active liveness detection has been known to be easier to spoof, with hackers reportedly using realistic masks, photos, and deepfake videos to fraudulently bypass challenge responses. However, 

the debate around active and passive liveness detection 

effectiveness is a complex one, with strong arguments for and against both methods. 

Perhaps the biggest drawback to active liveness detection is that user experience becomes more arduous – while this may not be a problem when implementing authentication solutions in high-risk sectors like government, military, and aviation, challenge-response systems would undoubtedly increase friction during day-to-day activities, such as authenticating payments or unlocking your phone.

How does Keyless improve liveness detection?

At Keyless, we use offline passive liveness detection, which does not require any interaction with the user, nor does it require an internet connection (or backend computation for more technical audiences). 

Our advanced biometric authentication systems use state-of-the-art deep learning models capable of detecting signals and patterns that can determine whether or not an image or video is fake.

Our advanced biometric authentication solutions combine liveness detection with anti-spoofing techniques that detect the slightest obstructions and distortions in a multitude of environments, including in low light conditions, which have undergone rigorous testing and have been 

certified for commercial use by the FIDO Alliance

Liveness detection cannot be used without a second, strong authentication factor

While liveness detection is a critical component of any facial recognition solution, it’s not a fail-safe when it comes to preventing spoofing and deep fake threats that threaten to upend business operations and cause long-lasting reputational and compliance consequences. 

To protect against a rise in biometric threats, it’s critical to combine facial recognition systems with an additional, strong authentication challenge such as device binding (device verification).

For more information on what Keyless can do to improve your business's security, 

schedule a free demo with one of our passwordless experts.

Why liveness detection is not enough to prevent spoofing threats

shows that 81% of customers view biometrics as the more secure form of identity verification compared to passwords. So why, then, have some businesses been reluctant to implement passwordless logins?

Over the course of this article, we will highlight some of the privacy risks associated with biometric data, and look at how companies can use privacy-enhancing technologies (PETs) to make it safer to store biometric data while complying with cross-jurisdictional data protection laws.

In short, data privacy refers to the protection and control individuals have over their personal information, ensuring that it is collected, stored, processed, and shared in a secure and confidential manner. It involves the right to determine what information is collected, how it is used, and who has access to it.

In the digital age, data privacy, and the laws surrounding it, couldn’t be of more importance. This is because vast amounts of personal information are generated, collected, and analysed by various entities, from huge social media platforms to governments, to small businesses. This information can include sensitive details like names, addresses, financial data, health records, and online activities.

What are the key elements of data privacy?

The concept of data privacy encompasses several key principles:

Individuals should have the right to give informed consent before their data is collected and used.

Data should only be collected for specific purposes and not used for other unrelated activities without the individual's consent.

Only necessary data should be collected, limiting the collection of excessive or irrelevant information.

Organisations should make reasonable efforts to ensure that collected data is accurate, up-to-date, and relevant for the intended purpose.

Appropriate measures must be implemented to protect data from unauthorised access, loss, or damage.

Individuals have the right to know how their data is collected, used, and shared by organisations.

Individuals should have the ability to access their personal data, request corrections or deletions, and have control over its use and disclosure.

Data privacy regulations, such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), aim to safeguard individuals' data privacy rights by imposing obligations on organisations handling personal information. These regulations provide individuals with greater control over their data and require organisations to adopt privacy-by-design practices and enhanced data protection measures.

For businesses, ensuring data privacy is essential for building trust, protecting individuals from data breaches and identity theft, and maintaining the ethical and responsible use of personal information in this ever-accelerating digital era.

Data privacy is crucial for internet users due to various risks they face online. 

For businesses, data privacy also plays an essential role.

Data privacy measures, such as data minimisation and security protocols, contribute to overall data governance and risk management,

 ensuring the integrity and confidentiality of sensitive business information.

As biometric technologies become increasingly commonplace in online authentication and identity management, it's important that businesses properly evaluate solutions to ensure that personally identifiable information is protected against mounting privacy and security threats.

What are the privacy risks of storing biometric data?

Data breaches are a very real threat and have the capacity to affect millions of users. 

While much of the focus on data breaches tends to be on “written down” customer information (passwords, email addresses, telephone numbers, etc.), skilled hackers also target biometric data as well.

Biometric data such as fingerprints are immutable and cannot be altered. As such, biometric data theft is far more dangerous than a standard password leak, as it could have wide ramifications for the person who has been hacked. Biometric data theft can pose a legitimate security concern, as a well-equipped and highly funded group of hackers could create a 3D-printed fingerprint mould to unlock any device or account that is linked to the hacked user. 

Due to the sensitive nature of biometrics, there are a number of policies around the world that govern how biometric data is collected, stored, and used.

What are the regional differences in biometric legislation?

As we outlined in our article on data protection outside of the EU, the European Union leads the way when it comes to data protection regulation, and biometric data is no exception.

Defined by EU data privacy law as “special categories of personal data”, the General Data Protection Regulation (GDPR) establishes that it is forbidden for any company to share the biometric data of EU citizens and long-term residents with third parties without their consent. 

Legislation for the protection of biometric data also exists outside of the EU, with India and China, in particular, having strong guidelines on what can and can’t be done with biometric data.

In the United States, meanwhile, there is no single unified law that regulates biometric data (or any type of personal data for that matter), with individual states deciding on their own policies. However, the state of Illinois does have the Biometric Information Privacy Act, which is the most expansive policy in the country.

In light of the current security challenges facing every online business, organisations are beginning to adopt an approach known as data protection by design to help keep customer data safe. This approach has seen businesses implement one of five emerging PETs to ensure that any personal data processed has been safeguarded to prevent it from falling into the wrong hands.

As highlighted above, there are five emerging PETs that are vital for safely using personal data online. Large organizations that handle sensitive customer data, such as banks, use PETs to ensure that their customers' data remain safe.

By using secure multi-party computation, Keyless removes the need to store or process biometric data. This greatly enhances the security of Keyless, making it a no-brainer when it comes to safeguarding the identity of your customers.

Our unique biometric authentication enables organizations to safely implement Keyless into their business without breaching regulations and exposing themselves to compliance risk. So, what are you waiting for? Give your customers the joy of a smooth, frictionless, passwordless login with biometrics that simply works.

Biometrics: solving data protection challenges

Physical SIM cards have been present in mobile technology since the beginning of the smartphone revolution. However, unlike phones of the past, Apple’s latest release, the iPhone 14 series, comes without a physical SIM slot. Instead, these handsets exclusively use embedded SIMs (eSIMs), which can’t be removed. This design change makes it easier for users to change providers, enables users to connect to more than one network, and allows for extra physical space on the phone to enhance the design.

However, as the SIM has traditionally been the gateway to any connected device, what does its removal mean for security? Account takeover, a form of identity theft involving hijacking a user's account, is an ongoing problem that 

 in 2021. Could eSIMs be the answer to preventing threats posed by malicious actors?

In this article, we’ll examine the benefits and drawbacks of eSIMs from a security perspective and discuss why financial institutions must remain vigilant to the threats posed by eSIMs and data security.

In recent years SIM swapping has become an increasingly prevalent fraud technique. SIM swapping involves cybercriminals tricking mobile phone carriers into porting a genuine user’s phone number into the criminal’s device. They will pretend to be the genuine user and say that their device has been lost or damaged. When asked to provide identification, the criminal will provide real information on the user - often either stolen beforehand or bought on the dark web.

Once the cybercriminal has convinced the carrier to transfer the number, they will then be able to conduct account takeovers across any accounts linked to the compromised phone number. 

With an eSIM, however, as there is no physical SIM card, a cybercriminal cannot fraudulently claim that the SIM card got lost or damaged - which negates the ability of criminals to carry out a SIM swap. 

Apple’s iPhone 14 series has been seen as a key driver for eSIMs, which follows the US government’s 

. However, while enhanced data security is one of the key driving factors for this switch, iPhones sold outside of the US still feature a physical SIM card slot.

One of the most significant changes with the eSIM-enabled iPhones is that users must sign into their Apple iCloud ID to activate the device. The logic behind this is that Apple iCloud passwords are more complex than standard Apple ID passwords, thus making them more resistant to brute-force attacks.

However, despite the increased security of Apple iCloud passwords, any system that relies on a password (including those that use temporary one-time passwords - OTPs) are still vulnerable. For example, Apple ID passwords can be leaked, breached, or phished from users through various email and keylogging scams.

As with all new technologies, it will take some time to understand the full scale of security vulnerabilities. This is because cybercriminals generally follow the path of least resistance, meaning it might only make economic sense to focus their attention on compromising eSIMs once they are more broadly adopted. In the UK, for example, the adoption of eSIMs has been somewhat slow, with only three major networks offering eSIMs without any caveats. 

However, with Apple being the largest mobile phone manufacturer in the US, with 

, the likelihood is that eSIM security will be heavily tested in the coming months and years. 

Why biometrics are more reliably secure than eSIMs

While eSIMs help negate SIM-swap attacks, embedded SIMs such as those found on the iPhone 14 still rely on typed Apple ID passwords and OTPs. For the ultimate level of security, organizations should be utilizing biometric security, which replaces access via typed passwords with access via biological features. By using behavioral or biological characteristics for access control, data is at far less risk of being compromised.

Passwords are the biggest driver behind account takeovers, yet 

 say that changing their password was the only action they took after experiencing an attack. By sticking with a typed password authentication method, users are keeping themselves vulnerable to further data breaches.

Here at Keyless, we don’t rely on SIMs to authenticate users and we don’t send OTPs anywhere because we know that one-time passwords can and will be compromised, no matter the method by which they’re delivered to the customer.

By combining our patented privacy-preserving facial biometrics with device verification software, we provide a multi-factor authentication solution that is resilient against SIM-swapping malicious actors who try to capture OTPs sent to the user’s device or accounts. 

Our passwordless verification method also offers straightforward yet effective biometric-based authentication solutions for all users, allowing them to simply look into the camera for access – no passwords, PINs, or OTPs required.

To chat with a member of our team and see our technology in action, 

Will e-SIMs help to eliminate threats or make account takeovers easier?

Over the past five years, a raft of global jurisdiction changes has forced multinational corporations to rethink their business practices regarding data handling. 

Following the implementation of the European Union’s GDPR in 2018, a wide range of countries across the globe began to implement variants of data protection rules. The challenge for any global organization is to be aware of and remain compliant across multiple jurisdictions.

Throughout this article, we will provide a snapshot of data laws, analyzing how data protection rights are handled in different regions of the world and how these laws are driving the adoption of privacy-enhancing technologies. We will also be taking a look at what happens when companies fail to comply with changes to data protection laws.

Understanding data sovereignty, residency, and privacy

There are three main terms that are important when understanding how data protection works and the nuances associated with the topic. These are as follows:

A common example of data residency is when a company chooses a particular location to base itself in - typically, this is done in order to take advantage of a better tax regime. 

Businesses will then often be required to prove that they are predominately doing business and storing data within the borders of their chosen data residency in order to enjoy the benefits of their chosen location.

Every region has a different approach to how data is governed; for example, in Europe, data is governed and protected by the European Union under the General Data Protection Regulation (GDPR), which serves as a framework for how personal data is collected and processed from individuals who live both inside and outside of the EU.

What does data regulation look like around the world?

Outside of Europe, several differences exist in how each region (and sometimes even individual countries within the same region) handle data.

60% of countries in Africa have data protection and privacy legislation, with 20% reporting no legislation whatsoever. 

Meanwhile, in the Middle East, most nations have at least a draft form of legislation (Saudi Arabia & UAE, for example, have draft privacy and data protection legislation in place). However, as with some parts of Africa, Islamic countries operate under Sharia Law which has multiple principles regarding the divulging of personal secrets. Under the realm of privacy, Islam considers the safeguarding of people’s privacy as not only an individual duty of all people but also as the Islamic state and government’s obligation. Any violation of privacy is illegal.

Like in Africa, around 60% of countries in APAC have some form of data protection and privacy legislation. Of these, only Japan, New Zealand, and South Korea have adopted laws similar to Europe’s GDPR. 

Meanwhile, Australia has a system known as the Australian Privacy Principles (APP) that covers collecting, using, and disclosing personal information. A breach of an APP is considered to interfere with an individual's privacy and can lead to a number of penalties. 

Canada is the only North American nation with GDPR-like data protection legislation, while the US has legislation on a state level only.

In South America, only three countries have successfully passed GDPR-like legislation (Argentina, Brazil & Uruguay), with Paraguay also in the draft stages of creating said legislation.

Central America meanwhile has data protection and privacy legislation across most of the region, however, unlike GDPR, Central American nations’ laws are independent laws that aren't recognized outside of their respective countries borders. 

Across the Americas, 75% of countries have some form of legislation in place with a further 10% implementing draft legislation.

How are regulations driving the adoption of privacy-enhancing technologies?

Due to the rise in data protection laws around the world, the need for privacy-enhancing technologies (PETs) has never been greater.

As outlined by the ICO, the UK government’s independent regulatory office that deals with data protection, PETs can help organizations operate under the concept of 

, which is a system, product, or business practice designed to protect personal data automatically.

In addition to data and privacy laws, the adoption of PETs throughout a product's research and development stage can help an organization minimize the cost and risk associated with a major data breach. For example, suppose data is stored incorrectly in a manner that isn’t fully compliant with GDPR or a similar regulation, in that case, a data breach could have wide ramifications for both the organization's customers and business as well. All customer personal data (including name and address) could be leaked onto the internet, whilst the company could face fines of up to 17 million euros or 4% of their annual turnover, whichever is greater. However, adhering to well-established privacy techniques such as encryption methods for passwords and other such information can make it harder (and sometimes virtually impossible) for data breaches to leak personal information in their entirety.

 of supporting the adoption of PETs, highlighting their potential to unlock innovation by enabling valuable data sharing and analysis whilst protecting the privacy and confidentiality of sensitive data.

What are the consequences of non-compliance?

While most countries have their own rules and regulations regarding noncompliance, the common theme that unites them all is that failing to comply with data protection laws will result in substantial fines and penalties for infringing individuals and companies.

For example, in Uruguay, failing to comply with the country’s data protection supervisory authority carries several punishments, which include warnings, fines, and even forced closure of a company’s database.

Meanwhile, in Japan, the maximum penalty for not complying with the Act on the Protection of Personal Information (APPI) can carry up to a year in prison. 

Ever-changing global data regulations are both driving innovation and the adoption of PETs as businesses seek to protect their organization from facing fines or being unable to operate in certain markets. 

 following the implementation of China's Personal Information Protection Law, companies are also wary of new legislation and the impact it might have on their business.

Rather than face fines or allow new legislation to potentially alter, threaten, or even 

, many firms will choose to cease operating in non-essential markets until a solution has been implemented or a suitable PET can be utilized to adhere to regulatory changes.

The regulations driving the adoption of PETs

The use of Buy Now, Pay Later (BNPL) platforms has skyrocketed in the past two years.

 have become household names in their own right, as consumers embrace the idea of being able to purchase expensive items without needing to pay upfront. 

In addition to the obvious benefits of being able to afford items that are normally beyond a person's purchasing power, BNPL platforms have gained significant popularity due to their relatively frictionless approach to providing short-term consumer credit lines. 

BNPL websites rely on scant few details from applicants and, in many countries, don’t require a hard credit check. And despite economical constraints from the ongoing cost of living crisis in the UK and Europe, the BNPL market shows little to no signs of slowing down – with some of the world's most recognized fintechs 

, recently introducing their own BNPL payment schemes.

Unfortunately, as with virtually everything online, the popularity of BNPL has also attracted the attention of nefarious groups. Fraudsters and hackers are exploiting the lack of oversight on these payment platforms. 

BNPL is expected to be a major contributor to global fraud losses, which are forecast to surpass 

. Over the course of this article, we will highlight how BNPL platforms can enhance security and prevent fraud from occurring on their platforms. 

When discussing BNPL fraud, it’s important to understand the 

Generally, onboarding processes for opening BNPL accounts tend to be less rigorous in terms of identity verification when compared to traditional financial institutions which are regulated. 

As such, it's easier for fraudsters to commit identity theft and fraudulently open a BNPL account using stolen personal information. It’s also lucrative for fraudsters to launch account takeover campaigns, aimed at compromising the login credentials and OTPs to hack into existing BNPL accounts. 

According to a recent report from Sift, the leaders in Digital Trust & Safety, account takeover (ATO) 

attacks on BNPL platforms have gone up 54% in the last year

 – with most stemming from compromised passwords and one time passwords (OTPs).

There are several tell-tale signs of BNPL fraud that BNPL platforms should look out for:

Due to most passwords and billing information being saved on a device or web browser that they’ve previously signed into, the majority of end users tend to stick to the same device when making purchases online. If an existing account has login attempts from a number of different devices, there is a greater chance that this account has been compromised. 

When compromising a BNPL account, fraudsters may attempt to order goods to a new address. If purchases are suddenly being sent to a new address, this is a strong sign that a customer’s account may have been hacked.

BNPL platforms should pay close attention to their customers' account order history, while also encouraging end users to review their order history if their personal data has been compromised. 

BNPL platforms should also look to re-authenticate a customer when an unfamiliar transaction occurs. Typically, a radical change in the type and price of the items purchased will indicate that an account has been breached.

There are four types of BNPL fraud that customers and BNPL companies should pay close attention to.

Account takeover (ATO) fraud is where a fraudster uses stolen credentials and personal information to hack into a genuine user's BNPL account. ATO attempts on a BNPL account may be secondary to email ATO and SIM Swapping attacks – which enable fraudsters to capture OTPs sent by the BNPL account during authentication. To make matters worse, many customers typically use similar, easily guessable, or 

Similar to an account takeover, identity theft will involve a criminal using stolen personal information (emails, passwords, identity documents, addresses) obtained from another data breach) to open an account with a BNPL platform like Klarna. Identity theft can go further, in some instances fraudsters use stolen passports, driver’s licenses, bank cards, and mobile phones to set up new BNPL accounts and make purchases using the stolen identification.

This type of fraud is not too dissimilar to identity theft, whereby a fraudster will set up a new account to make illegitimate purchases. However, synthetic fraud differs from identity theft because the information used to set up the account is typically fake.

Friendly fraud refers to BNPL purchases often made by friends, family members, and young children that have accessed a customer’s device and made a purchase without the owner of the account being made aware.

What is Keyless & how can it help prevent BNPL fraud?

While BNPL fraud is alarming, it is possible for BNPL platforms to enhance their fraud prevention strategies by eliminating credentials, which are easily compromised, from the authentication journey. 

One of the best ways to prevent BNPL fraud is 

, the world’s most advanced passwordless authentication solution. Keyless enables BNPL platforms to enhance security by replacing credentials with biometric authentication. 

Biometrics have been proven to be safer and more secure than passwords and OTPs, both of which can be easily compromised with the right technology. With Keyless, customers are authenticated using a combination of 

and background device verification checks that help to ensure that login attempts are coming from a known device.

In this way, Keyless offers frictionless strong authentication during authentication, or whenever a high-risk purchase or action is made, such as changing an address. 

Keyless also integrates with major eIDV/KYC vendors, helping to close the assurance gap between identity verification and customer authentication. Thanks to these integrations, Keyless is able to offer high assurance that the real person is logging in or attempting to make a purchase – making it difficult for fraudsters to use stolen personal information to open or hack into an account. 

, now is perhaps the best time to consider enhancing your authentication strategy by switching to a passwordless solution. 

How to protect against buy now, pay later (BNPL) fraud with Keyless

In recent years, account takeover attacks have become more prevalent than ever, with fraudsters closing in on the financial services sector with new ways to defeat multi-factor authentication challenges.

In this blog, we’ll look at three emerging methods fraudsters are using to bypass multi-factor authentication and execute account takeover fraud, as well as how businesses can effectively mitigate these emerging threats. 

Despite the roll out of strong customer authentication, in 2021, 

84% of financial services firms experienced account takeover attacks

. According to studies from Juniper, that number is only set to rise, 

with losses forecast to surpass $206 billion by 2025

Rather than being deterred by the improvements to authentication security, attackers are simply inventing new ways to capture multi-factor authentication (MFA) credentials, such as OTPs, to execute attacks. 

We’ll now look at the techniques listed below that fraudsters are frequently using to bypass MFA security:

SIM swapping is a major concern for financial firms and cryptocurrency exchanges, with attacks becoming more frequent and pervasive, increasing by over 400% the last five years in the United Kingdom. 

To carry out a SIM swapping attack, fraudsters exploit compromised and leaked personal information to impersonate legitimate customers and transfer legitimate phone numbers onto new, fraudulent SIMs.

Once a new SIM is activated on a fraudster's device, they will receive OTPs meant for the customer. They will then often use these to bypass and disable MFA, make fraudulent payments, and launch further attacks on the victim’s accounts and contacts.

According to the European Union Agency for Cybersecurity, 

there are specific circumstances that open the opportunity for SIM swapping. These include

It goes without saying that these attacks can have serious financial repercussions for victims. Last year, 

Canadian police arrested a teenager for stealing a staggering $36 million from a single victim through a SIM-swapping attack

, and in Europe, criminals leveraged SIM swapping methods to 

steal over $100 million from US celebrities.

Another advanced method being used to capture OTPs are reverse proxy scams. Reverse proxy scams are a type of man-in-the-middle phishing attack that enable fraudsters to steal (MFA) credentials and session cookies from victims without the victim’s knowledge. 

To execute a reverse proxy scam, attackers intercept a victim’s credentials using a proxy web server that essentially acts as a layer between the victim and the website they’re attempting to login to. 

Microsoft announced this year that approximately 

10,000 organizations had been targeted with fake Microsoft Office login pages

. The campaign led the user to an attacker-controlled proxy site that sat between them and the server they were attempting to log into.

Reverse proxy scams like these use a number of advanced steps to capture genuine MFA credentials:

Unfortunately, these attacks can be especially insidious, as targets are often completely unaware that they’re being hacked, until it’s too late. Exacerbating the problem, 

bad actors can now purchase “phishing kits” online to execute such attacks

 – meaning you do not necessarily have to have the technical skills to launch attacks. 

The popularity of BNPL platforms, like Klarna and Clearpay, has recently exploded, 

with BNPL customers now exceeding 360 million globally

The adoption of BNPL payments has created an unprecedented opportunity for fraudsters, who are taking advantage of weaker security standards adopted by BNPL services and their retail partners.

Bad actors are attracted to BNPL accounts because there’s more opportunity to execute an account takeover attack. 

ATO attacks on BNPL accounts can be executed either by:

The latter method generally requires less effort as online retailers have weaker authentication standards compared to financial platforms and apps – meaning 2FA is often not required. 

Fraudsters can compromise a genuine customer's account either by purchasing compromised credentials online or by running automated credential stuffing or credential cracking attacks. 

According to recent research from Imperva, 

64.1% of account takeover (ATO) attacks make use of bad bots (software applications that run automated tasks such as credential stuffing)

, meaning they can execute these kinds of attacks en masse. 

Luckily, there’s a simple way for financial firms to protect their customers against these emerging threats, and that’s by eliminating passwords entirely – whether temporary or saved – from login and payment authentication flows altogether.

By eliminating all credentials, whether a password, PIN, or one-time code, businesses can effectively reduce account takeover threats caused by compromised credentials, phishing, and man-in-the-middle attacks to zero. 

By replacing passwords and OTPs with our advanced passwordless solutions, Keyless provides the ultimate protection against ATO attacks. Since there’s nothing to steal or phish, we help financial firms protect their bottom line and brand reputation, while simultaneously protecting their customers from the financial repercussions of fraud and cybercrime. 

3 ways hackers are bypassing MFA to commit ATO fraud

Between October 2020 and May 2021, nearly 

7,000 US consumers reported financial losses from cryptocurrency scams that totaled over $80 million

Blog