Learn which authentication trends will shape how people onboard to financial services, access digital banking, and approve payments.
The digital financial services landscape is constantly evolving, and when it comes to the topic of customer authentication, there’s no exception. When examining upcoming changes in legislation as well as the evolution of the latest technology trends, new challenges continually arise in proving secure customer identities online — as a result, financial organizations must proactively seek out ways to innovate.
To help you navigate this complicated landscape and map out the necessary adjustments, we’ve prepared an overview of the five main trends in authentication to watch for in 2024.
1. Rising Popularity of Passkeys (FIDO2)
As the number of phishing, vishing, and smishing attacks continues to rise, financial organizations evaluate authentication technologies that provide resilience against these attacks by design. FIDO2 is a prime example of such a technology.
While initially struggling to get significant traction, Apple recently prompted the broader acceptance of FIDO2 by popularizing passkeys, a passwordless login method that leverages the FIDO2 standard under the hood.
With passkeys, financial organizations can design native login experiences on the web — for example, passkeys can simplify web banking logins, allow customers access to digital banking, and authorize payment approvals using solely an iPhone (i.e. without the need for an additional mobile app).
2. Decentralized Identity
With the growing acceptance of web3 concepts, new authentication standards have emerged (for example, the W3C’s verifiable credentials and verifiable presentations). Decentralized identity radically changes the existing authentication paradigm and gives users unprecedented power over their identity and which attributes they share with third parties.
In simple terms, decentralized identity allows people to carry their proof of identity — digitized ID documents — in a mobile wallet app, which they use to prove their identity when accessing both digital and physical services.
Government efforts, such as the upcoming EU legislation on the European Digital Identity Wallet (EUDIW), heavily support this trend. The EU Digital Identity Wallet will work across the European Union (which is enabled by decentralization), and acceptance of the wallet by end users will be supported by making accepting the EU Digital Identity Wallet mandatory for all large companies, including banks.
The good news is that the banks will significantly benefit from implementing the EU Digital Identity Wallet, as it will enable customers to open a new bank account or apply for a loan in seconds instead of minutes. Faster customer acquisition and onboarding with lower friction are clear benefits worth investing in.
3. Getting Ready for PSD3
Although the PSD3 legislation is still in its infancy, this initiative will introduce important changes to Strong Customer Authentication (SCA). As using SCA is mandatory for financial institutions with payment accounts, these organizations must reflect each of these changes in the authentication solutions that they provide to customers.
4. Post-Quantum Cryptography (PQC)
Cryptography is at the core of all modern authentication systems. While existing standards worked well for decades and the majority of systems only required minor occasional algorithm upgrades, a new major threat for cryptographic systems has emerged in the form of quantum computers.
Quantum computers are based on a completely different computational principle and can break down traditional asymmetric cryptography, such as RSA or Elliptic Curve Cryptography. As a result, they will render most of the currently accepted proofs of identity (such as electronic signatures using current cryptographic algorithms) untrustworthy.
While today’s quantum computers are not yet powerful enough to pose a significant threat to a well-designed cryptographic system, local cybersecurity agencies and standardization bodies already recommend preparing for their advancement. For example, NIST recently suggested the standardization of three new cryptographic algorithms in 2024.
5. Renaissance of Hardware Authenticators
2023 brought a number of technological breakthroughs in artificial intelligence. Together with all the potential and new possibilities, new threats have also been introduced. For example, AI-powered facial or voice deepfakes will test the limits of remote biometric authentication.
At the same time, organizations must rethink their reliance on any information that users manually enter on laptops and mobile phones, such as PIN codes or passwords. Through commoditized mobile malware or even legitimate remote desktop tools (such as AnyDesk or TeamViewer), fraudsters can routinely intercept sensitive data, steal passwords or PIN codes, and effectively take over an account. While the current fraud scripts are often easy to spot, the ability to use AI to craft a tailor-made, localized script for a particular victim will increase the already-high attack success rate.
As a result of these developments, security-minded customers will seek out the highest protection level and consider using a dedicated authenticator device as an alternative. This approach will provide a much more solid possession-based element in multi-factor authentication. Thanks to FIDO2 authentication, we can see standardization in this area beginning to gain momentum. Consequently, digital banking customers can select the authenticator device of their choice.
Get Ready for Emerging Authentication Technologies
Our authentication technologies are easy to deploy, help you meet the strictest compliance standards, and deliver a secure and seamless user experience.
Let’s keep the conversation going!
.webp)
