It is common practice to place The best Multi-factor Authentication /2FA flows at Sign In, but just because something is common doesn’t mean it’s the most sensible and secure. Here are some reasons why:
- Sign In friction is one of the biggest causes of customer frustration and a common reason for consumers not to opt-in to a simple multi-factor Authentication.
- Cybercriminals are now able to bypass step-up 2FA and MFA on Sign in, depending solely on your Customer Identity and Access Management (CIAM) provider is now at risk. This is often called cookie stealing.
- Friendly fraud tactics blame unauthorized use while the app was “Signed In”
- Creation of manual workload for customer service and operations teams when there's a lack of assurance at other places in the customer journey
How do we mitigate the above challenges? The answer is simply placing challenge flows in other parts of your customer journey, with step-up risk parameters and rules at Sign In.
Authsignal allows you to build rules to flag high-risk signals on Sign in, like "New Device", and "Impossible Travel", so that you can let most of your good customers through without stepping up authentication on Sign In.
Using a consumer FinTech or Crypto On-Ramp as an example, these are the four important places you should consider placing step-up authentication immediately:
Withdrawal flows
Fraud risk at withdrawal is the highest in many FinTech apps, with customer expectations and satisfaction also at their most heightened. Getting this customer journey wrong could mean losing good customers if the experience is too painful and letting in massive fraud losses if controls are too relaxed. In 2022, this risk is further exaggerated with modern instant payment infrastructure making transactions irreversible when they get processed.
Placing step-up authentication with rules around the dollar value of the amount and behaviour through velocity data gives strong assurance that your customer has authorized the withdrawal. This is commonly known as transaction signing and provides the most balanced way to manage risk.
Buy/Sell/Pay
Similar to withdrawals, Buy/Sell/Pay flows are next on the list for important customer journeys where you should consider placing step-up authentication. This is especially important if your app saves credit/debit card information and saves it on file to charge on behalf of your customer. This is typically called Card Not Present (CNP).
In these flows, it is common to have customer raise disputes or challenge payments through payment schemes, and with the rise in friendly fraud, more and more disputes are coming through, claiming that "it wasn't me".
By placing controls like rules-based challenges and having an audit trail of your customer's activity and device information, operations teams can quickly investigate and validate the claims of your customers.
Change of personal/contact information
An often overlooked part of your customer journey is where personal and contact information can be changed. Places where customers can change address information, email, and contact information, if not fully secure, can lead to cyber criminals exploiting gaps to launch phishing campaigns and re-route sensitive information.
Chatbots and Customer Support queries
Finally, one of the weakest places where cybercriminals can exploit your platform is your manual customer support channels. Cybercriminals know that good customers use these channels when they get "locked" out of their accounts and exploit weak customer authentication approaches like verification questions (e.g. tell me your date of birth or your address)
By automating this crucial part of your customer journey with step-up challenges, customer support can get straight to assisting your customers without the antiquated approach of messaging back and forth, only to get a weak form of verification a couple of hours later.
How Authsignal Helps?
Authsignal makes it really easy to bring beautiful challenge flows using our pre-built UI, balanced with our easy-to-use no-code fraud rules engine, all housed within our admin portal, which gives you access to rich analytics and an audit trail of your customer activity.
Authsignal's SDKs and APIs mean that engineers can drop in challenge flows anywhere you choose in your customer journey within hours, regardless of platform, web or mobile.
<blog-button>Learn more about Authsignal and flexible MFA<blog-button>
.svg)
