New Report | When Trust is Hacked: Customer Identity Security in Finance in 2024 | 2024
When Trust is Hacked: Customer Identity Security in Finance
In surveys of both financial services organizations and their customers, a telling picture emerges:
Banking customers are increasingly uneasy about cybersecurity and the safety of their data when it comes to managing their finances. Moreover, they are demanding cybersecurity innovation to address these concerns faster than their financial institutions can provide it.
Finance organizations face increasing identity-based threats....
86%
have been targeted by identity-based cyberattacks
$4,572,761
spent per organization on breaches caused by weak authentication
77%
were breached through authentication processes
At the same time, financial services customers say ....
80%
would likely switch financial institutions following a data breach
77%
would actively favor a bank offering passkeys
22%
use the same password for their financial institution as another account
Finance organizations are under pressure to strengthen identity security as they are increasingly targeted by threats like phishing, credential misuse and deepfakes. To stay ahead, banks must prioritize innovative, customer-centric security measures like passkeys or risk losing both revenue and trust."
Gehan Dabare
Leader for IAM at companies such as JPMC, Citi, CVS Health
What Are Passkeys?
Passkeys has become an umbrella term for passwordless authentication based on FIDO standards. Passkeys replace passwords with a cryptographic key pair and on-device authentication to make user login easier and more secure. There are two types of passkeys, synced and device-bound.
Synced Passkeys: A synced passkey is a digital credential for phishing-resistant login to websites or apps without a password. They are provided and managed by platforms such Apple, Microsoft, Google. They can be synced between the user’s devices via cloud services like iCloud or Google Cloud, and are the type of passkey that consumers are most familiar with.
Device-Bound Passkeys: A device-bound passkey is generated and stored in dedicated hardware on a single device and cannot be shared across devices. This could be a security key, a smartphone or computer. They are provided and controlled by the enterprise and may support advanced protocols such as transaction signing. Financial institutions frequently choose to implement this type of passkey for their customers, integrated into their own app.