Interest in passwordless authentication is growing due to increasing user impatience with passwords, and the growing UX and security costs associated with this outdated type of authentication. For companies looking to adopt passwordless authentication, there are several approaches. For mobile, zero-factor authentication delivers not only a passwordless authentication experience but also a frictionless authentication experience for mobile users.
Passwords were first utilized in computing in the ’60s and since then have become the main authentication factor for online services. However, today passwords are no longer secure and are not the most user-friendly, creating significant friction in the user experience.
[banner_1]
Because of the security vulnerabilities of passwords, multiple new types of authentication methods have been introduced, including one-time passcodes (OTPs), biometric authentication, and security keys. To increase security these additional authentication factors are typically used in conjunction with passwords for multi-factor authentication (MFA), which increases friction even more. Offering a seamless customer experience is today one of the main differentiators of online businesses, yet security and risk management leaders, by increasing security, are unfortunately adding friction for legitimate users.
To fix the problem, many companies are looking to adopt passwordless authentication strategies using one of the three approaches outlined by Gartner in its report entitled “Passwordless Authentication Is Here and There, but Not Everywhere”:
The defining quality of zero-factor authentication is that no action is required from the user, it is based on recognition signals that work silently in the background. This is undoubtedly the best an application can get in terms of user experience for authentication.
To achieve zero-factor authentication, there are two approaches:
If an anomaly is detected via zero factor authentication then the application should invoke additional authentication steps, preferably passwordless MFA to ensure both protection of accounts and delivery of a good user experience.
Network signals
Network signals refer to analyzing data such as the IP address, WiFi connection and Phone number to identify any positive or negative history associated with that particular account or other accounts. For example, if a WiFI connection was previously associated with an account takeover attack, it is a substantial risk signal when it shows up in a new transaction. On the other hand, if a legitimate user frequently uses a particular WiFi connection, the next time there is activity relating that account to that WiFi connection it can be used as a trust signal. As network activity can be very dynamic and easily manipulated by users and fraudsters, it is a signal that cannot be relied on solely but needs to be used in combination with others.
Device signals
Device fingerprinting is the most commonly used method to identify a device and evaluate its trustworthiness. In summary, the technique consists of collecting hardware and software information for identification. However, the approach has been recently affected by new privacy policies implemented by the browsers and operating systems, making traditional techniques less precise and reliable. Because of this, it is a signal that has to be used in combination with others.
Location signals
Location signals include data such as the IP location, GPS, Wifi scans, Bluetooth scans, and Cell-tower scans. An important consideration is that today location spoofing using VPNs, proxies, fake GPS Apps, and emulators is prevalent (more details can be found in this blog post about location spoofing - Five ways Fraudsters Spoof Location). Assuming there is good location spoofing detection technology in place, location signals can help identify if the user is at a familiar place or region and can be used as a trust signal. Additionally, specific locations can be flagged as suspicious based on historical fraud activity and used as a risk signal.
The precision of the location data defines the strength of the signal for both trust and fraud detection. For example, if the location data is sufficiently precise to be able to identify a specific “place” or location, Apps can identify if the user is in a trusted environment such as the home, office, or other frequently visited trusted location. In a study conducted by Incognia that analyzed data from financial services Apps, 90% of the legitimate sessions and 95% of the legitimate sensitive transactions happen from trusted locations, which means that there is a possibility to implement zero-factor authentication for the vast majority of the cases. For fraud detection, precision is also relevant. By identifying the exact place from which fraud originates, companies can block that specific location without impacting consumers’ user experience that lives or stay nearby, avoiding false positives.
To implement zero factor authentication with confidence, Apps have to make sure they have good location spoofing detection, strong device fingerprinting and access to a large volume of historical data about the reputation of devices, locations and networks.
At Incognia, we combine precise location with place-level accuracy, device and network signals to deliver a zero-factor authentication experience for mobile. 80-95% of users opt-in for zero-factor authentication on financial services apps, with users eager to experience less friction and increased security.
We published a recent case study of the results Will Bank, a challenger bank, achieved using Incognia, zero factor authentication, including friction-free login for 93% of the logins while reducing fraud losses by more than 90%. Of most interest for fraud prevention, is that with Incognia approving hundreds of millions of logins, the users who had location services turned on, experienced zero account takeover fraud.
Zero factor, zero friction.