ClickCease

4 Multi-Factor Vulnerabilities to Watch Out For

Prove
February 17, 2021

Black Friday is right around the corner and while bargain hunters are preparing to find the best deals, fraudsters are making plans to prey on unsuspecting consumers. If your company uses multi-factor authentication (MFA) such as one-time SMS passwords (OTPs) to safeguard customer accounts, you might think you’re covered. But our recently published analysis of over 385,000 retroactive SMS & Voice OTP transactions, conducted using our Trust Score™ technology, unearthed 4 concerning multi-factor authentication vulnerabilities:

  • FinTech and e-Commerce/Retail may be particularly at risk. The analysis shows 2X and 18X higher chances, respectively, for low Trust Score transactions in these sectors.
  • 2.5% of mobile MFA transactions were found to have low Trust Scores
  • 5% of mobile transactions had low SIM tenure, indicating potentially fraudulent SIM swaps
  • 10% of multi-factor authentication transactions were over Non-Fixed VoIP (voice over internet protocol, i.e. virtual phone numbers not tied to a physical address) lines. This increase in non-mobile device types is concerning because it indicates a potential opportunity for bad actors.

Download the report

The analysis indicates possible vulnerabilities in companies’ current multi-factor authentication processes, which may be unknown to the companies themselves. These results point to both major information deficits, such as outdated customer information, as well as risks that are not being addressed by in-place security measures, leaving companies and customers vulnerable to bad actors. The study also shows that these multi-factor authentication concerns can be addressed by fortifying one-time passwords with a trust indicator such as Prove’s Trust Score, which uses behavioral and phone intelligence signals to measure fraud risk and identity confidence. 

Are your MFA transactions vulnerable?

Read the full report here

Learn more about the Trust Score here

Keep reading

See all blogs
Blog
How Sponsor Banks Can Thrive in the Era of Heightened BaaS Scrutiny

Discover how sponsor banks can navigate increased scrutiny in the Banking-as-a-Service (BaaS) landscape. Learn strategies to ensure compliance, mitigate risks, and foster sustainable growth in this evolving era.

Mary Ann Miller
July 2, 2025
Blog
Blog
How Prove and authID Are Cutting Off Deepfake Fraud at the Source

Learn how Prove Identity and authID are uniting to combat AI-generated fraud and deepfakes, delivering secure, privacy-preserving identity verification that halts attackers before they create fake digital identities.

Prove
June 26, 2025
Blog
Blog
Injection by Deception: How Fraudsters Are Hijacking Identity Verification Flows with Injection Attacks

Discover how injection attacks allow fraudsters to bypass identity verification by injecting malicious data, highlighting the critical threat of these sophisticated attacks on digital security flows. Learn to identify and defend against these evolving methods that hijack trust and compromise user accounts.

Ryan Alexander
June 11, 2025
Blog