Replacing Knowledge-Based Authentication Is Long Overdue

Knowledge-based authentication, long used for online identity proofing, is criticized as increasingly unreliable because it relies on static personal information that has been widely exposed through data breaches and is readily obtainable by fraudsters. The passage notes that KBA can both deny legitimate users and allow fraudulent users to pass, prompting NIST to deprecate its use in its identity guidelines, though it remains common in public-sector services such as motor vehicle registration and government portals. It argues that using KBA as a fallback method creates an exploitable route into centralized state systems and recommends stronger alternatives including biometric checks, behavioral analytics combined with other methods, ongoing verification during high-risk account actions, and user security education. Citing studies by identity-verification provider Socure, the passage claims that passive, risk-based evaluation of submitted personal information improved approval rates for legitimate applicants who failed KBA while identifying suspicious identities that KBA had allowed, presenting modern, adaptive identity proofing as a means to reduce fraud and improve user access.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.