According to Riskified, losses from account takeover increased 122% from 2016 to 2017 and grew by 164% in 2018. This percentage is expected to be even higher by the end of 2019. In this environment, it is critical that companies find a way to secure credentials. At the same time, however, users are demanding a seamless online experience and companies are in a difficult position trying to address ATO without introducing login friction.
Two-factor authentication (2FA) is an example of an authentication technology that most people simply do not want to use. If given the choice, many prefer not to implement it at all—for example, fewer than 10% of Google users have signed up for 2FA to protect their Google accounts. It’s clear that 2FA will need to evolve in order to meet companies’ competing priorities of security and a low friction customer experience.
There are other authentication alternatives for companies besides 2FA, that can alter friction at login:
So, how can organizations get a handle on the authentication situation and achieve the holy grail of low friction and robust security?
At Enzoic, we believe the most critical step is ensuring password security without adding a lot of login friction. With our credential and password screening products, users’ credentials are compared against our continuously updated database of exposed username and password pairs. Because this process happens behind the scenes, it has zero impact on the customer experience if the credentials have not been compromised.
If it’s determined that a user’s credentials have been exposed, companies can take a range of actions—for example, requiring an additional authentication factor or forcing an immediate password reset.
We believe that credential screening provides organizations with an unparalleled ability to truly evaluate risk at login. It’s a known fact that people frequently reuse passwords across multiple sites in both their personal and professional lives and other authentication solutions will ultimately fail to protect the account if the credentials themselves are not secure. This, coupled with users’ demand for a frictionless experience, make credential screening of paramount importance in the current landscape where breaches happen on a daily basis.
Protecting accounts without introducing login friction is a complex problem. Various methods of authentication may be appropriate based on industry, perceived risk-level and a variety of other factors. But it’s critical that companies include credential or password screening in their security arsenal to ensure security at the password layer.