Cheap, easy to deploy, and exploitative of human error (cybersecurity’s weakest link), phishing holds strong as the most common attack vector for digital identity fraud and a major challenge for fraud detection across digital banking in 2025. But the phishing landscape doesn’t look like it used to…especially for regional banks and credit unions.
Since the launch of ChatGPT in November of 2022, there has been a 4,151% increase in malicious emails (Figure 1), overwhelming traditional fraud detection tools. Convincing phishing is up 217% over the past year (Figure 2), and financial institutions are the top targets for this ramp-up in activity.
The tell-tale signs of a scam are less obvious, outreach is more personalized, and fraud detection at-a-glance isn’t as easy as it once was, meaning education is no longer cutting it as the primary defense against phishing.
Regional Banks & Credit Unions: Hackers’ Favorite Phishing Holes
With fewer fraud detection resources and more vulnerabilities than their big bank counter parts, regional banks and credit unions are good targets for digital identity fraud. In 2025, their highly digital nature opens the door for more opportunities of attack (Figure 3 & Figure 4).
We know phishing is the #1 tactic deployed by hackers as a means of digital identity fraud, and the data supports this trend, particularly when it comes to credit unions and regional banks, where we see a disproportionate share of login attacks compared to big banks. Regional banks report a 12% higher volume of cybersecurity incidents at login, exposing gaps in fraud detection coverage, while credit unions face login attacks at a staggering 52% higher rate, highlighting a need for stronger fraud detection mechanisms (Figure 5).
Make no mistake, hackers are phishing in your customer & member pools as we speak. In 2025, users will have a more difficult time spotting phishing than previously. Now, phishing resistant authenticators are emerging as the answer.
Phishing-Resistant Authenticators: The Gold Standard of Fraud Detection for Digital Banking
The Cybersecurity and Infrastructure Security Agency (CISA) calls phishing-resistant authenticators the gold standard for fraud detection and multi-factor authentication (MFA). It’s time to make sure phishing-resistance is a part of your fraud detection and prevention strategy. Let’s talk about why.
It’s time to make sure phishing-resistance is a part of your fraud detection and prevention strategy. Let’s talk about why.
How Phishing-Resistant Authenticators Strengthen Fraud Detection
Many phishing attacks are designed to lead users to a false access gateway, and these can be difficult to spot. Phishing-resistant authenticators function by cryptographically linking authenticators to the entry points they’re designed to unlock (Figure 6).
Here’s how it works:
- The authenticator passes credentials to a gateway with an encryption key, then
- The gateway uses its decryption key to reveal them.
- When a false access gateway doesn’t have the decryption key the authenticator is looking for, the authenticator won’t reveal its data…fraud detection alarm bells go off, and the credentials won’t work.
This real-time fraud detection mechanism has proven to be highly effective in fraud detection strategies, ensuring that authenticators catch phishing attempts — even when users don’t. In 2025, phishing-resistant authenticators have a huge role to play in an effective fraud detection and prevention strategy.
As with any other identity solution, phishing resistant authenticators are designed to work in conjunction with other solutions as a part of a comprehensive digital identity strategy. This is always the best approach to fighting digital identity fraud.
These are some phishing-resistant authenticators you might recognize:
- Okta FastPass, a device-bound passwordless authenticator
- FIDO2 WebAuthn authenticators (security keys)
- Device-bound FIDO2 WebAuthn authenticators (e.g. FaceID, TouchID, Windows Hello)
- PIV smart cards
- Hardware-based security keys (e.g., YubiKey)
Fraud Detection & Seamless Digital Banking: A Win-Win
The nature of identity-based technologies like phishing resistant authenticators performing fraud detection functions is such that security and experience mutually reinforce one another. i.e. phishing-resistant authenticators like Okta FastPass are designed to be as user-friendly as they are secure.
Phishing-resistant authenticators streamline fraud detection by reducing friction in the login process while enhancing security. Features like:
- Passwordless authentication
- Secure auto-fill capabilities
- Fewer account recovery steps
- Seamless integration with SSO solutions
… all contribute to a fraud detection strategy that doesn’t compromise user experience.
