Authentication is the process of verifying that a person, device or system is who or what it claims to be. A user claims an identity, for example by typing a username or presenting a card, and then proves it with evidence such as a password, a code from a phone or a fingerprint. Banks, payment firms, merchants and crypto platforms authenticate customers at login and before risky actions, and authenticate staff, machines and partner systems in the background.
Authentication is often confused with two neighbouring ideas. Identity verification (IDV) establishes who a person really is, usually once at onboarding as part of know your customer (KYC) checks; authentication then confirms, at each later visit, that the same person has returned. Authorization comes after authentication and decides what the verified user may do. Together with logging, the three form the basis of access control.
Authentication in plain terms
At an airport gate, the agent checks your boarding pass and looks at your passport photo. The boarding pass shows you have a seat; the passport and your face prove it is really you holding it. Only then do you board.
Online, the website cannot see your face, so it asks for proof that only you should have: something you remember, something you carry, or something you are. Asking for two different kinds at once is much safer, because a thief who learns your password still lacks your phone, and one who steals your phone still lacks your fingerprint.
Authentication factors and methods
Evidence of identity is grouped into three factor types:
- Knowledge. Something the user knows: a password, a personal identification number (PIN) or answers to security questions, which is the basis of knowledge-based authentication (KBA).
- Possession. Something the user has: a registered phone receiving a one-time password (OTP), a hardware OTP token, a bank card with a chip, or a security key.
- Inherence. Something the user is: a fingerprint, face or voice checked through biometric authentication.
Using two or more different types is multi-factor authentication (MFA); the common two-factor form is two-factor authentication (2FA). Many systems also weigh passive signals, such as a known device, a digital fingerprint of the browser or a usual location, and ask for more proof only when something looks unusual. Passkeys, based on standards from the FIDO Alliance, replace passwords with a key pair stored on the user's device and unlocked by a fingerprint, face or PIN. Because the device will only sign a login request for the genuine website, passkeys resist phishing in a way that typed codes do not.
In the United States, NIST's Digital Identity Guidelines (SP 800-63-4, finalised in July 2025) define three authenticator assurance levels, from single-factor at level 1 to phishing-resistant, hardware-backed authentication at level 3, and accept syncable passkeys. The guidelines are mandatory for federal agencies and widely used as a benchmark by banks and fintechs.
Authentication in banking and payments
Payments add specific rules. In the European Union and the United Kingdom, strong customer authentication (SCA) under PSD2 has required two independent factors for most electronic payments and account logins since 14 September 2019, with exemptions for low-value and low-risk transactions; for card-not-present (CNP) purchases this is usually done through 3-D Secure (3DS). At the shop counter, the EMV chip proves the card is genuine by generating a one-time cryptogram, and the PIN verifies the cardholder. The wider topic of how payments are confirmed is covered in payment authentication.
US rules are less prescriptive. The FFIEC's August 2021 guidance asks banks to base authentication on risk assessments, names multi-factor authentication, or controls of equivalent strength, as an effective way to reduce the risk of unauthorized access, and covers employees, third parties and service accounts as well as customers. The FTC's Safeguards Rule requires MFA for anyone accessing customer information at non-bank financial institutions. Behind the scenes, systems authenticate one another as well: a bank API may require a client certificate over mutual Transport Layer Security (TLS) before it accepts any request.
Weaknesses and attacks
Each method has known weak points. Passwords are reused and leaked in breaches, and answers to security questions can often be found online, which also fuels identity theft. Codes sent by text message can be intercepted through SIM swapping. Phishing kits now relay codes in real time: the victim types an OTP into a fake bank page and the criminal uses it within seconds. Social engineering callers persuade customers to read codes aloud or approve push notifications, and repeated push prompts can wear users down until they tap "approve". Biometrics are hard to steal but cannot be changed if copied, and voice and face checks face growing pressure from synthetic media.
The common result is account takeover (ATO). Defences combine phishing-resistant methods such as passkeys and hardware keys, device binding, behavioural monitoring, clear wording in authentication messages ("You are paying £500 to …"), and stronger checks when risk rises, such as a new payee, a new device or a large transfer.