Rethinking Device Trust: A Global Perspective

For years, a recognized device helped financial institutions answer a relatively straightforward question: Is the person attempting to access the account likely to be the enrolled customer? That question still matters, but on its own, it is no longer sufficient. A genuine customer can use a familiar, recognized device, pass authentication, and authorize a transaction while a fraudster actively manipulates or coerces them. A second scenario involves a fraudster who gains unauthorized access using stolen credentials and socially engineered one-time passcodes. The authentication may succeed, but the device, application environment, network, or session behavior may reveal signs of compromise. At the same time, legitimate device changes, browser privacy controls, and fragmented channel data can make a good, known customer look unfamiliar and elevate risk. 

Financial institutions do not need more isolated signals. They need durable, explainable device continuity embedded in a process that continuously reassesses risk associated with the customer, session, behavior, transaction, network, and intent. Trust in a customer or device cannot be permanent, especially in a rapidly evolving fraud and scam landscape. For financial institutions, the device has become one of the most important sources of trust across the entire customer journey.

Foreword 

This Javelin Strategy & Research report, sponsored by BioCatch, explores why device intelligence has become a critical component of a modern fraud tech stack for financial institutions. It examines the ever-growing risks present throughout the customer journey. It identifies real-world examples of where financial institutions lose confidence in identity across sessions, devices, and channels, and the consequences of not establishing identity and device certainty.