Identity for Financial Services

The job identity does in financial services

In financial services, identity is a regulated control, not a convenience feature. The system has to prove the customer is who they claim, that a transaction is legitimate, and that the institution holds a defensible audit trail when a regulator asks. It spans customers, employees, support agents and contractors with access to money-moving systems, and the non-human identities behind trading, settlement and APIs.

Fraud and regulation demand friction; customer experience demands none. The answer is authentication that is strong but mostly invisible, with step-up authentication only when risk rises.

Financial services accounts for 3 of the 123 incidents in the Identity Breach Database (2.4%). Together they reached about 15.2 million people. Two failed at authentication and one at the identity lifecycle, and none needed malware or a software vulnerability: a phone call, a former employee and reused passwords were enough.

The identity threat picture, from the incident record

A phone call to support. On 3 November 2021 an attacker socially engineered a Robinhood customer support employee by phone and reached customer support systems. Robinhood said the attacker took email addresses for about 5 million people and full names for about 2 million others, then demanded an extortion payment. See vishing and help desk social engineering.

Access that outlived employment. On 10 December 2021 a former Block employee downloaded Cash App Investing reports containing names and brokerage account numbers. Block's SEC 8-K said the person had regular access in their past job but used it after employment ended; about 8.2 million customers were contacted, and a $15 million class settlement received final approval in 2025. This is orphaned account abuse, a deprovisioning failure rather than an authentication one.

Credential stuffing against customer accounts. Between 6 and 8 December 2022 attackers logged into 34,942 PayPal accounts with reused passwords, exposing names, dates of birth and Social Security or tax ID numbers. New York DFS fined PayPal $2 million in January 2025, finding it had not required MFA or used controls such as CAPTCHA and rate limiting. See credential stuffing.

Service accounts in bank tenants. Outside the sector tally, a 2026 password spraying campaign against Chilean Microsoft 365 tenants aimed at major banks compromised seven accounts, all functional or service accounts with no MFA and default or never-rotated passwords. The Snowflake credential attacks show the same pattern at scale.

The regulatory floor

• New York: NYDFS Part 500 is the most prescriptive identity rule in US finance. DFS's MFA factsheet says that from 1 November 2025 covered entities must use MFA "for any individual accessing any of its information systems, regardless of location, type of user", unless the CISO approves equivalent controls in writing or a limited exemption applies. The factsheet also calls SMS codes weaker because of SIM swapping. Section 500.7 adds access reviews and privileged account limits, and Class A companies need a PAM solution. The next annual certification is due 15 April 2027.
• US federal: The FTC's GLBA Safeguards Rule at 16 CFR 314.4(c)(5) requires MFA "for any individual accessing any information system" at non-bank financial institutions, unless the Qualified Individual approves an equivalent control in writing. For banks, the FFIEC's Authentication and Access to Financial Institution Services and Systems (August 2021) replaced the 2005 internet banking guidance and its 2011 supplement, and explicitly covers customers, employees, third parties and service accounts. Amended SEC Regulation S-P requires an incident response program and customer notice within 30 days; smaller entities had to comply from 3 June 2026.
• Cards: PCI DSS v4 extends MFA to all access into the cardholder data environment; the PCI SSC FAQ on single-factor passwords describes users entering the CDE "via MFA". See identity controls for PCI DSS.
• EU: PSD2 SCA requires two independent factors plus dynamic linking of the authentication code to amount and payee. DORA has applied since 17 January 2025, making strong authentication, least privilege and privileged access monitoring explicit duties; the next register of information on ICT third parties is due 31 March 2027 (see identity controls for DORA). The AML Regulation applies on 10 July 2027, including remote onboarding with eIDAS electronic identification, and regulated private relying parties must accept the EU Digital Identity Wallet by 24 December 2027.

The identity controls that matter most

1. MFA on every account, human and service. PayPal and the Chilean service accounts both failed for lack of it, and NYDFS and the Safeguards Rule now require it for any individual on any system. See MFA rollout.
2. Phishing-resistant MFA and call-back verification for support staff. Robinhood started with a phone call. Phishing-resistant MFA removes codes a caller can extract, and resets should never be satisfiable with personal details alone.
3. Credential stuffing defenses on customer login. Breached-password screening, rate limits, bot detection and risk-based authentication are what DFS named as missing at PayPal. Offer passkeys to remove the password from the equation.
4. Deprovisioning tied to HR events, everywhere. Cash App's failure was access to reports after termination. Automate joiner-mover-leaver through SCIM, including reporting and export tools, and use the secure offboarding checklist.
5. Limits on bulk export from support and reporting tools. Cap what one session can pull and alert on volume.
6. Privileged access to money-moving systems. Vaulting, session recording and just-in-time elevation; see implementing PAM.
7. Evidenced access reviews. Access certification and segregation of duties with exportable evidence; the access review checklist and IAM audit preparation guide help.

Workforce vs customer identity

Vendor shortlist

• Workforce identity: Microsoft Entra ID, Okta or Ping Identity; see best identity tools for financial services.
• Customer identity and fraud: Transmit Security, Auth0 or Ping Identity; see best CIAM for fintech.
• Verification: Persona and Socure.
• Privileged access: CyberArk (Idira); see best compliant PAM platforms.
• Governance: SailPoint or Saviynt; see best compliant IGA platforms.
• Service accounts and legacy MFA: Silverfort.
• Phishing-resistant hardware: Yubico; compare methods in the MFA matrix.

Narrow a shortlist with the vendor selector, and see top 5 IAM for financial services.

Common pitfalls

• Fraud and identity run as separate systems, so risk signals are missing at decision time.
• Relying on SMS OTP, which DFS itself describes as weaker because of SIM swapping.
• Service accounts and reporting tools left out of MFA and deprovisioning.
• Access reviews performed but not evidenced for regulators.

Where it is heading

NYDFS universal MFA and DORA have made good practice an enforced baseline. EU AML rules in July 2027 and wallet acceptance in December 2027 push reusable, verified identity into onboarding, while passkeys replace passwords on customer login.

Frequently asked questions

Does NYDFS Part 500 require MFA for all users?

Yes. Since 1 November 2025, section 500.12 requires MFA for any individual accessing any of a covered entity's information systems, unless the CISO approves reasonably equivalent controls in writing or the entity qualifies for a limited exemption.

Does the GLBA Safeguards Rule require MFA?

Yes, for non-bank financial institutions under FTC jurisdiction: 16 CFR 314.4(c)(5) requires MFA for any individual accessing any information system, with a written exception path.

What caused the PayPal 2022 incident?

Credential stuffing. Attackers reused passwords from other breaches against 34,942 accounts; DFS found PayPal had not required MFA or used CAPTCHA and rate limiting.

Is the FFIEC authentication guidance a regulation?

No. It is 2021 supervisory guidance that stresses risk assessment and names MFA, or controls of equivalent strength, as effective.