From
Ideem— device-bound passkeys and A2A payment authentication for banks, fintechs, and payment platforms.
Call center authentication has been running on borrowed time. The mother's maiden name, last four of the SSN, the address from two moves ago, the security question about a pet — the entire knowledge-based authentication (KBA) stack assumed the customer knew things the attacker didn't. That stopped being true around the 2017 Equifax breach. The 2024–2025 wave of generative AI voice attacks has finished the job. The attacker now sounds like the customer, knows what the customer knows, and can pass the identity check at a price point that scales.
The fix isn't more KBA or longer scripts. It's to take the trust decision off the call entirely and put it on the customer's enrolled device. The agent (or the IVR) triggers a passkey signature on the phone the customer is already carrying. The cryptography either succeeds or it doesn't — and no amount of synthetic voice gets a fraudster across that line.
The most-cited number right now comes from Pindrop's 2025 Voice Intelligence & Security Report: deepfake call attempts rose 1,300% in 2024, jumping from roughly one synthetic call a month to seven per day across Pindrop's customer base. The same report measured contact center fraud at its highest level in six years and put the 2024 industry-wide loss at $12.5B, with a 2025 projection of another 162% increase and total exposure approaching $44.5B.
Hiya's Q4 2024 Global Call Threat Report told the consumer-side version: 31% of U.S. consumers, 27% of Canadians, and 26% of U.K. consumers reported encountering a deepfake fraud call in the prior quarter. Average reported U.S. loss per victim was $539 — but the long tail is where the damage sits, with deepfake calls producing significantly more victims above $6,000 than traditional phone scams.
Bank-specific numbers are harder to find publicly, but where they have surfaced they are striking. A 2024 Regula study (cited in Reality Defender's published research) puts the average financial-services voice deepfake incident cost at roughly $603,000, with 23% of surveyed firms reporting average losses above $1M. McAfee Labs' research found that three seconds of recorded audio is now enough to produce an 85% accurate voice clone, and that 70% of consumers in McAfee's global survey were not confident they could tell a cloned voice from a real one. None of the technology is exotic — most of the generators McAfee tested are free or low-cost trials.
KBA failed for reasons that compound. The breach economy commoditized the answers — mother's maiden name, address history, prior employers are all available in bulk on underground markets at prices low enough that fraudsters use them as routine inputs. The 2017 Equifax breach put roughly the entire U.S. adult population's KBA dataset into circulation, and the breaches haven't stopped.
The deeper failure is that KBA was always an authentication of facts, not people. The system can't tell whether the person on the line who knows the answers is the customer or is reading them off a screen. When that person also sounds like the customer — because a deepfake generator has produced the voice from a thirty-second LinkedIn clip — the agent has nothing left to anchor a decision on. FFIEC interagency authentication guidance has been explicit since 2021 that knowledge-based questions used alone are no longer sufficient for high-risk activities, and the supervisory direction in 2025–2026 has hardened around that position.
Voice biometrics on its own is also no longer a complete answer. Voiceprints remain a useful signal, but the generative models producing the deepfakes are improving fast enough that voice-only liveness is now an arms race. Pindrop's Pulse system reports 99% deepfake detection in two seconds — the detection tooling works — but no fraud leader should design a 2026 control regime around a single detection signal staying ahead of a model release cycle that ships every few weeks.
The pattern that works in 2026 takes the trust decision out of the call and puts it on a device the bank has already cryptographically enrolled. The flow is simple. A customer calls. At the moment identity verification is required — in the IVR or after transfer to an agent — the bank's auth system sends a passkey challenge to the customer's enrolled device. The customer approves with a device biometric, and the device returns a cryptographic signature bound to the bank's origin.
Three properties make this work where KBA failed:
The customer experience is faster than KBA, not slower. Banks replacing KBA with push-to-passkey report meaningful reductions in average handle time — the agent no longer walks through three or four challenge questions and escalates when the customer says "I don't remember." It's a single device prompt that completes in under five seconds.
For bank fraud and security leaders evaluating the move, four questions narrow the decision quickly.
Not every call needs cryptographic step-up. The first cut is to identify flows where a successful impersonation causes material loss — wire transfers, beneficiary updates, payee additions, address-of-record changes, debit card reissue to a new address, and account recovery. These are where push-to-passkey delivers the highest return and where retiring KBA is overdue.
Push-to-passkey requires the customer to have enrolled a passkey on a device the bank can reach. Banks that have rolled out passkeys for online and mobile have most of the work done — the same credential applies. Banks earlier in their program should sequence the call-center rollout behind a baseline enrollment campaign, with KBA available as fallback for unenrolled customers during the migration window. That fallback should be measured and reduced on a defensible timeline, not left open indefinitely.
Call-center authentication lives or dies in the agent's tooling. A deployment that requires the agent to switch applications and copy a customer ID into a separate console will underperform on adoption. The integration target is a one-click verification request from inside the primary CRM, with the response surfaced back to the same screen.
Customers will occasionally be unable to complete a prompt — phone is dead, calling from a landline, or the device is lost. The fallback should be a separately gated path with stronger verification (in-branch visit, video KYC, or a manager-approved process with elevated logging), not a "default to KBA" backdoor. The minute the fallback becomes the easy path, fraudsters route the calls there.
The headline 2024–2025 incidents show why recognition or knowledge-based verification can no longer be load-bearing. Arup, early 2024: a Hong Kong finance employee executed 15 wire transfers totaling roughly $25.6M after a video call with what appeared to be the CFO and colleagues — all deepfakes. March 2025, Singapore: a $499,000 transfer authorized after a Zoom call where every face and voice was synthetic.
Neither was a call into a bank contact center — they were corporate fraud. But the threat model is identical. A synthetic voice paired with breached PII and a plausible story defeats any verification step that depends on recognizing a person or trusting a shared fact. The same playbook runs against bank call centers every day. A journalist demonstrated this in 2025 by cloning her own voice from public audio and using it to pass both her bank's IVR and a five-minute call with a live agent.
The regulatory direction is unambiguous. FFIEC, OCC, and international regulators have all signaled that KBA on its own is no longer a defensible control for high-risk activities, and the 2026 supervisory tone has continued to harden. The FTC's Impersonation Rule is in active enforcement against AI-enabled fraud, and the FCC's February 2024 declaratory ruling made clear that AI-generated voice calls fall under TCPA's existing robocall restrictions. Banks still anchoring call-center identity verification on KBA are out of step with both their regulators and their attackers.
The migration isn't a multi-year program. Push-to-passkey can be deployed in the highest-risk flows in a single quarter when the underlying passkey infrastructure is already in place. Banks that invested in passkey enrollment for online and mobile in 2025 and early 2026 have already paid most of the cost — extending it into the contact center closes the channel fraudsters have been migrating into as the digital channels have hardened.
Ideem's Passkeys+ supports push-to-passkey as a first-class call-center workflow. The platform exposes a verification API the agent desktop (or the IVR) can call to trigger a passkey signature on the customer's enrolled device, with the response returned to the agent's screen in seconds. The same passkey infrastructure the bank uses for online and mobile is reused — no separate enrollment, no parallel directory.
For high-value call-driven actions, Passkeys+ supports transaction binding — the agent's verification request includes the specific transaction details (amount, beneficiary, account), and the customer's signature is bound to those details. A fraudster who somehow intercepts the prompt cannot redirect the signed transaction; the signature only validates the exact action shown to the customer at the moment of approval. For banks operating under SAMA, RBI, MAS, QCB, or FFIEC supervisory regimes, the audit trail from transaction-bound passkey verification is materially easier to defend than the audit trail of a KBA decision. Passkeys+ is also provider-agnostic across Apple, Google, Microsoft, 1Password, Dashlane, and hardware keys, so the agent triggers one verification and the customer's device handles it regardless of the authenticator they chose.
The forward look is straightforward. Deepfake voice technology will keep improving, the generators will keep getting cheaper, and the gap between a real customer's voice and a synthetic one will keep narrowing. The banks that retire KBA on the call channel through 2026 and 2027 — replacing it with cryptographic, device-bound, action-bound verification — will be the ones writing the comfortable headlines. The ones that wait for a deepfake-driven loss to force the issue will be writing a different kind of report.
Most orgs running OTP-based MFA have 3–4 exploitable gaps they don’t know about. Our Authentication Assessment takes 2 minutes and shows you exactly where you stand — plus a phased migration roadmap.
Take the Assessment →Built by Ideem
Device-bound passkeys and A2A payment authentication. One SDK. No OTPs, no redirects.
Our 2-minute assessment scores your authentication setup and shows you exactly where the improvements are.
See Your Score →