Data breaches, compromised passwords, and hacked credentials

by Keir Breitenfeld 2 min read August 22, 2014

More than ever before, there may now be credence in the view that the majority of consumers’ personally identifiable information (PII), user names and passwords, and even some authentication tokens have been, or are, at risk of compromise.  Between sophisticated hacking schemes and regularly reported and sometimes unreported data breaches, those charged with implementing and maintaining identity authentication and management systems must assume this to be true.  In doing so, the need for layered authentication becomes readily apparent.  Layered authentication can mean many things to many people, but I would offer it up as diversifying authentication and risk assessment techniques and processes across multiple elements and attributes throughout the customer lifecycle.  These elements and attributes corresponding techniques can include:

  • traditional PII validation and verification
  • identity transaction link analysis and risk attribute derivation
  • credit and non-credit data and risk attributes
  • identity risk scores
  • knowledge-based authentication question performance
  • device intelligence and risk assessment
  • credentials
  • biometrics

and should be layered proportionally by inherent risk per application, addressable population, transaction history and types, current transaction, and access channel for example.  Industry guidance such as the FFIEC Guidance of Authentication in an Internet Banking Environment is a solid foundational direction that calls out the need for institutions to move beyond simple device identification — such as IP address checks, static cookies and challenge questions derived from customer enrollment information — to more complex device intelligence and more complex out-of-wallet identity verification procedures.  I would suggest that while this is a great start, it is by no means comprehensive.  Institutions across all markets, both private and public sectors, should be exploring all available services and technologies in an effort to reduce reliance on one or only a few methods of authentication and identity management.  Particularly, again, assuming that the one method an institution may rely on could be greatly weakened or without value if subject to mass compromise.

Make sure to read our Comply whitepaper to gain more insight on regulations affecting financial institutions and how you can prepare your business.

Learn more about how your business can authenticate consumers confidently.

Related Posts

Building for Bots in the AI Age: Separating Legitimate Agents From Fraudsters

See how NeuroID helps businesses distinguish legitimate AI agents from fraud bots, while Agent Trust verifies agent-initiated transactions.

October 29, 2026 by Laura Burrows
2026 Retail Banking Identity and Fraud Report 

Learn how banks can convert rising fraud investment into protection customers recognize, value and feel in our recent report. Read more!

October 28, 2026 by Laura Burrows
One Platform, Fewer Handoffs, Faster Decisions

The average credit union manages between 100-300 vendor relationships, and nearly a third have no dedicated staff managing them. What was supposed to drive efficiency is stunting growth and compromising the member experience. Application volume is continuing to rise, and consumers expect a loan decision at digital speed. But for credit unions, meeting that expectation isn't the only goal. They must also continue to make the right lending decisions while also prioritizing risk management. The institutions pulling ahead aren't the ones with the most tools. They're the ones that have turned credit, fraud and decisioning into a single, coordinated system. A single loan decision touches: Credit data Identity verification Fraud signals Decisioning logic Reporting Rarely does all of that live in one place. More often, it’s stitched together across separate platforms, each with its own contract and its own support line. When a credit view and a fraud view are generated separately, they must be reconciled instead of read together in the same instant. Every handoff is a place where a decision slows down and a signal gets missed. It's why a fraud pattern that would be obvious next to the credit file often surfaces only after the funds are already gone. Fragmentation also makes it harder to optimize lending strategies over time. When data, analytics and decisioning are disconnected, credit unions have less visibility into what's working, what's changing and where strategies need to be adjusted. An integrated decisioning ecosystem closes those seams by design, with credit, fraud and lending strategy running on one platform and accessed through a single Application Programming Interface (API). Identity and compliance capabilities can be an integrated decisioning flow. The data doesn't need to be reconciled after the fact because it was never separated in the first place. Stop overengineering, start removing friction When decisioning underperforms, the instinct is to build something more custom: a proprietary model, tighter segmentation, more configuration.  Custom modeling has its place for institutions with the scale and data to justify it. But often, for small or mid-sized credit unions, the bigger opportunity is a flexible decisioning strategy that uses a strong, continuously refreshed model. This shouldn't be either/or. The right approach gives credit unions a strong decisioning strategy today, with the ability to introduce more customized analytics and modeling as their needs evolve.  The same principle applies to strategy management: credit unions can gain greater control through self-service capabilities as they build a more sophisticated data science team.   That kind of flexibility is important as credit unions modernize their decisioning infrastructure. Research surveying more than 2,000 senior credit risk and fraud decision-makers across 11 countries found that organizations investing in unified platforms and modern infrastructure are moving faster and realizing the greatest Return on Investment (ROI).   As their needs evolve, credit unions can adjust decisioning strategies without introducing another layer of technology or relying on third parties to make every change. Until self-service is the right fit, choose a partner that understands what makes your credit union’s membership and risk appetite different from others.  Same member, same afternoon, faster answer Consider a credit union growing its auto and personal loan originations.  A member applies for an auto loan on Saturday afternoon. Credit data, identity and fraud signals are read together in a single real-time pass instead of separate reviews:  Most applications resolve immediately, approved or declined based on a more comprehensive view of the applicant. A smaller number are flagged for quick step-up verification and cleared within minutes. Only genuinely ambiguous cases reach an underwriter, who is working from one complete picture instead of reconciling multiple signals. The member has an answer before the weekend is over. The credit union books the loan before competitors even open on Monday. Built to scale This kind of process holds up today. However, the better test is whether it holds up eighteen months from now when application volume has grown, new products are live and the data flowing through the system looks nothing like it does right now. Future-proofing isn't only about handling more volume. It's about having room to be nimbler and make adjustments as quickly as the market changes. A credit union that relies on standard models within a decisioning strategy may want more customized analytics and greater control over its strategies tomorrow. Connect with us With more than three decades of credit expertise and one of the industry's largest data footprints, Experian helps credit unions do more than solve this year's friction. We're helping to build a decisioning foundation that scales, so growth becomes something the system absorbs, rather than something it must be rebuilt around. Explore More

October 21, 2026 by Zohreen Ismail

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe