AI has changed the rules of fraud – it’s time to rethink digital identity

AI has reduced the cost of executing fraud attacks against knowledge-based authentication — passwords, PIN codes, SMS OTPs — to near zero. Voice cloning, real-time phishing relay kits, and deepfake document generation are now production-grade tools available to any attacker. The only authentication controls with structural resilience against AI-enabled attacks are possession-based: something the user physically holds, verified at the device or network layer, with no credential that can be stolen, replicated, or socially engineered.

The scale and sophistication of these attacks are growing far beyond what traditional defenses – or human intuition – can handle. That’s why organizations are beginning to turn to stronger, possession-based forms of security that remove the human from the fraud equation.

AI is breaking traditional models of fraud and identity

With the rise of AI-based fraud, traditional models of online identity and fraud defense no longer work. AI completely changes the game, introducing new vulnerabilities and attack surfaces:

1. Bypasses legacy authentication – KYC, Knowledge factors, Voice, Video
2. Multiplies attack volume – anyone can now use AI tools to be a hacker
3. Brings new Agentic fraud risk – how can we trust AI agents?

This post outlines how new mobile possession factor technology can solve all of these issues and become a key element of modern security that is vital to protect against current and future AI-driven attacks.

Mobile as a primary attack surface

Already today, over 80% of phishing attacks now target mobile devices.

The world is going mobile, and the mobile phone is becoming the primary computer (already over 60% of internet traffic comes from mobile devices). More than just a computer – the mobile is becoming your identity. We already use our mobiles to pay instead of credit cards; you no longer call a company switchboard or a home number, you call the person. Our travel tickets are in our mobile wallet. Soon our driving licences and other identity documents will be there too. And as we start to adopt agent-based commerce, many of the agents and transactions will run on our phone.

These changes make it increasingly vital that we have complete trust in the mobile device and that a chain of trust exists between the owner, their online account and the device in their hand.  

In this new world of AI, traditional online identity models that use email, password, SMS PIN codes to verify mobile number and device ownership are no longer fit for purpose. A new approach is urgently needed.

Solution 1 – Knowledge and Biometrics are compromised – move to Possession factor security

Passwords can be guessed, stolen, or phished. Documents can be faked and even biometrics can be spoofed. Knowledge-based questions are easily bypassed when criminals can scrape personal details from breached data or social media. 

The magic triangle of factors relies on:

• Knowledge – passwords, PIN codes, passkeys*
• Biometrics – face, voice, fingerprint
• Possession – physical documents, mobile device, SIM card, security dongle

*Mainstream passkeys (Google, Apple, Microsoft) sync via the cloud and are not tied to a specific device — making them closer to a knowledge factor in practice. See the FAQ below.

AI has now compromised knowledge factors, biometric factors and physical documents.

What is left is secure digital possession factors – the only factor with real resilience against AI attacks is encrypted, digital possession factors, something the user physically holds, like their mobile phone.

Solution 2 – Eliminate the risk of “human-in-the-loop”

Now that AI provides powerful, easy to use tools, anyone can be a hacker, which means many more attacks. Faced with this – it is vital to protect against the biggest and most easily targeted vulnerabilities, and that is – people. We are the weak link!

Most current defenses rely on the human being part of the security model – we have to do the right thing to ensure fraud can’t happen – spot the suspicious email, type the SMS code, verify the caller’s voice, don’t share the PIN code or click the wrong link. But humans are fallible, and when AI-generated content looks and sounds real, even the savviest users will be tricked. Relying on users to detect fraud is no longer viable. We need to remove the human from the security chain.

The strongest defense against AI-driven fraud is to authenticate users based on something they physically possess and cannot unknowingly give away. That’s where embedded mobile possession-factor security comes in.

New technology is now available that allows you to securely and silently verify the SIM card in the mobile device. This check happens directly with the mobile network over a secure, encrypted connection, in real-time. There is no user involvement. It provides strong, phishing-resistant proof of possession.

• Universal: Everyone has a mobile phone. Every phone has something cryptographically secure embedded in it – the SIM card.
• Invisible: Users don’t have to do anything, eliminating the risk of phishing or missteps.
• Deterministic: A Yes/No verification in real-time, directly from the mobile network. No guesswork.

By anchoring authentication to a possession factor that AI cannot fake, businesses can eliminate the risk of human-in-the-loop and block fraud before it happens.

Solution 3 – Extend a Secure Chain of Trust to include Mobile + Agents

Agentic commerce is being created and deployed at a simply incredible pace. Visa, MasterCard, Stripe, OpenAI and others have all launched Agentic Commerce solutions. While the prospects are very exciting, this also brings a whole wave of new risks.

Agentic Commerce – where AI agents make purchases or financial decisions on behalf of users – introduces new fraud risks because it becomes harder to prove who is truly behind each transaction. Without strong identity links, malicious actors or AI-driven fraud systems can impersonate users, hijack agent sessions, or inject fake identities into the network. By establishing a secure chain of trust that connects the user’s verified digital identity to their physical SIM card and mobile device, and ultimately to the Agent app, each action can be cryptographically tied to a real, authorized individual – significantly reducing the risk of impersonation, account takeovers, and synthetic identity fraud.

Mobile Possession Factor security is a key foundation for trust in this new AI-driven world

The shift from knowledge-based to possession-based security is not just a technical upgrade, it’s a strategic necessity in an era of AI fraud. Banks, Payment providers, eCommerce platforms and every large enterprise need to upgrade and modernize their authentication models now, to be prepared for the inevitable AI attack that is sure to come, and sooner than you think. 

Mobile possession-factor security offers a way forward: stronger protection, seamless user experience, and fraud prevention that scales as fast as the threats.

Learn more about how IDlayr helps businesses fight AI fraud.

About the author: Paul McGuire

Paul McGuire is CEO of IDlayr. He has spent over two decades at the intersection of mobile, telecoms, and digital identity. He works directly with banks, payment platforms, and large consumer apps deploying Silent Network Authentication to replace SMS OTP, eliminating ATO and SIM Swap fraud risk. He has held senior leadership roles across mobile and technology businesses in the USA and internationally.

How is AI changing fraud attacks?

AI has made phishing, voice scams, and identity fraud faster, cheaper, and more convincing. Phishing volumes increased 400% in early 2025 (Gen Digital Q1 Threat Report). Over half of fraud cases now involve some form of AI (Feedzai). Voice cloning takes 30 seconds of audio. Deepfakes can bypass live-selfie KYC. The marginal cost of a sophisticated attack has fallen to near zero.

Why does AI break SMS OTP security?

SMS OTP relies on a human correctly identifying a legitimate authentication request and entering the code only on the real site. AI can now deliver pitch-perfect fake callers, in any language, 24 hours a day, to socially engineer victims into providing the OTP code. AI-powered phishing relay attacks automate the interception in real time — the attacker’s server forwards credentials to the real site, the OTP is sent, the user enters it on the fake site, and the attacker forwards it before it expires. The entire flow takes under 90 seconds.

What is phishing-resistant authentication?

Phishing-resistant authentication is any mechanism that does not rely on the user transmitting a secret. SNA is phishing-resistant because there is no code for the user to read or enter — the check happens server-side, between the enterprise and the mobile network operator.

Why can’t AI defeat possession-based authentication?

Possession-based authentication requires physical access to a specific device or SIM card. AI can replicate knowledge (passwords, OTPs, security questions) and biometrics (faces, voices, documents) at scale. It cannot physically possess someone’s SIM card or device. That structural distinction is what makes possession-based controls resilient as knowledge-based controls degrade.

What is the difference between knowledge-based and possession-based authentication?

Knowledge-based authentication (passwords, PINs, OTPs, security questions) relies on information the user knows — information that can be stolen, guessed, phished, or replicated. Possession-based authentication relies on something the user physically holds: a specific SIM card or device. AI can break knowledge factors at scale. It cannot replicate physical possession.

How do I protect my business from AI-enabled fraud?

The most effective response is to remove human-mediated steps from authentication and replace them with possession-based controls. Silent Network Authentication verifies mobile identity at the network layer without any user action — there is nothing for an AI-powered attack to phish or intercept.

What is a SIM-based possession factor?

A SIM-based possession factor uses the cryptographic relationship between a SIM card and a mobile network to verify a user’s identity. The SIM is physically present in the user’s device and cryptographically bound to the mobile network — a binding running silently for 5 billion users since the 1990s. Silent Network Authentication exposes this as an API.

How does Silent Network Authentication resist AI fraud attacks?

SNA makes no request of the user. There is no credential to phish, no code to intercept, no voice to clone, no document to fake. The check is a silent API call between the business and the mobile network operator. An AI-powered attack has no surface to operate against because there is no human-mediated step to exploit.

What is the difference between SNA and passkeys?

Passkeys replace passwords (a knowledge factor at the app layer). SNA verifies the physical SIM card in your device directly with the mobile network — a true, carrier-verified possession factor. They are not competing technologies; they protect different stages of the user lifecycle.

Are passkeys knowledge or possession?

Mainstream passkeys — as deployed by Google, Apple, and Microsoft — sync across your devices via the cloud, which means they are not tied to any specific physical device. That makes them closer to a very long, very strong password stored in a password manager: a knowledge factor, not a true possession factor. A device-bound passkey (stored only on one piece of hardware and never backed up) is a genuine possession factor — but that is not how most consumer passkeys work today.

Do passkeys replace SNA?

No. Passkeys replace passwords; SNA replaces SMS OTP. They operate at different stages of the user journey and neither does the other’s job.

If I already have passkeys, why do I need SNA?

Three specific problems arise in any passkey deployment — and SNA resolves each one. First, initial device trust: SNA verifies the SIM belongs to the legitimate user before the passkey is issued, blocking attackers from registering fraudulent passkeys. Second, SCA compliance for banks: synced passkeys cannot prove the user held a specific device at authentication time, creating a PSD2 possession-factor ambiguity that SNA’s carrier-level verification resolves. Third, secure recovery: when a user loses their device, SNA re-establishes trust on the new device without an SMS OTP fallback.