The account is the target
Not the network, not the data centre. Account takeover is the attack, it arrives through the customer rather than through your perimeter, and it succeeds at the weakest step of the journey.
Insurance & Banking
Assurance has a price list, and somebody else wrote part of it
Financial services is the one sector where how much proof you demand is partly set by a regulator, partly by a fraud team, and entirely visible to a customer who will move to a competitor if you get it wrong.
Two sectors, one uncomfortable position
Both sit between a customer who wants immediacy, an intermediary who wants autonomy, and a regulator who wants evidence.
Somebody else does the selling
Brokers, agents, tied intermediaries, correspondent institutions. A large share of transactions is initiated by a person who works for a different company than the one holding the risk.
The core system is not moving
Policy administration and core banking platforms are decades old, business-critical and untouchable. Whatever modernises the customer experience has to sit in front of them.
Insurance
The person acting is rarely the person insured
A broker files the claim, an agent amends the policy, a family member calls on behalf of a parent. Identity here is less about authentication than about establishing on whose behalf somebody is acting, and with what authority.
Acts
Broker or agent
Employed by an independent firm. Authenticates as themselves, in their own organisation.
Is represented
The policyholder
May never log in at all. Their consent, their data, their claim — and their right to withdraw it.
Holds the risk
The insurer
Answerable for every action taken in its systems, including the ones it did not perform.
Delegated authority has limits, and they change
What an intermediary may bind, amend or settle is defined by an agreement that is renegotiated. The system has to enforce the current version, not the one configured at onboarding.
Acting on behalf of has to be recorded
Every action needs both identities in the trail: who performed it, and for whom. Reconstructing that after a dispute is the expensive way to find out it was not captured.
Claims are where fraud concentrates
It is the moment money leaves. Assurance and antifraud signals belong at that step specifically, not spread evenly across a portal most people use to download a certificate.
Banking
What each action should cost the customer
Applying the same authentication to every action is how you end up with a login nobody can face and a payment step an attacker walks through. The list below is the design.
ActionWhat is at stakeWhat to ask for
Check a balanceInformation only, already on the deviceNothing. A live session is enough.
Download a statementPersonal data leaving the platformThe session, plus a check that it is still fresh.
Add a payeeSets up every future transferA phishing-resistant factor. This is the step attacks aim at.
Pay a known payeeMoney moves on an established railUsually nothing extra. The trust was established when the payee was added.
Pay a new beneficiary, high valueIrreversible, and the classic fraud outcomeTransaction signing bound to the details being approved.
Change contact detailsQuietly redirects every future notificationA phishing-resistant factor, and a notification to the old address.
Notice the fourth row. Paying a known payee asks for less than adding one — because the expensive check already happened, at the step that actually decided the outcome.
How Monokee approaches it
Assurance bound to the action, not to the front door
A flow per transaction type
Journeys are attached to an application, an API or a single operation, so the ladder above is configuration rather than logic compiled into the banking front end.
Intermediaries in their own domain
Brokers and agents administer their own people within limits you set, and act on behalf of customers with both identities carried through to the record.
In front of the core, not instead of it
The platform sits ahead of policy administration and core banking, so the customer experience can change on a timescale the core system will never support.
Bring us the transaction your fraud team argues about
There is always one where security and the product team disagree. It is the most useful place to start a conversation about assurance.
Talk to an expert