- Traditional MFA based on SMS, TOTP (time-based codes generated by an app, which change every few seconds), or repetitive push no longer suffices against phishing, malware, SIM swap (the theft of a person's phone line to intercept their verification codes), and approval fatigue.
- Passwordless authentication reduces friction and lowers costs associated with account recovery, support, and resets.
- Adaptive authentication applies strong verification only when risk justifies it.
- Passkeys, FIDO2 (the open standard that makes them possible), and biometric authentication shift security from "what the user remembers" to "what the user has and is."
Every day, we leak, reuse, share, and sometimes forget and recover passwords through processes that are often weaker than the original login. There was a time when generating a good password was enough to solve the identity authentication problem. But what started as a solid defense gradually turned, over time, into operational debt.
For years, traditional MFA (multifactor authentication—that is, requiring a second proof beyond the password) tried to compensate for this problem with a second factor. It worked for a while, but soon the threats returned: attackers learned new techniques and evasion tricks. We call the symptom of this curve MFA fatigue or exhaustion. What does it consist of?
When a user receives too many notifications, codes, challenges, or verification steps, they start approving without looking. Not because they don't care about security, but because the system has conditioned them to accept interruptions. At that point, the control stops being a barrier and becomes noise. This is the signal for a new leap in innovation.
Passwordless authentication changes the starting point: instead of reinforcing a weak password, it removes the password from the flow and bases authentication on biometrics (i.e., fingerprint or facial recognition), cryptographic keys, devices, and contextual risk.
Traditional MFA has become easy to wear down
MFA was born to solve a real problem: the password alone was insufficient and needed to be reinforced with new filters. But not all filters have the same resistance. SMS, TOTP, and push notifications add a barrier, but they also open the door to known threats: SIM swap, real-time phishing, mobile malware, session theft, social engineering, and fatigue-based approval.
The problem, then, is not just technical. It's human.
If the user receives constant attacks, they are trained to trigger alerts as quickly as possible. But if the flow frequently interrupts legitimate operations without explaining the risk, they stop distinguishing a real alert from an annoying routine. The attacker, always attentive to operational exceptions, identifies and exploits this blind spot. Thus, a legitimate protection process becomes the weakest link in the entire chain of trust.
Control degrades when the user receives too many challenges: security loses precision and the experience loses trust.
SMS and TOTP-based mechanisms can still play a role as bridge technologies, raising the basic level of authentication while migrating toward more robust architectures. But considering them the final state of the authentication model is not enough. It's not about accumulating more verification factors, but about changing the paradigm: progressively reducing the attack surface that static passwords represent and basing access decisions on continuous trust signals.
Passwordless authentication has a direct business case
Authenticating without a password has a concrete operational impact. Maintaining a password system generates visible costs: resets, lockouts, account recovery, tickets, support calls, and abandonment during access.
But it also generates less visible costs: account takeover (when someone accesses with credentials that don't belong to them), repeated friction, loss of conversion, and engineering time dedicated to sustaining a weak credential. Eliminating the password reduces a significant portion of that operation.
The business case rests on four fronts:
- Fewer support tickets: fewer resets, lockouts, and forgotten password recoveries.
- Less account takeover: less exposure to leaked credentials, phishing, and reuse.
- Less recurring friction: the user doesn't have to remember, change, or recover keys.
- More operational continuity: security teams stop managing a credential that no longer works as a strong defense.
In financial services, gaming, sales, government, and background screening, changing this paradigm touches critical flows: login, account recovery, withdrawals, payments, credential issuance, and sensitive operations. A password system seems economical until you measure everything it forces you to sustain.
Adaptive authentication reduces friction without lowering control
There is a common mistake: thinking of authentication as a fixed door. If the user presents the correct credential, they enter; if not, they stay out. That model is too rigid for today's attacks, because a session can start with low risk and change when a new device appears, an improbable location, a sensitive operation, or an anomalous sequence.
What does adaptive authentication consist of? It works with risk scoring—that is, it assigns a score to each session based on its context. It doesn't demand the same effort from all users at all times: it evaluates the context and decides whether the flow can continue without friction, whether it needs an additional challenge, or whether it should block or review.
The most useful signals typically include:
- Device: history, integrity, recent changes, emulators, or anomalous signals.
- Location: geographic consistency, impossible speed, proxies, or unusual patterns.
- Behavior: interaction rhythm, action sequence, and deviations from history.
- Operation: amount, destination, sensitivity of the change, or type of action.
- Identity: prior confidence level, biometrics, liveness detection (confirming there is a real person, not a photo or video, on the other side), and verification events.
- Accumulated risk: combination of signals, not an isolated rule.
Static MFA interrupts everyone equally. That might seem more secure, but it often produces the opposite effect: more fatigue, more automatic approvals, and more pressure on support. Adaptive authentication, on the other hand, applies friction only where it belongs.
Biometrics and passkeys change the access architecture
Passwordless authentication relies on a fundamental technical shift: moving away from verifying shared secrets and toward verifying possession, presence, and context. Passkeys and FIDO2 use public-key cryptography: the private key remains on the user's device and is never shared with the service. This reduces exposure to phishing because there is no password to authenticate or reuse.
Biometric authentication, meanwhile, improves both experience and security when implemented with proper controls. It's not about saving a face as a simple replacement for a key, but about using biometrics as a local factor or as part of an identity architecture with liveness detection, device, and risk.
- Passkeys: reduce phishing and password reuse through cryptographic keys linked to the user's device or account.
- FIDO2: defines an open standard for strong authentication based on public-key cryptography.
- Biometric authentication: simplifies access and re-authentication when combined with presence and risk controls.
- Liveness detection: reduces presentation attacks with photos, videos, masks, or digital injection.
- Adaptive MFA: activates additional steps only when risk increases.
The transition is not just about changing the login screen, but about changing the trust model.
Implementation must migrate risk, not just credentials
Moving from legacy passwords to passwordless authentication requires an orderly migration.
It's not advisable to turn everything off overnight. Nor is it advisable to add passkeys on top of a weak account recovery process, because the attacker will go for the easiest path. Implementing these solutions involves reviewing the entire lifecycle: onboarding, login, recovery, device change, re-authentication, and deactivation.
A reasonable migration plan typically includes:
- Map critical flows: login, account recovery, sensitive operations, data changes, and device registration.
- Identify password debt: frequent resets, tickets, lockouts, abandonment, and abuse points.
- Introduce passkeys/FIDO2: start with users or flows where operational impact is high.
- Add biometrics where they add value: especially on mobile, sensitive operations, and account recovery.
- Close weak routes: review SMS, security questions, manual support, and email recovery.
- Apply adaptive risk: don't challenge everything; challenge when the signal justifies it.
- Measure adoption: activation, abandonment, tickets, fraud, login time, and retries.
- Design a secure fallback: passwordless recovery with sufficient evidence and traceability.
The fallback is the most underestimated point. Strong authentication with weak recovery is a reinforced door with an open window. If the user loses their device, changes phones, or needs to recover access, the flow must validate identity without reverting to easy questions, vulnerable SMS, or manual review without evidence.
Here, biometrics and identity verification once again become central.
Identity connects authentication and fraud prevention
Passwordless authentication shouldn't be isolated as something separate from other security systems: it becomes more powerful when connected to the rest. A passkey can confirm that someone possesses the gateway to data; biometrics can simplify access; scoring can adjust friction. But complete trust requires connecting identity, session, and risk.
At VU, we work on this layer through three capabilities: Verify, for identity verification and biometric onboarding; Authenticate, for authentication, MFA, and passwordless access; and Protect, for real-time fraud prevention.
In financial services, this impacts account opening, login, payments, transfers, and access recovery. In gaming, it impacts onboarding, withdrawals, and promotion abuse. In retail, it impacts purchases, financing, and user accounts.
VU ONE consolidates these capabilities on a single platform. The direction is clear: fewer shared secrets, less unnecessary friction, and more risk-based decisions. The password doesn't disappear because it's inconvenient—it disappears because it has ceased to be an inviolable proof of identity. That, at its core, is the meaning of frictionless security.
Schedule a demo
