The FFIEC authentication guidance, issued on 11 August 2021 as "Authentication and Access to Financial Institution Services and Systems", tells banks and credit unions how examiners expect them to manage who gets into accounts and systems: assess the risk of each kind of user and transaction, layer controls so no single one carries the load, use multi-factor authentication or controls of equivalent strength where single-factor with layering is not enough, and cover the call center and help desk as well as online banking. It replaced the 2005 internet-banking guidance and its 2011 supplement. For account takeover, the guidance is hard to apply because its controls sit in different systems run by different teams, and a takeover walks through several of them in an hour. Botminds' Account Takeover Fraud Prevention reads those systems together and records, for every case, which controls tied to the guidance failed and which worked.
Examples from the solution on this page are sample data on a fictional bank, Corvane National Bank. Quotations are from the guidance as distributed by the FDIC in FIL-55-2021.
What does the FFIEC authentication guidance require? Principles, not a checklist
Strictly, the guidance requires nothing new. It describes "examples of effective risk management principles and practices for access and authentication", and it says so explicitly.
"This Guidance does not interpret or establish a compliance standard for these laws or impose any new regulatory requirements on financial institutions."
FFIEC, Authentication and Access to Financial Institution Services and Systems, Introduction, 2021
That does not make it optional in practice. The guidance ties itself to standards banks are held to, the safety and soundness standard "to have internal controls and information systems that are appropriate to the institution's size and complexity" and the Interagency Guidelines Establishing Information Security Standards, and it is the document an examiner reaches for when a takeover reveals weak authentication. The useful reading is as a description of what a well-run program looks like, against which each takeover can be checked.
Nine expectations in the FFIEC's 2021 guidance, and the takeover control that meets each
- A current risk assessment for access and authentication
Covering consumer and business customers, employees and third parties; as the guidance warns, "A non-current risk assessment may result in unidentified risks or insufficient controls."
- An inventory of users, customers and high-risk transactions
Wire and ACH origination, payee creation and contact-detail changes are the takeover-relevant ones.
- Periodic evaluation of whether controls work
Including data from actual fraud events, such as where confirmed takeovers began.
- Layered security
Preventive, detective and corrective controls, so a takeover that passes one meets another.
- MFA or controls of equivalent strength where single-factor with layering is inadequate
Especially for high-risk transactions and high-risk users.
- Monitoring, logging and reporting
Logs that can reconstruct a takeover across the contact center, digital banking and payments.
- Controls for call centers and help desks
Enhanced authentication for credential resets, attention to unusual phone numbers, trained staff.
- Customer awareness and education
Including how to tell a real call from the bank, and when the bank uses enhanced authentication.
- Reliable identity verification
Methods that do not depend solely on knowledge-based questions.
What replaced the 2011 FFIEC guidance? The 2021 guidance, and how the scope widened
The 2021 guidance replaced both "Authentication in an Internet Banking Environment" (2005) and its "Supplement" (2011), as the FDIC's cover letter states (FDIC FIL-55-2021). Many bank policies and vendor documents still cite the 2011 supplement, so the first test of a takeover policy is whether it has caught up.
The older texts were specific about internet banking. The 2005 guidance, as the First Circuit quoted it in a takeover case, said: "The agencies consider single-factor authentication, as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties" (Patco v. People's United Bank, 1st Cir. 2012). The 2011 supplement, as Texas's bank supervisor summarised it, said institutions "should no longer consider basic challenge questions an effective primary control" (Texas Department of Banking, SM 1029).
From the 2005 and 2011 internet-banking guidance to the 2021 guidance
2005 guidance and 2011 supplement: Customers using internet banking
2021 guidance: Customers on any digital channel, plus employees, third parties, service accounts and system-to-system access
2005 guidance and 2011 supplement: Inadequate as the only control for high-risk transactions
2021 guidance: Single-factor "either alone or in combination with layered security, is inadequate in many situations"
2005 guidance and 2011 supplement: Basic challenge questions no longer an effective primary control (2011)
2021 guidance: Reliable verification does not depend solely on knowledge-based questions
2005 guidance and 2011 supplement: Not a focus
2021 guidance: A section of their own, with controls for credential resets
2005 guidance and 2011 supplement: Not addressed
2021 guidance: Risks of services with "shorter processing windows, push-payment capabilities, and limited fraud management functionality"
2005 guidance and 2011 supplement: Minimum expectations for online banking
2021 guidance: Examples of effective practice, applied through the bank's own risk assessment
The widening matters for takeover in one specific way. A takeover today often starts outside online banking, on a phone call to the contact center or in a carrier's store where the customer's number is moved to a new SIM, and the 2021 text covers the bank's side of both. A policy written to the 2011 supplement can be fully compliant with its source and still leave the reset desk uncovered.
Is multifactor authentication required by FFIEC? Where the risk assessment says single-factor is not enough
Not universally. The guidance's test is the bank's own risk assessment: "When a risk assessment indicates that single-factor authentication with layered security is inadequate, multi-factor authentication (MFA) or controls of equivalent strength, combined with other layered security controls, can more effectively mitigate risks associated with authentication." It then answers part of the question itself, stating that single-factor with layered security "has shown to be inadequate for customers engaged in high-risk transactions and for high-risk users".
The guidance is also candid that MFA is not one thing. Factors differ in "usability, convenience, and strength", and "certain MFA factors may be susceptible to MIM attacks, such as when a hacker intercepts a one-time security code sent to a customer." For takeover that sentence is the whole problem in miniature: a code sent by text to a number the criminal has just moved, or read aloud to a caller posing as the bank, is a second factor that protects nobody. How that plays out with ported numbers is the subject of the guide to SIM swap fraud prevention.
The phrase "controls of equivalent strength" is the one to read carefully. It lets a bank meet the expectation with a combination of controls rather than a specific factor, but the burden is on the bank to show the combination is as strong. A program that relies on monitoring as one of those controls should be able to show the monitoring catching takeovers, not just producing alerts.
What is layered security? Controls that catch what the last one missed
Layered security means several controls of different kinds on the same risk, so a failure in one is caught by another. The guidance defines it as incorporating "multiple preventative, detective, and corrective controls", designed "to compensate for potential weaknesses in any one control", and lists examples including MFA, user time-out, monitoring processes and transaction amount limits.
Account takeover is the best test of whether layers are real or only listed. In the sample case at Corvane National Bank, three preventive layers failed in sequence: knowledge questions on a phone reset, an alert on the contact-detail change that went to the new number, and a passcode for the new payee sent to that same number. The new-payee daily limit partly worked; the $9,750.00 transfer was just under $10,000. What stopped the loss were the detective and corrective layers: the transaction hold, and the stitching of the reset to the login with an outreach call to a trusted number.
The controls tied to the FFIEC guidance in Account Takeover Fraud Prevention, marked failed, partly worked or worked
Read that way, each takeover is a free control test. Among its risk assessment practices the guidance lists: "Initially and periodically assess the design and effectiveness of access and authentication controls employed." A file that records, case by case, which layers failed gives the risk assessment real numbers instead of opinions.
What is a high-risk transaction under FFIEC? Four elements the guidance names
The guidance does not define high-risk transactions by type; it names the elements banks have used to identify them: "the dollar amount and volume of transactions, the sensitivity and amount of information accessed, the irrevocability of the transaction, and the likelihood and impact of fraud." Irrevocability is the element that matters most for takeover, which is why wires, same-day ACH credits and instant payments rank high on any reasonable list.
FFIEC appendix controls, matched to the steps of a typical takeover
| Takeover step | Control named in the 2021 appendix | What to check in your program |
|---|---|---|
| Password reset by phone | Enhanced authentication for credential reset; training on password reset process | Which factor the reset desk uses, and whether it can be passed with breached data |
| First login from a new device | Device identification and enrollment; fraud and anomaly detection monitoring | Whether a first-seen device on a fresh credential raises risk, and who sees it |
| Phone number or email changed | Account maintenance controls; lost, stolen or changed information and devices | Whether a contact change needs enhanced authentication and alerts the old contact |
| New payee added | Transaction value, frequency and timing controls, including restrictions on devices for adding payment recipients | Whether a payee added from a new device, minutes after a contact change, is treated differently |
| Transfer sent | Transaction alerts; fraud and anomaly detection; dual control for business customers | Whether the hold decision can be made, with evidence, before the rail's window closes |
| After the takeover | Fraud response policies; transaction and audit logs | Whether the case can be reconstructed and the failed controls counted |
Account maintenance: the control most takeovers walk through
If one appendix control deserves more attention than the rest for takeover, it is account maintenance: "Enhanced authentication controls are applied for account maintenance activities (e.g., changes to physical or email address, password, contact information, or enrolled devices) performed or requested by customers or users." Every step that disarms later controls is on that list.
The reason is sequence. A criminal who changes the phone number first receives every later passcode and alert; one who adds a device first can pass device checks on the next login. The guidance's appendix also asks for processes to handle lost, stolen or changed devices and contact details, naming changes of phone number or carrier, the bank-side defence against a number moved to a criminal's SIM. A program that applies MFA at login but lets the phone number change on a single factor has put its strongest lock on the wrong door.
Does the guidance cover call centers? Yes, in a section of its own
Yes. Section 8, "Call Center and IT Help Desk Authentication", describes threat actors deceiving representatives into resetting passwords and asks for a risk assessment that sets secure processes, training and effective controls for those operations. The appendix adds the specific controls: enhanced authentication for credential resets, detection of calls from unusual numbers, handling of changed phone numbers or carriers, and training on the password reset process. How those controls work in a contact center under pressure is the subject of the guide to contact center fraud prevention.
The guidance also pulls call centers into customer education. It suggests explaining to customers "situations in which the institution uses enhanced authentication controls, such as call center contact or certain types of account activity like password reset". A customer who knows the bank will step up a reset is a customer more likely to hang up on a caller who says it will not.
How do examiners test authentication controls?
Examiners judge the program, not a list: whether the risk assessment is current and covers every user type and channel, whether high-risk customers and transactions are identified, whether controls are layered and periodically evaluated, and whether the evidence shows them working. For more detail, the guidance refers readers to the FFIEC IT Examination Handbook's Information Security booklet, among other resources.
Some state supervisors have been more specific. Texas's Department of Banking requires state-chartered banks to address nineteen account-takeover components, and its IT security examiners "have implemented examination procedures which focus on the nineteen components in this Memorandum as well as the FFIEC Supplemental Guidance" (Texas SM 1029, 2019). That is one state's rule, written when the 2011 supplement was current, but it shows how a supervisor turns principles into test steps. The components, and what a business-account policy built on them looks like, are in the guide to corporate account takeover policy.
Three pieces of evidence answer most examiner questions about takeover: the current risk assessment showing that resets, contact changes and payee creation are treated as high-risk; the data showing where confirmed takeovers began and which controls failed; and evidence of what was changed as a result. The guidance itself suggests that fraud data can identify "certain authentication controls that are ineffective or degraded".
Mapping every takeover to the guidance with Account Takeover Fraud Prevention
In Account Takeover Fraud Prevention, the signal agent maps each signal to the layered controls in the FFIEC guidance, and each case file ends with the controls that failed and worked. Across cases, the strategy view counts where takeovers began; in the sample bank's 90 days, 185 of 452 confirmed takeovers, 41%, began with a phone reset passed on knowledge questions. From that pattern the strategy agent drafted a rule, a passcode to the phone on file for 30 days or more when a caller's number is not on file, back-tested it, and sent it for approval to the strategy manager and model risk.
The restore plan applies the same idea to one customer. After Gloria Henshaw's takeover, the plan steps up her contact-center authentication from knowledge questions to a passcode plus callback for 90 days, alongside putting back her phone number, revoking the device and resetting her credentials. Each step shows its before and after, and nothing changes until a second person checks it.
A restore plan that closes the control that failed, and a letter in plain words
Mapping is not compliance. The guidance asks for the bank's own risk assessment and judgment, and no system can supply those. What a system can supply is the evidence: for every takeover, which control failed, in which channel, and what was done. To see that evidence on your own past cases, start from Account Takeover Fraud Prevention.
Questions people ask
When was the FFIEC authentication guidance last updated?
On 11 August 2021, when the FFIEC issued "Authentication and Access to Financial Institution Services and Systems". It replaced the 2005 guidance on authentication in an internet banking environment and the 2011 supplement. The FDIC distributed it as FIL-55-2021.
What are the FFIEC MFA requirements?
The guidance sets no blanket MFA mandate. It says MFA "or controls of equivalent strength" can more effectively mitigate risk where the bank's risk assessment finds single-factor with layered security inadequate, and that single-factor with layering has shown to be inadequate for high-risk transactions and high-risk users. It also warns that some MFA factors, such as codes sent to a customer, can be intercepted.
Does the FFIEC guidance apply to credit unions?
Yes. The FFIEC includes the NCUA, and the guidance notes that its references to customers include credit union members. It applies to banks, savings associations and credit unions supervised by FFIEC members, and also covers employees, third parties and service accounts.
Does the FFIEC guidance mention behavioral biometrics?
Yes, in its appendix of authentication solutions, which describes software that studies how a customer swipes, taps, types and moves the mouse (the behavioral biometrics guide covers how a bank should test it). It is listed as an example, not a requirement; how a second line should evaluate it is a separate question.
Is the FFIEC guidance a regulation?
No. It describes effective practices and states that it does not establish a compliance standard or impose new regulatory requirements. Examiners use it alongside the safety and soundness standards and the information security guidelines that are binding.