A long-standing customer logs into their retail banking app at 2am, entering the correct password on a device the bank had already seen and getting the one-time code right on the first try, so every authentication control passes. 

Within nine minutes, the account has added a new payee and pushed the balance out across four instant transfers. By the time the genuine customer wakes up the money is gone irreversibly through real-time rails and scattered across accounts the bank had never had any reason to suspect were risky. 

Nothing was hacked. Someone simply logged in as a customer who wasn't there. 

Authentication passed, but control didn't 

Most organizations have invested heavily in identity authentication based on login passwords, one-time codes, device fingerprints, risk signals from IP and geolocation These are important tools, but they all answer just one question, does this session look legitimate right now? The question that is asked by a take over is harder: is the right person actually in control now, and as the session unfolds? A stolen session, a hijacked SIM, or a customer talked through a remote-access scam all produce a login that is technically genuine and functionally fraudulent. 

A login-time check is a snapshot. An identity takeover is what happens in the film that plays afterwards. 

Three ways a real login stops being trustworthy 

Phishing, credential stuffing, and info-stealer malware hand fraudsters stolen credentials and working logins at scale, so the password check passes because the password is correct, even though it isn't the owner typing it. 

MFA raises the bar but it doesn't close the gap. SIM-swaps redirect the one-time code, real-time phishing proxies relay it the instant it's issued, and push-bombing wears victims down until they approve a prompt defeating the second factor just as thoroughly. The fastest-growing vector barely looks like ATO at all. The real customer is at the keyboard, authenticating perfectly while being coached by a scammer through a remote-access session or a “safe account” story so authentication passes, the customer approves, and the payment is still not theirs. 

Each vector clears authentication differently, and stronger login-time signals narrow the gap but on their own they won't close it. 

Context starts at the login and doesn't stop there 

You can check context at the moment of login, and you should. Device IDs, IP address and geolocation, connection type, and feeds from other systems (threat intelligence, telco signals, prior fraud flags, shared industry data) turn a bare credential check into a far richer risk picture. A login from an unrecognized device, an anonymizing proxy, or an IP tied to known fraud should never be treated the same as a routine one. These signals are real-world context, and they stop a significant share of account takeovers at the door. 

They only describe a single instant of the session as it looks right now, and fraudsters have learned to make that instant look clean, using residential proxies that mimic a home connection, remote access into the customer's own genuine device, or session hijacking from a recognized browser. 

So login-time context is necessary, not sufficient. The signals that settle the question often keep arriving after the login, in behavior that doesn't match the customer and in money moving toward a network that does. The goal is to connect context at the login with context afterwards.  

Context is the connective layer 

To trust a login, you have to see every signal in one place, the device and IP behind this session, the customer's established pattern, and the network the transaction is reaching into, and you have to keep seeing it as things change. 

That starts with entity resolution, resolving customers, devices, IPs, counterparties, and transactions across every system into a single, trusted view of who is actually whom. The device ID and IP you captured at login aren't discarded once the check clears; they become nodes in that view, connecting this “trusted” session to a dozen other takeovers sharing the same infrastructure. On top of that sits a contextual view, a network that reveals what a session-level check never can on its own, the “new payee” already linked to known mule accounts, the dormant account waking to move funds in seconds, and the beneficiary quietly connected to a dozen other victims this week. 

This is what turns a login event into a decision-ready one. It's the surrounding context, login-time signals included, that tells you whether a genuine authentication can be trusted, and keeps telling you as the session plays out. It's the difference between reimbursing a loss after the fact and stopping the transfer before it settles. It's also what makes the decision explainable, because you can show the device tied to known fraud, the behavioral break, and the beneficiary network behind a hold, and defend it to an investigator, a customer, and a regulator. 

No individual signal, and no single vendor, solves this alone. It depends on connecting the data an organization already has, the login-time signals, the behavioral history, and the transaction network. Most already hold far more of it than they put to work. The same context, incidentally, exposes the synthetic identities that never had a real owner to take over in the first place, but that's for another post. 

Why this is urgent now 

Identity fraud and account takeover have turned from a nuisance into a systemic loss, driven by three shifts. 

The move to real-time payments is the clearest one. Instant, irreversible, always-on rails are exactly the environment takeover thrives in, and once a hijacked login pushes the payment, there's no window to reconsider and no way to claw it back. Real-time payments are now the norm across practically all economies. 

Liability is moving too. Regulators, especially in Australia, European and ASEAN countries, are increasingly shifting the cost of fraud toward the institutions that let it through, rather than the customers who suffer it. When losses stop being someone else's problem, “the login was valid” stops being an acceptable answer. 

Generative AI is changing the game for bad actors too, allowing industrial-scale automation of identity theft and fraud. Criminal syndicates are constantly iterating on their techniques for fully using these powerful new tools. 

From authenticating logins to trusting them 

The question worth asking is whether we can say, with evidence, that the right person is in control and that where this money is going makes sense for them. 

Login-time context gets you part of the way. Only connected context across the session, the behavior, and the network gets you the rest. 

If you're rethinking how your organization moves from authenticating logins to genuinely trusting them, our team would welcome the conversation and can show you what entity resolution and contextual decisioning look like against your own data.