Description
Date
September 1, 2021
🔎 Challenge
Traditional MFA (especially SMS and voice) was costly, inconvenient for users, and not always needed. Call center feedback and Qualtrics reviews showed confusion around login friction and abandoned sessions. At the same time, the threat landscape was evolving, requiring stronger signals to detect fraud.
💡 Strategy
1. Introduced Adaptive Authentication:
- Integrated ThreatMetrix to enrich session data with device fingerprinting, geolocation, behavioral analytics, and known fraud patterns.
- Collaborated with Security and Legal to define risk thresholds and enable step-up MFA only when necessary.
2. Added Bot Defense via Shape Security:
- To stop credential stuffing, account takeover attempts, and scripted attacks, Shape was layered into the front of the auth flow.
- Result: reduced fake traffic and allowed for cleaner analytics and lower false positives.
3. MFA Optimization:
- Tracked success rates and drop-off metrics using Splunk and Adobe Analytics.
- Introduced Fast Track MFA setup with pre-verified info for known users, reducing set-up time.
✅ Outcomes
- Reduced unnecessary MFA challenges for low-risk users by ~30%.
- Improved user satisfaction (NPS) while maintaining secure access.
- Detected and blocked thousands of bot attempts weekly with Shape.
- Achieved buy-in from stakeholders across Security, UX, and Call Center Ops.