Customers accessing financial services online authenticate with MFA at login; high-risk activities such as adding payees or changing contact details and limits require authentication mechanisms such as transaction signing or behavioural analysis, with the MFA request distinct from and where practical on a different channel to the login request; sessions are time-limited, protected against hijacking and terminated promptly on detected compromise; and protocols designed to obscure identity or attribution are barred from login and high-risk transactions. Before offering services through third-party messaging or voice platforms or payment intermediaries, the institution performs due diligence on security characteristics and a risk assessment of which services suit the channel; customers are adequately authenticated before onboarding via such platforms with MFA for high-risk transactions consistent with the main platform; and onboarding through third-party providers aligns with the institution's login authentication, with monitoring built into the integration to catch and counter fraud.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.