Passwordless authentication: Solve CX pain points, boost revenue

As account takeover attacks skyrocket and customer frustration with digital experiences mount, passwordless authentication has become a hot topic. A recent survey by Enterprise Strategy Group found that 85% of IT and cybersecurity professionals agreed that adoption of passwordless technologies is a top  strategic initiative.

But is it right for your business? Let’s explore what this authentication approach involves, its benefits, and how to implement it effectively.

The business impact of password hell

Passwordless authentication is gaining traction as businesses grapple with multiple risks associated with traditional account passwords.

1. Customer attrition: In one recent study, nearly 20% of customers who forgot their passwords abandoned their account rather than endure the password reset process.
2. Cart abandonment: A survey of 1,000 consumers found that one in four online shoppers were willing to abandon a cart of $100 or more if they had to reset their password to check out.
3. IT helpdesk resource strain: By one World Economic Forum estimate, larger businesses allocate nearly 50% of IT help desk costs to password resets.
4. Cybersecurity: Bot-driven credential stuffing attacks are growing. Aberdeen Strategy & Research found that 84% of business survey respondents said their online users had experienced a successful account takeover (ATO) in the past 12 months.

Two-factor authentication comes to the rescue, but there’s a catch

To combat these risks, many brands shifted to a two-factor authentication (TFA) strategy, where users create a password and choose another method to verify their credentials.

While TFA is effective against cybersecurity threats, the additional verification step adds a level of friction and rigidity to the experience. Users can be reluctant to adopt it.

Last November, Twitter revealed that only 2.3% of its active accounts opted in for TFA. Meta said it’s TFA enrollment was similarly small.

Bye, bye passwords: The promise of passwordless authentication

Brands are turning to passwordless strategies to address the weakness of traditional password authentication and avoid the rigidity of TFA. In fact, Apple, Google, and Microsoft recently announced plans to expand support for a common passwordless sign-in standard created by the FIDO Alliance and the World Wide Web Consortium.

Put simply, passwordless authentication is the process of giving a user access to a digital property using credentials that don’t involve password setting. Here are examples of some of the most popular types:

Phone login (mobile SMS) – Customers receive a one-time SMS code that enables them to access a digital property.

E-mail one-time password (OTP) or magic link – A brand sends customers a one-time code or an HTML link to the email address on file, which enables access to a digital property.

Fast Identity Online (FIDO) – This method turns a customer’s device (either mobile or desktop) into the authentication key. Set up after the initial log-in, FIDO authentication uses the security of today’s devices – such as biometrics – to validate the customer’s identity and offer a frictionless log-in experience.

Push authentication – Customers authenticate on their mobile phones by confirming a push notification, instead of using their password.

While each method executes differently, they all reduce the security risks associated with the traditional password, make accessing digital properties fast and easy, and offer relief to contact center reps.

Authentication: one size does not fit all

No single passwordless method has risen above the others. In fact, the key may be offering customers a choice, according to McKinsey & Company: “To reduce friction from rigid multifactor-authorization requirements, for example, customers could be allowed to choose their preferred multifactor method from a list of options.”

This notion of choice demonstrates the need for an authentication strategy to consider the balance between security and experience.

If the method favors a frictionless experience too much, there may be security implications. Conversely, a rigid multifactor approach may be secure, but it might also drive customers away.

The right balance, however, can improve customer retention, grow more revenue, reduce IT costs, and boost security.

Get ahead of the curve with CIAM

The shift away from passwords is still in the early stages. A new Microsoft report found that just 22% of the companies in the Azure Active Directory used strong authentication.

So, the window of opportunity is open now to gain a competitive advantage by beating competitors to market with passwordless authentication. Here’s where customer identity and access management (CIAM) software can help.

With the job of creating the front door to a brand’s digital properties, today’s CIAM software offers a range of authentication options, including passwordless, and enables a brand to apply its chosen method efficiently.

Risk-based, intelligent authentication

Glimpsing into the not-too-distant future, the next evolution of authentication strategy brings artificial intelligence into the conversation.

Instead of basing access on a pre-set authentication flow, innovative businesses are using AI to assess the risk of the log-in attempt. The assessment includes several factors, including:

• What time of day is it for the user?
• What IP address is the user logging in from?
• How many attempts has the user made to log in?
• Has the user suffered an ATO attack previously?

The score determines the user’s authentication journey. If they’re low risk, a frictionless method is served. If they’re high risk, the brand can automatically add authentication steps – like the dreaded CAPTCHA challenge – to ensure security.

Bottom line: simplicity, security, and satisfied customers

Authentication is a critical point in the digital experience and passwordless approaches are gaining momentum.

C-suites should prioritize executing the strategy that best suits their customer needs and finding the right supporting technologies, like CIAM. By doing so, they can boost customer retention, reduce security risk, and ultimately drive revenue.

As history shows, authentication constantly evolves. New methods, standards, and innovations are the rule, not the exception. By partnering with a CIAM vendor who works to update their software with the latest innovations, businesses can benefit from new methods as they arise while maintaining their focus on growth.