Technical insights on authentication, identity verification, and security architecture.
Of the £629.3M UK banks lost to fraud in H1 2025, roughly half to 60% is closed by device-bound cryptographic authorization — deterministically on the unauthorized category, and as a sharpening signal on a subset of APP fraud. The full breakdown, backed by UK Finance's own published figures.
Read articleScenario by scenario — the eight APP categories UK Finance tracks, plus five unauthorized-fraud patterns and the emerging AI-agent category. For each: what happens, what exists today, and whether device-bound authorization neutralizes it, reduces it as a signal, or is not applicable.
Read articleAuthorization infrastructure does not replace Actimize, Featurespace, or Sardine. It contributes a single binary field — human_verified = true | false — that converts probabilistic fraud scoring into deterministic closure wherever identity uncertainty is the dominant source of error.
Read articleArticle 14 requires effective human oversight of high-risk AI systems. The industry defaulted to approval dialogs. Prompt injection, agent compromise, and consent fatigue prove that interpretation was never enough.
Read articleOTP and risk scoring cannot stop authorized push payment fraud. That is a structural fact, not a product gap. The honest question is which slice of the fraud market per-action cryptographic signing deterministically closes, and which slice it cannot. UK Finance 2025 data, scoped.
Read articlePrompt injection is not a bug. It is a property of how language models process input. Defenses that live on the same surface the attacker controls eventually lose. The only defense that survives is orthogonal to the model.
Read articleArticle 97 demands three things: two-factor authentication, a dynamic link to amount and payee, and non-repudiable evidence. Most production implementations satisfy one of the three.
Read articleSix fields, one signature, no single party in possession of the whole truth. The anatomy of the artifact banks will need to produce — and the one regulators will increasingly ask to see.
Read articleFraud scoring produces a probability. Deterministic human authorization produces an artifact. For high-stakes actions, the difference matters more than the math.
Read articleA log is produced by the platform. In a disputed action, it is the platform's own account of what happened. Proof requires an artifact the platform alone cannot write.
Read articleIdentity, fraud scoring, and policy engines each solve a real problem. None of them produces the artifact regulated systems actually require: a cryptographic proof that a specific human authorized a specific action at a specific moment.
Read articleSessions inherited trust from login and extended it indefinitely. PSEA corrects this by requiring proof of authority at the moment of action.
Read articleA technical comparison of offline-first authentication and cloud-based identity systems, including security, privacy, availability, and attack surface.
Read articleLogin authentication verifies access, not intent or human presence. Here's why Zero Trust requires action-level verification.
Read articlePasswordless systems reduce friction, but most still verify credentials, not real human presence.
Read article