In May, a 84‑year‑old woman lost $30,000 after thieves accessed her bank and retirement accounts because the institutions did not require multi‑factor authentication. She received a call from her retirement account provider about a suspicious transaction and confirmed it was unauthorized; the provider protected the account. She then discovered thousands of dollars transferred from her checking and savings accounts. The transfers used daily withdrawal limits and moved funds to a separate account. Thieves accessed her Gmail account, set up filters to hide bank communications, and created fraudulent accounts in her name. Her bank initially asked whether a family member had performed the transactions before agreeing to investigate. The Consumer Financial Protection Bureau states that consumers have 60 days to dispute transactions and banks have up to 45 days to investigate. If a bank refuses reimbursement, a consumer may pursue legal action.

Many banks and online services make MFA optional, and some, including PNC, require it, while others such as Bank of America, Chase, Capital One and Citibank leave it optional, as do Google accounts. The woman used the same or similar passwords across accounts and her data had appeared in a prior breach, which likely facilitated the intrusion.

Security experts note that MFA can block 99.9 percent of attacks according to a 2019 Microsoft report, but other analysts say the figure is inflated because social engineering and SIM‑swap attacks can bypass SMS or email one‑time codes. The most common MFA method, OTP via SMS or email, is vulnerable to phishing and SIM‑swap attacks. Industry advocates recommend passkeys, which use cryptographic key pairs and are resistant to phishing. Several banks, including Chase, Wells Fargo, US Bank and Bank of America, are beginning to offer passkeys, and some mobile apps already require biometric verification, though web logins may lack such challenges.

Andrew Shikiar, CEO of the FIDO Alliance, said banks view MFA as an optional feature that can increase friction and support costs. He added that the industry is moving toward passkeys as a default, but widespread mandatory adoption may take time.

The incident highlights that convenience‑driven security choices can lead to greater financial loss for consumers, and banks may need to adopt stronger authentication methods to reduce fraud risk.