Adversary-in-the-Middle Attacks: Why Multi-Factor Authentication Alone Can No Longer Protect Banks
- TrustSphere Network
- May 13
- 3 min read
The Escalating Threat Landscape
Adversary-in-the-Middle (AiTM) attacks have evolved from a niche technical exploit into one of the most effective tools in the modern fraud operator’s arsenal. These attacks intercept the real-time communication between a customer and their financial institution, capturing authentication credentials, session tokens, and one-time passcodes as they are entered. The result is complete account takeover that bypasses even robust multi-factor authentication controls.
What makes AiTM attacks particularly dangerous for financial institutions is their ability to defeat authentication controls that were specifically designed to prevent account takeover. Traditional phishing captures static credentials; AiTM captures the entire authenticated session in real time, rendering MFA ineffective as a standalone defence.
Regulatory, Enforcement, and Market Context
Regulators across major financial centres have begun explicitly addressing AiTM and session hijacking risks in their guidance. The European Banking Authority’s revised strong customer authentication guidelines, the UK’s FCA expectations around APP fraud prevention, and the Monetary Authority of Singapore’s technology risk management guidelines all reference the need for controls that go beyond static authentication.
The liability landscape is shifting decisively. The UK’s mandatory APP fraud reimbursement regime, combined with similar developments in the EU and Singapore, means that institutions that fail to detect and prevent AiTM-facilitated fraud face direct financial liability for customer losses.
What the Data Is Showing
Microsoft’s Digital Defense Report documented a significant increase in AiTM phishing campaigns targeting financial services, with attack toolkits like EvilProxy and Evilginx becoming commoditised and available as phishing-as-a-service platforms. Group-IB’s threat intelligence reports confirm that AiTM kits are now routinely used by financially motivated threat actors, not just advanced persistent threat groups.
The financial impact is substantial. Account takeover losses facilitated by session hijacking have grown significantly, with individual cases frequently reaching six-figure amounts before detection. The speed of exploitation is a key factor — attackers typically begin fraudulent transactions within minutes of capturing a valid session.
Implications for Financial Institutions
The defence against AiTM attacks requires a layered approach that moves beyond authentication-centric thinking. Session integrity monitoring — continuous validation that the authenticated session is being used by the same device, network, and behavioural profile that initiated it — is essential. Device fingerprinting, behavioural biometrics, and network anomaly detection all play critical roles.
FIDO2/WebAuthn-based authentication represents the most robust technical countermeasure, as it binds authentication to the specific origin domain and device, making proxy-based interception ineffective. However, migration to FIDO2 is a multi-year programme for most institutions, requiring parallel investment in session-layer controls.
Conclusion
Adversary-in-the-Middle attacks represent a fundamental challenge to authentication-centric fraud prevention strategies. Institutions that recognise this and invest in session integrity, behavioural analytics, and phishing-resistant authentication will be materially better positioned to protect their customers and manage their fraud losses.
Suggested Next Steps
Assess your current session management controls against AiTM attack scenarios and identify gaps in session integrity monitoring.
Evaluate your MFA implementation to determine vulnerability to real-time proxy attacks and develop a roadmap toward phishing-resistant authentication.
Review your fraud detection rules and models to ensure they include session anomaly indicators such as device fingerprint changes, impossible travel, and behavioural deviations mid-session.
Conduct a threat simulation exercise specifically targeting AiTM scenarios to test your detection and response capabilities.
Sources: Microsoft Digital Defense Report 2024; Group-IB Threat Intelligence; EBA Strong Customer Authentication Guidelines; FCA APP Fraud Prevention; MAS Technology Risk Management Guidelines.
Comments