Rules and risks

How the rules work

Most login rules are about MFA and passwords, and almost none are about permissions. The US federal standard sets the technical bar, sector rules make MFA mandatory where money or health data sits, and privacy regulators punish its absence after a breach.

NIST. SP 800-63-4, final on July 31, 2025, is written for US federal systems and copied far beyond them. Passwords used alone need at least 15 characters, with no composition rules, no forced rotation and a check against leaked-password lists; security questions are out. At the middle assurance level, apps must offer a phishing-resistant option, and synced passkeys are allowed up to that level but barred at the top one. SMS is "restricted", and a push prompt that only asks "approve?" no longer counts.

Sector rules. PCI DSS 4.0.1 has required MFA for all access to cardholder data since March 31, 2025, and New York's financial regulator MFA for any individual accessing any system since November 1, 2025. The 2021 FFIEC guidance for US banks asks for MFA or equivalent controls for high-risk activity, service accounts included. A proposed HIPAA rule would make MFA mandatory for health data, with the final rule reportedly slipping to July 2027. In EU payments, PSD2's strong customer authentication needs two independent factors, and the European Banking Authority counts an SMS code only as possession. PSD3 and the Payment Services Regulation reached provisional agreement on November 27, 2025, with start dates unconfirmed.

Privacy. The UK's ICO fined 23andMe £2.31 million in June 2025, citing among other things that MFA wasn't required, and Ireland's Data Protection Commission fined Meta €251 million in December 2024 over a 2018 access-token bug. The FTC's 2023 order against Ring found under 2% of users turned on MFA when it was optional; Ring paid $5.8 million.

Platforms and audits. Azure, AWS, Google Cloud, GitHub, PyPI and Snowflake now require MFA for their own users, and SOC 2 and ISO 27001 auditors expect it even though SOC 2's criteria don't name it. CISA calls SMS a last resort.

What mistakes cost

Let's say the project app had a consumer side: 2 million accounts, passwords only, optional MFA, no bot protection, and a sharing feature that shows collaborators' profiles. Attackers stuff leaked credentials, take over 20,000 accounts and, through sharing, see a million people's profiles. Rough arithmetic on those assumptions:

• The damage: class settlements in comparable cases came to roughly $1-7 per exposed person, so $1-7 million plus response costs.
• What it gets back: at most a year of the identity vendor's fees (perhaps $150,000-400,000), and nothing if the vendor shows MFA was available and not enforced. Insurance pays only if the MFA answers on the application were accurate.
• What prevention costs: mostly product design. MFA comes with most identity vendors and passkeys carry no per-sign-in fee, and Ring's under-2% uptake shows the real cost is defaults and prompts.

Read the attack data carefully. Stolen and reused credentials are the main way into accounts, as the cases below show. For breaches as a whole the picture changed: Verizon's 2026 Data Breach Investigations Report found exploited vulnerabilities were the way in for 31% of breaches against 13% for credential abuse (22% the year before, partly because Verizon moved some cases to a new category). And several of the biggest identity incidents were failures on the provider's side, where no customer's MFA choice mattered: Microsoft's Storm-0558 signing-key theft, Okta's support system and Meta's token bug.

The record so far:

When systems go down, the business loss runs ten to a hundred times the settlements; when only data leaks, payouts per person are small. Detection usually comes from outside (other companies spotted the Okta breach, the US State Department Storm-0558), and providers mostly pay by changing a default afterwards.