Accuracy
The human at the moment of risk
A live biometric check re-proves the person where MFA only proves a credential is present and a device is enrolled.
Account takeover protection
Stop account takeover with human-first verification
Incode adds a fast biometric step-up at the exact high-risk moments where credentials aren't enough, re-proving the real, live human behind the account.
The challenge
A stolen credential walks in through the front door
Account takeover (ATO) starts with a stolen or phished credential, a SIM-swapped one-time code, a socially engineered password reset, or a hijacked session. Because the account and its credentials are real, the activity looks legitimate.
Passwords and MFA (multi-factor authentication) protect the credential and the device rather than the human, and generative AI has made it worse: deepfaked voice and video now defeat the manual checks that call centers and recovery flows fall back on.
$0B+
in US account-takeover losses in 2025, the costliest single fraud type
Javelin Strategy & Research
0M
US account-takeover victims in 2025, up 18% year over year
Javelin, 2026
0
password attacks per second, with credential attacks up 74% year over year
Microsoft
$0M
stolen in a single deepfake CFO video-call transfer
CFO Dive
How it works
Re-prove the real person at every high-risk moment
Account takeover protection layers on your existing auth stack: Incode proves a real human is present, while your CIAM or IAM (Auth0, Okta, Microsoft Entra, Ping) manages the credential and session.
Why Incode
A biometric step-up that proves the human
Incode layers on your auth stack and re-proves the live person behind the account, closing the SIM-swap, phishing, and social-engineering gaps that MFA leaves open.
Security
Beats SIM swap, phishing, push fatigue, and deepfakes
Multi-modal liveness and Deepsight catch the exact vectors that defeat one-time codes, knowledge-based answers, and manual video recovery.
Recovery
Zero-trust account recovery
Biometric re-proof closes the social-engineering path through the help desk and reset flow, with no knowledge-based questions to guess. The step-up runs only when risk warrants: a browser-based selfie, with no app, hardware key, or SDK for the user to install.
Scalability
One enrolled identity, from onboarding through recovery
The same identity proven at KYC re-authenticates and recovers the account across its lifecycle, backed by more than 7.1 billion trust checks run on the Incode platform.
Use cases
Step up at the events attackers target
Account takeover wins at the event rather than the login. The same step-up covers every moment where value moves.
New-device and suspicious logins
Challenge a risky login with a selfie match before the session proceeds.
Password and MFA resets
Replace one-time codes and security questions with a biometric re-proof at every reset.
Account recovery
Re-prove the account holder with a selfie, or a full government ID plus selfie, when a credential is fully lost.
High-value transactions
Step up at wires, payee or beneficiary changes, loyalty redemptions, and other irreversible actions.
SIM swap and port-out
Re-prove the real account holder at a SIM change, port-out, eSIM re-provision, or number transfer.
Methods
The identity stack behind every step-up
Every challenge runs on the same core identity stack.
Manifesto
Privacy is the architecture
We made privacy a founding conviction long before regulation or the market asked for it. Incode's AI-first identity verification reduces fraud while remaining private and compliant.
See it in actionConfirmed integrations
Built into the login and recovery flow you already run
In Auth0, Incode installs as a post-login Action from the Auth0 Marketplace: new users get full identity verification, returning users skip within the reverification window, and high-risk sessions get a no-document face authentication step-up against the enrolled biometric, with the verified result stamped into the Auth0 token.
Auth0
Incode IDV as step-up verification inside Auth0 consumer authentication flows.
CIAM
Okta Customer Identity
Step-up biometric verification and account recovery in Okta consumer sign-in flows.
CIAM
Microsoft Entra External ID
Biometric step-up at consumer sign-in, MFA recovery, and account recovery in Entra External ID.
CIAM
Ping
Incode IDV in PingOne DaVinci orchestration for workforce and consumer identity use cases.
CIAMIAM
TS
Transmit Security
Incode verification as a step-up journey inside Transmit's orchestration.
CIAM
AC
AWS Cognito
Biometric step-up on high-risk Cognito sessions, with the verified result returned to the user pool.
CIAM
Descope
No-code auth platform with Incode verification built in for customer-facing applications.
CIAM
Okta
Step-up biometric verification and account recovery in Okta workflows.
IAM
Microsoft Entra
Biometric verification to provide additional protection at provisioning, MFA recovery, and privileged access.
IAM
ServiceNow
Incode in ServiceNow IT workflows, protecting password resets, MFA recovery, and high-risk actions from impersonation.
ITSM
Zendesk
Identity verification inside Zendesk support workflows, so a reset or recovery ticket cannot be socially engineered.
ITSM
Verified proof
Risk-based step-up runs in production at top financial institutions
Top financial institutions run risk-based step-up and help-desk pre-verification in production for their workforces, the same re-prove-the-human mechanic this page applies to customer accounts.
7.1B+
trust checks run on the Incode platform
8 of 10
top U.S. banks choose Incode
190+
countries and territories covered
NIST 800-63-B
authentication-assurance guidelines the step-up maps to
What is account takeover (ATO)?
Account takeover (ATO) is when a fraudster seizes control of a legitimate user's existing account, getting in with stolen or phished credentials, a SIM-swapped one-time code, a socially engineered password reset, or a hijacked session. Because the account and its credentials are real, the activity looks legitimate.
We already have MFA. Why do we still see account takeover?
MFA (multi-factor authentication) proves a device rather than the person: SMS codes get SIM-swapped, phishing kits steal live sessions, and push prompts get fatigue-bombed. Incode re-proves the real human at the risky moment, closing the gaps MFA leaves open.
Does account takeover protection check every login?
No. It's risk-based: it steps up only at high-risk events (a new-device login, a password or MFA reset, an account recovery, a large transfer, or a payee or beneficiary change), so normal traffic stays frictionless.
How does Incode stop socially engineered account recovery?
It replaces knowledge-based questions with a biometric re-proof: a selfie, or a full ID plus selfie for high-assurance recovery, so there's nothing for an attacker to guess or socially engineer.
Does account takeover protection plug into our login stack (Auth0, Okta)?
Yes. Pre-built CIAM and IAM connectors (Auth0, Okta, Microsoft Entra, Ping), OIDC, a REST API, and SDKs. Your platform keeps the session; Incode proves a real human is present.
What about SIM swap and telco port-out fraud?
Because the check is biometric rather than an SMS code, a SIM swap doesn't help the attacker, and Incode can re-prove the account holder at a SIM change, port-out, or number transfer.
Can a deepfake beat the biometric step-up?
No. Passive liveness plus Deepsight block the deepfakes and injected feeds that defeat naive face checks.
Will this add friction and hurt conversion?
Incode challenges only high-risk actions, and the check is a sub-second selfie, browser-based, with no app: far less friction than a locked account or a failed one-time code.
Which industries is account takeover protection for?
Anywhere accounts hold money or value: banking, wealth, fintech, crypto, marketplaces, telco, travel and loyalty, and gaming.
What's next
The account is trusted. Make sure the person is
See how a biometric step-up closes the gaps MFA leaves open.