Your Bank's Back Door Is a Selfie and a Sticky Note

Imagine this: you're switching to a new phone. You log into your banking app, hit a snag updating your email address, and customer support steps in to help. They ask you to take a selfie holding your ID and a handwritten note. You do it. Done. Problem solved.

Now imagine a fraudster doing the exact same thing — with a photo of your ID they bought on a dark web forum and a face that's close enough to yours to fool a tired support agent. That's not a hypothetical. That's the weakness Fincrime Central exposed in Qonto, a major European digital bank — and it's almost certainly how your own financial accounts work too.

The Front Door Is Fine. It's the Side Door You Should Worry About.

Here's the thing about modern banking security: companies have genuinely gotten better at the front door. When you first open an account, there are often sophisticated checks happening behind the scenes — video selfies, document scans, even checks that try to detect if you're a real living person rather than a photo being held up to a camera (this is sometimes called a "liveness check," which is exactly what it sounds like: it tries to confirm you're alive and present, not a static image).

Qonto used a service called Fourthline to run those checks at sign-up. Fourthline is serious technology — the kind banks in Europe use to confirm you are who you say you are before they hand you access to financial services. Impressive, right?

Here's the kicker. When Fourthline's system ran into an error during routine account updates — say, a customer trying to change their email address — Qonto's support team didn't have a secure backup option. So they fell back to asking customers to submit a manual selfie alongside their ID document and a handwritten note.

Read that again. Enterprise-grade verification on the way in. A selfie with a handwritten note when things went sideways. This article is part of a series — start with Face Detection Before Identification How Facial Analysis Act.

Why Recovery Is the Real Target

Let's talk about how attackers actually think, because this is where most security explanations lose people. Criminals aren't sitting there trying to guess your 15-character password. They're not trying to intercept your two-factor code (that's the six-digit text message that proves it's really you — the extra step beyond your password). Those things are genuinely hard to crack.

What's easy? Finding the path around all of that.

According to research published by AuthSignal, account recovery is the identity industry's most overlooked vulnerability — and the reason is almost embarrassingly simple: recovery processes are built for convenience, not security. When you're locked out of your account at 10pm, stressed and frustrated, the last thing anyone wants is a 45-minute verification process. So companies design recovery to be quick and human. And quick and human means it can be fooled.

As TechRadar reported in their analysis of recovery-based attacks: attackers have figured out that password resets and account recovery workflows are becoming a major entry point to bypass authentication entirely. Once they know the fallback process is weaker than the front door, they stop targeting the front door.

"When recovery is needed, organizations attempt to reconstruct trust using weaker signals than those used in the original proofing process." — Analysis reported by AuthSignal

That's the trap in plain English: the moment your account is most vulnerable — when you've lost your phone, changed devices, triggered a security flag — is exactly when the verification drops to its weakest level. It's backwards. And the Qonto case is a textbook example of how it plays out in a real financial product.

The Selfie-and-Note Problem Is Bigger Than One Bank

Don't let this be a Qonto story in your head. It isn't. Qonto got named because they got scrutinized — but the manual selfie-with-ID fallback is everywhere. It's used by fintechs, credit unions, app-based lenders, and more traditional banks when their automated systems can't make a call. It looks official. It feels like security theater — because it is.

Here's why this matters so much right now, specifically: the tools to fake that process have gotten shockingly good. Deepfakes (AI-generated fake videos or photos that look real — think of it as a very sophisticated Photoshop that works on faces in real time) aren't just for politicians anymore. There are services, today, that can generate a convincing photo of your face holding an ID. A support agent who reviews 50 of these submissions a day isn't going to catch one that's been carefully constructed. Previously in this series: That 99 Accurate Badge Protecting Your Bank Account It Expir.

According to research from NHIMG, fallback authentication methods define the real attack surface of any security system — because an attacker only needs to find one weaker route to bypass everything stronger. It doesn't matter how good your front door is if the back window doesn't lock.

What You Can Actually Do — Before You're Locked Out

Most people only find out their bank's recovery process is weak when they're already in the middle of it, stressed, trying to regain access to their own money. That's the worst moment to discover a security gap. So let's get ahead of it.

First — and this is the most important thing — do this tonight, not someday: log into your most important financial accounts and look at what recovery options exist. Not your password. Not your two-factor setup. Specifically: what happens if someone says they're you and they've lost their phone? Is there a phone number to call? An email to contact? Does that process require anything that only you would actually know, or could it be faked with publicly available information about you?

If your financial provider's recovery process involves a customer support agent making a judgment call — especially one that relies on documents or photos — that's worth knowing now. Some providers let you set a PIN specifically for support calls. Some let you add a security phrase. Ask whether yours does.

As TechNewsWorld reported in their examination of identity breach patterns: the core problem is that identity assurance is treated as a one-time event — something you prove at sign-up, then never again. But the threat doesn't stop after you open the account. It just waits for the moment the guardrails are down.

If you've ever felt that quiet unease when a website asks you to "confirm your identity" with steps that feel weirdly easy — that instinct is correct. You're sensing the gap. The question this kind of situation forces us to ask is exactly the right one: is this check actually proving it's me, or just checking a box? Up next: Before Facial Recognition Names You It Has To Find You And T.

The Trust Inversion Nobody Talks About

There's something almost philosophically broken about the way this works. Companies spend serious money making sure the person who opens an account is real — because that's the regulated part, the part that auditors check, the part that shows up in compliance reports. Recovery? That's a customer service problem. Different team, different budget, different priority.

So we end up with this absurd inversion: the harder it is to sign up, the more trust you feel. And then, precisely when you need protection most — when you're locked out, when you've changed devices, when something unusual has triggered a re-verification — the system drops back to processes that haven't meaningfully evolved since online banking began.

A handwritten note. A selfie. A support agent making a call.

The Qonto case isn't a scandal about one company cutting corners. It's a mirror held up to an industry-wide assumption that security is something you achieve at the door — and then you're done. That assumption is wrong. And the people paying the price for it, to the tune of $15.6 billion last year, aren't the banks.

So here's the question worth sitting with tonight: if someone called your bank's support line right now, said they were you, and knew your address and the last four digits of your Social Security number — information that has leaked in roughly a dozen major data breaches over the past decade — what exactly would stop them?