Your Login Screen Is Now a Con Artist's Favorite Costume

Two things are happening at once, and they pull in opposite directions. The hardware side of identity is finally good. Face unlock on a door now works in under a second. Meanwhile the human side is under attack, and the attackers are winning by pretending to be you, or your company, or Apple. If you own an account or identity feature, both of these land on your desk. Let me catch you up.

The hardware finally works

Face unlock used to be a gimmick. Not anymore. Reviewer Jennifer Pattison Tuohy tested four facial recognition smart locks and found the Eufy FamiLock E40 unlocks in under a second, even with sunglasses on. These locks use infrared to build a 3D map of your face, so a photo will not fool them. The tech crossed the line from demo to daily use.

One detail matters for your roadmap: all four locks store and process face data locally, not in the cloud. That is the design choice that makes people comfortable enough to try it. When the sensitive data never leaves the device, the trust conversation gets a lot shorter.

So the lesson is not "add biometrics." It is that good biometrics buy you trust only when you can point to where the data lives and why it is safe. Ship the feature and the story together.

The attackers stopped picking locks

Here is the catch. While the hardware got harder to beat, the scams got smarter, and they skip the hardware entirely. They go after the person. Groups like Scattered Spider target and exploit employees rather than computer systems, a strategy U.K. police called both effective and hard to counter. The FBI tied one of the jailed teens to attacks on more than 120 companies using social engineering.

That is the shift. Your strongest lock does not matter if someone talks their way past the person holding the key. The attack surface is your users and your support flow, not your encryption.

Wearing your brand to rob your users

The scams that should scare you most are the ones that dress up as safety. A phishing campaign hit LastPass and Bitwarden users with fake security notices. The emails came from a lookalike domain with a DocuSign link and even told users their vaults were "completely secure" to lower suspicion. The whole con was pretending to be the thing users trust.

Apple is now warning about the same move over FaceTime. Scammers pose as "Apple Support," then ask to share or control your screen, and Malwarebytes says they have emptied bank accounts this way. On the Mac, malware called CrashStealer fakes Apple's crash reporter, asking for a password Apple never actually requires. The pattern is the same: copy your trusted flow, then ask for the one thing you would never really ask for.

The threat you cannot see yet

Some of this data is being stolen now to be cracked later. Attackers run "harvest now, decrypt later" attacks, hoarding encrypted data to unlock it once quantum computers catch up. Experts put that day 10 to 20 years out, but the theft is already happening.

You do not need to panic about quantum computing on your Monday roadmap. But if you hold sensitive user data for a long time, health records, financial history, identity documents, the shelf life of your encryption is now a real question. NIST standardized new algorithms in August 2024, and VPN vendors flipped them on with no real speed hit. The cost of getting ahead of this is low right now.

The deep cut

Every scam here works by copying a real flow and asking for one thing the real flow never asks for. Fake Apple crash reports ask for a password Apple never needs. Fake password-manager emails send you to sign a DocuSign you would never sign. So the highest-value fix is not more security theater. It is teaching users what your product will never do, and then actually never doing it. Pick your list: we will never ask for your password over a call, we will never send a login link by text, we will never ask you to share your screen. Put it in the product, put it in your emails, and hold your own team to it. The moment your real flow looks like the scam flow, you have trained your users to get robbed.

Three questions for your team

1. Can we say in one sentence where our users' identity data lives and why it is safe, the way those locks point to local storage? If not, that is the trust gap.

2. What are the three things our product will never ask a user to do, and does any current email, call, or prompt of ours break that promise?

3. For the sensitive data we hold longest, how long is our current encryption good for, and is post-quantum protection a cheap add now or an expensive scramble later?