Strong Customer Authentication (SCA) proves a credential was presented. It does not prove that the voice on the call is the person who holds it. Hongi closes that gap, for banks, insurers, and any organization where impersonation carries a real cost.
SCA covers the two ends of a customer interaction: the login and the transaction signing. Everything between them, the phone call, the video session, the email exchange, has no live identity proof. That middle is where vishing, deepfake video, and CEO fraud all sit.
Eight frameworks that touch identity assurance in the channels Hongi defends. For each: scope, where Hongi sits, and the primary source.
Strong customer authentication: at least two of knowledge, possession, inherence; transaction binding.
A complementary out-of-band possession factor for the conversation around payment authorisation. Does not replace SCA. Defends against social engineering that drives a customer through an otherwise valid SCA flow (fraud-induced transactions, advisor impersonation).
Digital operational resilience for the financial sector. Art. 9 (protection and prevention), Art. 17 to 19 (ICT incident reporting). In force since 17 Jan 2025.
Reduces the social-engineering surface that triggers ICT-related incidents. Optional audit log (Merkle tree of pairing hashes, no identities) supports post-incident reconstruction without retaining personal data.
Mandatory EU Digital Identity Wallet acceptance by relying parties from December 2027 (Art. 5f). Strong cryptographic identity proofs.
The live human-channel verifier alongside EUDI. EUDI proves a credential was presented. Hongi proves the voice on the call belongs to the credential holder. Two orthogonal problems, one architecture.
A failed Hongi cross-check during a bank-to-customer call is a clean machine-readable signal that can feed fraud reporting on CEO fraud and vishing, where the existing card-fraud schema underreports.
An operational identity-assurance layer for remote bank-customer and bank-internal interactions, consistent with the NBB framing of governance over ICT-supported services.
No name, no phone number, no email, no contact list, no codeword history, no analytics. The shared key lives on the two paired devices. The server forwards an opaque cipher. Almost nothing to leak in a breach.
Adds an identity-assurance layer to access control for the high-risk remote interactions (transaction approval, breach response, vendor onboarding) that text-channel MFA does not cover.
Targets the threat ENISA ranks first. Complements NIST authentication assurance levels with a session-level human-channel attestation that is mechanism-agnostic (phone, video, in person).
Six operational scenarios across customer-facing and internal flows. The organizational pairing and audit-log mechanics described below are on the B2B roadmap, not yet shipped. First pilots with banks are scheduled for Q4 2026. A single missed verification in any of these has a known six-figure tail.
Customers cannot distinguish a real advisor from a vishing fraudster with the right context.
The customer's codeword must match the advisor's. No match, no conversation.
Deepfake face swaps hit remote KYC. The face on screen may not match the uploaded ID.
Both sides read matching codewords on camera before KYC review. Attested in the session recording.
Urgent wire request from the CEO. Signature matches, voice sounds right. Money leaves.
Live codeword check before any unusual payment. One pairing closes the gap.
Attackers exploit incident chaos: fake IT, fake support, fake IR vendors.
Every internal call gated by a codeword check. No match, no instruction acted on.
Phone-authorised EUR 100k+ transfer with no out-of-band proof that the customer on the line is genuine.
Customer reads their current codeword aloud. Advisor confirms the match. Payment proceeds, attested.
Vendor calls have weak identity. Invoice fraud sits on top of that gap.
Pair at KYB. From then on, every vendor call carries a codeword check. No guessing.
A Hongi deployment is auditable by your DPO in a single afternoon. Below is everything held on a server when an organization deploys Hongi for its staff and customers.
What we do not store: names, phone numbers, emails, contact lists, codeword history, call logs, location, transcripts, biometrics, advertising identifiers. The verification key between two paired devices lives only on those two devices, derived locally.
The Hongi team sits down with your compliance, fraud, and IT leads and walks through your highest-impact use case. If there is a fit, we run a free six-month pilot with up to 500 customers or employees. No procurement, no licence, no exposure.
Hongi (Lovit BV) · Vlaanderen, Belgium · info@hongi.io