Rampant account takeover fraud has exposed the weakness of most digital authentication. So how can this problem be solved?