A fallback factor is an alternate authentication method used when the primary one cannot be completed. If a user cannot pass a biometric check, access a trusted device, or receive a push prompt, the system may switch to a backup such as an OTP, recovery code, hardware token, or verified support process. In banking and enterprise environments, fallback factors help keep legitimate users from being locked out while preserving continuity for critical actions.
They matter because attackers often target the backup path instead of the main login. Account recovery, helpdesk verification, and SMS-based fallback can be weaker than the primary control and may be abused through phishing, SIM swapping, social engineering, or stolen personal data. Good defenses make fallback harder to exploit than ordinary login: limit when it can be used, require strong identity proofing, log every step, and apply step-up checks for risky actions. A fallback factor should restore access, not become the easiest route into the account.