FIDO2 MFA in Puerto Rico financial sector: beyond SMS

Credit unions, payment services, and regional banks in Puerto Rico migrate customers to mobile apps while internal staff still use SMS OTP for admin consoles. CISA and NIST 800-63B are clear: SMS is AAL1 resistance, not AAL2 for high-value operations. Krebs on Security has documented SIM swap against financial targets for years.

FIDO2 — YubiKey hardware or passkeys on corporate devices —

FIDO2 — YubiKey hardware or passkeys on corporate devices — removes the interceptable factor. For Puerto Rico financial sector, prioritize: core banking admins, fraud analysts, SWIFT or clearing network access, and accounts with bulk ACH transfer permissions. Branch staff in Ponce or Carolina need different policy than San Juan treasury, but all need phishing-resistant MFA.

Practical implementation: Microsoft Entra ID or Okta with FI

Practical implementation: Microsoft Entra ID or Okta with FIDO2 enforced for risk groups, SMS only as documented fallback expiring in 90 days, and in-person key onboarding for critical roles. Bruce Schneier notes poorly implemented MFA creates workarounds — avoid permanent exceptions for "the VP who travels a lot."

Regulatory: financial institutions in PR under local and federal supervision must demonstrate access controls proportional to risk. Audits ask about MFA coverage, not checkboxes. Document key inventory, loss procedure, and revocation on offboarding.

YubiKey cost for 200 critical employees is a fraction of one fraudulent BEC transfer. Puerto Rico financial sector competes with continental neobanks on UX — FIDO2 can be both security control and trust differentiator for enterprise clients in the Caribbean.