Stronger authentication does not reduce social engineering, it redirects it. The UK already ran this experiment: takeover losses down 27%, authorized push payment up 19%. Plan for the door still open.