Should an authentication system be expected to reliably determine the motive of the user in addition to their identity? Various anti-fraud systems address this to varying extents, but a bank manager sitting at their laptop, tying in their password and TOTP with a gun to their head isn’t materially different to them providing biometric authentication with a gun to their head.