2

James can undertake authentication functions without the real user ever being aware this has occurred (e.g. attempt to log in, log in with stolen credentials, reset the password)

OWASP SCP
47, 52
OWASP ASVS
2.5.2, 7.1.2, 7.1.4, 7.2.1, 8.2.1, 8.2.2, 8.2.3, 8.3.6
OWASP AppSensor
UT1
CAPEC
SAFECODE
28