Adaptive Authentication

Adaptive authentication is a method of verifying users in which the strength of the check adjusts to the level of risk at that moment. A low-risk login from a familiar phone may need nothing more than a password or a saved session, while a login from a new device in another country, or a large payment to a new recipient, triggers extra steps such as a one-time code or a fingerprint scan. Banks, payment firms, crypto exchanges and online services use it to balance security against convenience.

The approach is closely related to risk-based authentication, and the two names are often used for the same idea. "Adaptive" tends to stress that the system learns from each user's history and changes its behaviour over time. It builds on multi-factor authentication by deciding when to ask for the extra factors rather than demanding them every time, and in card payments it is the logic behind the issuer's decision in 3-D Secure 2.

Each time a user tries to log in or carry out a sensitive action, the system collects contextual data and calculates a risk score. Based on that score, it selects one of several responses:

• Allow. The risk is low, so the user continues without interruption, a result known in payments as frictionless authentication.
• Step up. The risk is moderate, so the system asks for an additional factor, such as a one-time password, a push approval in a banking app or a biometric check.
• Block or review. The risk is high, so the attempt is refused or sent to a fraud team, and the user may be contacted through a known channel.

Rules and models are tuned so that most genuine users pass without friction while unusual behaviour faces tougher checks. Scores may be produced by fixed rules, machine-learning models or both, and the decision often feeds a wider transaction risk score used by fraud systems.

• Device. Whether the device has been seen before, identified through device fingerprinting, and whether it shows signs of emulators, rooting or tampering.
• Network and location. IP address, country, use of anonymising services and IP reputation, as well as impossible travel, such as logins from two continents within an hour.
• Behaviour. Typing rhythm, mouse movement and app navigation, analysed through behavioural biometrics.
• History and velocity. Time of day, frequency of attempts, failed logins and recent changes to contact details, often checked through velocity checking.
• Transaction context. Amount, currency, recipient, merchant type and whether the payee is new.

Banks use adaptive authentication at login and when customers add a new payee, change a phone number or raise transfer limits, since these are common steps in account takeover. Card issuers apply it to online card payments through 3-D Secure, using data sent by merchants to approve most transactions silently and challenge the rest. Crypto exchanges apply it to withdrawals to new wallet addresses. In each case the goal is to put friction where fraud is most likely and remove it where it is not.

In the European Economic Area and the United Kingdom, rules under strong customer authentication require two independent factors for most electronic payments and account access. Adaptive approaches fit within these rules in two ways: they decide which factors to ask for and how to present them, and they support the transaction risk analysis exemption, which allows payment providers with low fraud rates to skip strong authentication for some low-risk remote payments up to set value limits. Supervisors expect firms to monitor fraud rates and to be able to explain their risk models. Elsewhere, regulators such as US banking agencies have long called for layered security and risk-based authentication for online banking rather than relying on passwords alone.

The main benefit is a better customer experience with equal or stronger security: fewer genuine users face challenges, which reduces abandoned purchases and support calls, while risky sessions face more scrutiny. Adaptive systems also help defend against automated attacks such as credential stuffing, where criminals test stolen passwords at scale.

There are drawbacks. Models need large amounts of data and careful tuning; poorly set thresholds either let fraud through or block good customers. Collecting device and behavioural data raises privacy questions and must meet data protection law. Skilled fraudsters try to mimic trusted devices and behaviour, and social engineering can still persuade a genuine user to pass a step-up challenge on the fraudster's behalf. Finally, the decision logic is often opaque to customers, who may not understand why they were blocked. Many firms therefore pair adaptive authentication with phishing-resistant methods such as passkey authentication and clear explanations in their apps.

• National Institute of Standards and Technology