Risk-Based Authentication

Risk-based authentication (RBA) is a security approach in which the strength of identity checks varies with the assessed risk of each event, such as a login, a new payee or a card payment. Low-risk events pass with little or no friction, while higher-risk ones trigger extra steps, such as a one-time passcode, a biometric check or a call to the customer, or are blocked outright. Banks, card issuers, payment providers, merchants and online services use it to reduce fraud without forcing every user through the same hurdles.

Risk-based authentication is closely related to adaptive authentication, and the two terms are often used interchangeably. In card payments it is the logic behind 3-D Secure 2, where issuers decide whether a transaction can be approved through frictionless authentication or needs a challenge flow. In the European Economic Area and the United Kingdom it operates within the rules on strong customer authentication (SCA).

Each event is scored in real time using information about the user, the device, the context and the transaction. A rules engine, a machine learning model or both produce a transaction risk score, which is mapped to an action:

• Allow. The event matches the user's normal pattern and proceeds without extra steps.
• Step up. The system asks for additional proof, such as a code sent to a registered phone, an app approval or a fingerprint, as in multi-factor authentication.
• Review. The event is held for an analyst or confirmed with the customer by another channel.
• Deny. The event is blocked because the risk is too high.

Thresholds are tuned to balance fraud losses against customer friction, and can differ by product, channel and customer segment.

Typical inputs include:

• Device data. Whether the device has been seen before, its configuration and integrity, gathered through device fingerprinting.
• Network and location. IP address, IP reputation, use of proxies or anonymising services, and whether the location is consistent with the user's history.
• Behaviour. Typing rhythm, navigation patterns and other behavioural biometrics that distinguish the real user from a bot or fraudster.
• Transaction details. Amount, merchant, payee, time of day and how these compare with past activity, including unusual frequency picked up by velocity checks.
• Account events. Recent password resets, changes of phone number or address, and new payees, which often precede account takeover.

3-D Secure 2 was designed around risk-based decisions. Merchants send the issuer far more data than earlier versions allowed, including device and order details, and the issuer's access control server scores the transaction. Most transactions can be approved without the cardholder seeing anything, while risky ones are challenged. Merchants and acquirers can also run their own risk analysis and request that the issuer applies an exemption, accepting liability for fraud if they do.

Under the regulatory technical standards that implement PSD2, payment service providers must normally apply SCA to electronic payments initiated by the payer. Risk-based authentication is permitted mainly through the transaction risk analysis exemption, which lets a provider skip SCA for remote electronic payments that its real-time analysis rates as low risk, provided the provider's fraud rate for that type of transaction stays below set reference levels. The allowed transaction value rises as the fraud rate falls, with bands at €100, €250 and €500, so providers with better fraud performance can exempt larger payments. Other SCA exemptions, such as low-value or trusted beneficiary exemptions, have their own conditions. Outside Europe, risk-based approaches are generally encouraged rather than prescribed.

Risk-based authentication reduces abandoned checkouts and frustrated customers, because most users rarely see a challenge, while concentrating defences where attacks are likely. It also adapts as fraud patterns change, especially when models are retrained on new data.

Its weaknesses are the quality of its data and models. Fraudsters can imitate normal behaviour, use compromised devices or socially engineer customers into completing step-up checks themselves, as in authorised push payment scams. Poorly tuned models generate false positives that block genuine customers, which can fall unevenly on travellers, new customers or people with unusual patterns. The collection of device and behavioural data also raises privacy questions, so firms must comply with data protection law and explain their use of such data.