Step-Up Authentication

Step-up authentication is a security approach in which a system asks for stronger proof of identity at the moment a user attempts something sensitive, instead of applying the strongest check to every interaction. A customer might view their balance after signing in with a password, but be asked for a fingerprint or a one-time code before sending money to a new recipient. The extra check is the step up.

The idea is closely tied to risk-based authentication, which decides when the step up is needed. It is used by banks, wallets, card issuers and merchants to balance two aims that pull against each other: stopping fraud and keeping payments quick for genuine customers. In card payments the best-known form is the challenge in EMV 3-D Secure.

Every session or transaction is assessed against a set of signals. If the assessment finds low risk, the action proceeds with the authentication already performed. If risk is higher, or if a rule requires it, the system pauses the action and asks for an additional factor. If the user passes, the action continues. If they fail or abandon the check, it is blocked.

The additional factor comes from one of the standard categories: something the user knows, something they have or something they are. Common methods are a one-time password sent by text message or generated by an app, a push notification to be approved in a banking app, biometric authentication on the user's device, a hardware security key, or answers to questions drawn from records, known as knowledge-based authentication. Stronger methods bind the approval to the specific amount and payee, so that a code obtained by a fraudster cannot be reused for a different payment.

• The action itself. Adding a payee, changing a phone number or address, raising a limit, viewing full card details or adding a card to a wallet.
• Transaction features. An unusually large amount, a new merchant or country, or a pattern caught by a velocity check.
• Device and location. A device not seen before, signs of emulation or remote access, or a location inconsistent with the customer's history, detected through device fingerprinting.
• Behavior. Typing, navigation or timing that differs from the customer's usual pattern, measured by behavioural biometrics.
• Model output. A risk score above the level at which the business is willing to proceed without more evidence.

In an online card purchase, the merchant sends transaction and device data through 3-D Secure to the card issuer. The issuer's risk engine decides between two outcomes. In a frictionless flow the issuer is satisfied by the data alone and authenticates the cardholder without any interaction. In a challenge flow the issuer steps up, and the cardholder is asked to approve the payment in their banking app or enter a code.

In the European Economic Area and the United Kingdom, strong customer authentication rules make two-factor checks the legal default for electronic payments, with exemptions for low-value, low-risk and certain recurring transactions. Step-up logic there works in reverse: the question is when an exemption can be used to avoid the challenge. Elsewhere, including the United States, challenges are discretionary and issuers step up only a small share of transactions. A successful authentication generally moves fraud liability from the merchant to the issuer.

Banks and wallets use step-up within a logged-in session. Low-risk tasks need only the initial login, while payments to new beneficiaries, large transfers and profile changes need a fresh check. The same applies in call centers, where an agent may send a code to the caller's registered phone before discussing an account. In open banking, a customer is redirected to their bank to authenticate before a third party can access data or initiate a payment.

Card issuers also apply step-up when a card is added to a mobile wallet from outside the issuer's own app, typically by sending a code or asking the cardholder to call, before the token is activated.

Every challenge adds friction. Some customers abandon a purchase when asked for a code, messages arrive late or not at all, and people travelling may not have access to their registered phone. Merchants and issuers therefore track challenge rates and completion rates and tune their thresholds. Too few challenges let fraud through, and too many cost sales.

The strength of the step-up method matters as much as the decision to use it. Codes sent by text message can be intercepted through SIM swap fraud or obtained by tricking the customer into reading them out. Authentication also does little against scams in which the genuine customer is persuaded to make the payment themselves and willingly completes every check. For those cases banks add warnings, delays and payee name checks to the step-up process.

• EMVCo: EMV 3-D Secure
• FIDO Alliance