Step-up authentication

Asking for extra proof of identity, but only when a specific action, such as a large transfer, a new device, or a change to account recovery settings, raises the risk.

A customer might open a banking app with a quick fingerprint scan, then be asked for a one-time code or a fresh selfie before sending money to a new payee. Routine activity stays smooth, and the risky moment gets a second look.

Risk-triggered escalation to a stronger method of authentication or a fresh biometric check. The service starts a session with a baseline login, then raises the bar mid-session when something about the request looks riskier than the proof it already has.

A typical step-up flow works like this:

1. The person signs in with a baseline method, such as a password or passkey.
2. The service evaluates risk signals around each request, such as the action requested, the device, the location, and the pattern of behavior.
3. If the risk crosses a threshold, the service asks for a stronger proof.
4. A pass lets the action continue. A fail blocks it or sends the case for review.

The extra proof can take several forms:

• Passkeys or security keys that resist phishing.
• One-time passcodes (OTPs) sent to a phone or email.
• A fresh face match with liveness detection, which compares a new selfie with the face on file and confirms a real person is present.

Step-up authentication sits next to terms that are easy to mix up:

• Multi-factor authentication (MFA) requires more than one kind of proof every time, while step-up adds a check only when risk calls for it.
• Re-verification re-checks the person's identity against the record captured at enrollment, which goes further than asking for another login proof.