Adaptive Authentication

Overview

How it works and why it matters

Adaptive authentication adjusts authentication checks according to risk signals such as device familiarity, unusual location, attempted action, transaction size and account history. A routine balance view may need fewer steps than adding a new payout beneficiary. The system must resist attackers who manipulate signals and avoid locking out legitimate users without recovery options. Decisions should be logged so unusual approvals can be investigated later.

Technical context

The control exists to ensure that only appropriately identified and authorized principals can access resources or approve actions at the required level of assurance.

It differs from fixed multi-factor authentication because the challenge, assurance level, or access decision can vary with device, location, transaction, session, and anomaly indicators.

Sensitive secrets and authentication content should not be copied unnecessarily into logs.

Practical checks

Base step-up prompts on signals such as unfamiliar device, new beneficiary, unusual amount and recent credential recovery, but avoid a single easily spoofed location signal. Require transaction-bound approval for high-risk transfers and provide a secure process when legitimate operators lose their usual authentication device.

Related concepts

Authentication Failures; Phishing; Access Control List (ACL)