Risk-based/Adaptive Authentication
Overview
Risk-based authentication (RBA) is a security mechanism that dynamically assesses the risk level of a user's login attempt or transaction based on their historical behavior and contextual factors. Unlike static authentication methods, RBA adapts real-time security measures by analyzing parameters such as location, IP address, device, browser, and user behavior.
When an authentication attempt deviates from a user's typical behavior, RBA triggers additional security actions, such as requiring multi-factor authentication (MFA), blocking access, or notifying the user of potential fraud.
Key Features of RBA
- Risk Assessment Factors – Evaluates login attempts based on:
- IP address and geolocation
- Browser and operating system
- User behavior patterns
- Risk Scoring – Assigns a risk score to each login attempt based on deviations from normal behavior.
- Adaptive Authentication – Implements actions such as step-up authentication, transaction monitoring, or access restrictions based on risk levels.
Use Cases of RBA
- Preventing Unauthorized Account Access – Banks detect and prevent suspicious logins from unknown locations or devices.
- Mitigating Payment Fraud in E-Commerce – Online retailers verify high-risk transactions by requiring additional authentication.
- Enhancing Enterprise Security – Businesses secure corporate accounts by identifying and blocking high-risk access attempts.
Benefits of RBA
- Improved security against identity theft and fraud
- Reduced friction for legitimate users
- Adaptive protection with real-time risk analysis
Configuration
- Manage Risk Factors
- Additional Settings
Configuration Steps:
- Navigate to Risk-Based Authentication in the Admin Console.
- Enable risk factor tracking (City, Country, IP, Browser, Device).
Configuration Steps:
- Configure response actions (MFA prompts, alerts, access restrictions).
- Add admin emails for risk notifications.
- Customize email/SMS templates for risk alerts.