Step-up authentication is the practice of requiring stronger proof of identity at the moment risk increases, rather than applying the same scrutiny to every interaction. A user might sign in with a low-friction method to check a balance, then face stronger verification before adding a payee or approving a large transfer.

The reasoning is that uniform security is either too weak for the highest-risk actions or too heavy for routine ones, and usually both at once.

Step-up differs from multi-factor authentication, which requires more than one factor at a single point, normally sign-in. It also differs from re-authentication, which repeats the same credential after inactivity; repeating a weak factor confirms only that whoever had the credential still has it. Step-up can also increase the level of assurance.

Common triggers for step-up authentication include transaction value or sensitivity – such as a new payee or a change of registered details – behavioral anomalies such as an unfamiliar location or unusual hour, an unrecognized device, credential recovery and device rebinding, and external risk signals such as credentials appearing in a breach.

The Method Used For Step-Up Determines Its Effectiveness

This is where step-up strategies most often fail. Escalating from a password to a one-time passcode may look like an increase in assurance, but frequently is not. This is because the same social engineering that obtained the password can obtain the code, and a code sent to the device in use provides no separation. The same applies to knowledge-based questions: stepping up to a shared secret steps up to something an attacker may already hold.

A step-up factor is only meaningful if it establishes something the previous one did not, and at the highest-risk moments the missing element is the human. A password confirms a secret is known. A device-bound credential confirms a device is present. Neither confirms who is there.

iProov supports step-up through Flexible Authentication, applying different assurance levels to different risk contexts within a single integration.

Learn More About Step-Up Authentication

Article: Why Choose Face Biometrics for Step-Up Authentication?
Documentation Centre: Step-up MFA
Press: iProov Brings Government-Grade Identity Assurance to the Workforce