Step-up authentication: how to design policies that reduce fraud and friction
Deepak Raj
VP Tech
Summarize this article with
Step-up is not “add friction everywhere.” It is a targeted policy applied to high-risk sessions. Device context is the difference between smart step-up and blanket friction.
Tiered enforcement
Tier 1: trusted devices. Tier 2: new devices or mild risk. Tier 3: high-risk signals (automation, integrity failures, SIM anomalies).
Where to apply step-up
Login, password reset, OTP delivery, beneficiary changes, and high-value payouts.
Start with: Account takeover and SMS fraud.
All article tags
Related Articles
August 13, 2026
How to Detect Mule Accounts: Types, Red Flags & Prevention Strategies
August 10, 2026
How to Identify Account Takeover Fraud: Key Signals & Detection
July 28, 2026
Behavioural Analysis vs Device Intelligence: Which One is Better for Security?
July 23, 2026
How to Prevent Credential Stuffing: 11 Best Security Practices
Identify your web and
mobile traffic in minutes
Collect visitor IDs and signals instantly for free,
or reach out to our team for a demo.
250+
countries and territories where we identified devices_
4 Billion +
unique browsers and mobile devices identified_
50 Million +
real-time device intelligence API events per day processed_