Step-up authentication: how to design policies that reduce fraud and friction
Deepak Raj
VP Tech
Summarize this article with
Step-up is not “add friction everywhere.” It is a targeted policy applied to high-risk sessions. Device context is the difference between smart step-up and blanket friction.
Tiered enforcement
Tier 1: trusted devices. Tier 2: new devices or mild risk. Tier 3: high-risk signals (automation, integrity failures, SIM anomalies).
Where to apply step-up
Login, password reset, OTP delivery, beneficiary changes, and high-value payouts.
Start with: Account takeover and SMS fraud.
All article tags
Related Articles
Identify your web and
mobile traffic in minutes
Collect visitor IDs and signals instantly for free,
or reach out to our team for a demo.
250+
countries and territories where we identified devices_
4 Billion +
unique browsers and mobile devices identified_
50 Million +
real-time device intelligence API events per day processed_