Step-up authentication is the practice of requiring additional or stronger verification at a specific moment (when a user attempts a sensitive action or when risk signals rise) rather than at every login. It applies friction surgically, exactly when the stakes or the risk justify it.

Think of it as authentication that escalates on demand. A customer browses and checks a balance with a light touch; the moment they try to add a payee or wire funds, the system asks for a stronger proof. The friction lands where it’s warranted and nowhere else.

When step-up is triggered

Two categories of trigger drive step-up:

• Action-based, the sensitivity of what the user is trying to do. Moving money, changing account details, adding a beneficiary, or viewing sensitive data.
• Risk-based: signals suggesting the session may not be the legitimate user: a new device, an unusual location, anomalous behavior, or a rising fraud score.

Often both combine: a sensitive action from a risky context gets the strongest challenge, while the same action from a fully trusted device may pass with minimal friction.

How step-up fits with risk-based authentication

Step-up is the action half of risk-based authentication. RBA does the scoring; step-up is one of the responses it can invoke. In an orchestrated system, a rising risk score or a sensitive-action trigger automatically inserts the right extra factor (a passkey confirmation, a biometric, a one-time proof) into the journey, then returns the user to what they were doing.

Getting step-up right

The art is calibration. Too aggressive and you frustrate legitimate customers with constant challenges; too passive and you leave sensitive actions underprotected. The strongest step-up uses phishing-resistant factors (a passkey or biometric) rather than a phishable code, so the escalation actually raises assurance instead of just adding a hurdle an attacker can also clear. Well-tuned, step-up is nearly invisible to good users and a hard wall for fraud.

Where step-up matters most

Certain moments justify step-up almost regardless of risk score, because the consequences of getting them wrong are severe:

• Money movement: transfers, wires, adding a new payee, or raising limits.
• Profile and security changes, updating email, phone, password, or MFA settings, since these are how attackers lock a victim out and cement a takeover.
• Account recovery, re-establishing access is a prime attack target, so a strong verification here (ideally a fresh identity check rather than knowledge questions) is critical.
• High-value or unusual transactions, anything outside the customer’s normal pattern.

Notably, changing security settings deserves as much protection as moving money, an attacker who swaps the recovery email has effectively taken the account. Mapping these sensitive actions to step-up, and combining them with risk signals, is how institutions protect the moments that matter without taxing everyday activity.

Frequently asked questions

When should step-up authentication be triggered?

For sensitive actions (like moving money) and when risk signals indicate a session may not be the legitimate user.

How is step-up different from MFA?

MFA can apply at every login; step-up applies additional verification selectively, at high-risk or high-value moments.

What’s the best factor for step-up?

A phishing-resistant one like a passkey or biometric, so the escalation raises assurance.

Which actions should always trigger step-up?

Money movement, changes to security settings (email, phone, MFA), and account recovery, the moments an attacker most wants to exploit.

Related: Risk-Based Authentication · Multi-Factor Authentication (MFA) · Identity Orchestration · Passkeys · Continuous Authentication