Authentication policy

Step-up authentication threshold: 0.55

This case study models 8,000 login attempts to a fintech app, each with an account-takeover risk score from device, location, and behavior signals. A lower threshold requires more logins to pass step-up authentication (a code, biometric check), blocking more takeovers but adding friction for legitimate users.

Day outcome

Logins requiring step-up auth—

True takeovers blocked—

Legitimate users inconvenienced—

Login attempts by takeover-risk score (rose = step-up required, ring = true takeover attempt)