Risk-Based Step-Up & Account Recovery
Read risk from device, network and behaviour without hoarding data, decide when to ask for more, keep step-up from stranding users, and harden the recovery door attackers love most.
Requires: Threat Modeling OTP Flows
Chapters
- 1
Signals of risk: device, network, behavior (privacy-aware)
Which signals actually separate an owner from an attacker, how to collect them with minimal data, and why every signal needs a decay date.
6 min read
- 2
Policy design: when to ask for more
Combine action sensitivity with risk facts in a small, testable matrix. Decide what “more” means, how long it lasts, and how to keep policy reviewable.
6 min read
- 3
Step-up UX that doesn't strand users mid-flow
Interrupt at the right moment, preserve the user’s work, offer the strongest factor they actually have, and always leave a safe way forward.
5 min read
- 4
Account recovery as the softest door — hardening it
Recovery bypasses every factor by design. Map its paths, rank the evidence each accepts, add delay and notification, and stop recovery from downgrading strong accounts.
6 min read
- 5
Failure modes: loops, lockouts, social engineering of support
The ways risk-based auth fails real people — endless challenge loops, permanent lockouts, persuasive callers — and the design patterns that prevent each.
6 min read