Step-Up Authentication Stops Impostors, Not Scams: Securing the Session After Login
Login proves who started a session, once. The fraud that costs most happens later, often by the real customer following a scammer's instructions. Three questions a session has to keep answering, why a second factor fails a coached customer, and where to buy and where to build.
Most customer identity work ends at the login page. The fraud that costs most starts after it.
Login proves who started a session, once. Everything that moves money happens later: adding a payee, raising a limit, changing the phone number that receives the codes. In 2025, US consumers reported $15.9 billion in fraud losses to the Federal Trade Commission, and impostor scams were the most reported kind, at more than $3.5 billion. In the UK, authorised push payment fraud rose 19% to £576.4 million. In that kind of fraud the login works by definition: the customer signs in and sends the money themselves.
Generative AI makes these scams cheaper to run. Deloitte projects that fraud losses enabled by generative AI could reach $40 billion in the US by 2027, up from $12.3 billion in 2023. A cloned voice or a convincing script doesn’t need to beat your login. It only needs to reach your customer.
A strong login is still necessary. It is no longer enough. The session has to keep checking.
What step-up and continuous authentication mean
Step-up authentication asks a signed-in user to prove who they are again, with a stronger method, before a sensitive action. Continuous authentication keeps checking during the session, using signals such as device, network, location and behaviour, and decides when a step-up is needed. Risk-based authentication, also called adaptive authentication, is the policy that connects the two: low risk passes quietly, high risk gets challenged.
The plumbing is standard. RFC 9470, published by the IETF in September 2023, defines how an API tells an app that the current sign-in is too weak or too old for a request. The app then sends the user back for a stronger one. The hard part is deciding when to ask, and what to ask for.
Three questions a session has to keep answering
Login answers one question at one moment: is this the right person? A session that moves money has to keep answering three, and each needs a different response.
1. Is it still the same person?
This is session takeover. A new device appears mid-session, the network jumps countries, a session token is replayed from somewhere else, or the customer’s phone number moved to a new SIM card yesterday.
The response is a step-up with a factor the attacker is unlikely to hold: a passkey, or a biometric check on a device the customer already trusts. A text-message code is the wrong choice here, because a SIM swap hands the attacker the texts. That is one reason the Central Bank of the UAE told banks to move away from SMS and email one-time passwords toward biometrics and soft tokens. It also asked for real-time fraud monitoring that can suspend a session, with a March 2026 deadline.
2. Are they acting freely?
This is the scam. The customer is real, signed in on their own phone, and following a stranger’s instructions. Behavioural platforms look for the signs: an active phone call during a transfer, a remote-access app running on the device, long pauses before a payment, an account number pasted instead of typed.
3. Is this action normal for them?
This one is about the action. A first payment to a new payee, a limit raised minutes before a large transfer, a changed email followed by a password reset. Each can be legitimate. Each is also how most takeovers and scams end.
Why a second factor fails against a coached customer
Step-up authentication answers “is this the right person?” Against a coached customer, the answer is yes. They have the phone, the face and the passkey. They pass the challenge, and the money leaves.
It can be worse than useless. Scammers often tell the customer that a security check is coming. When the challenge arrives on cue, it makes the scammer’s story more convincing.
The responses that work break the script:
- A short hold on a first payment to a new payee, long enough for the call to end.
- A warning that names the scam in plain words: your bank will never ask you to move money to a safe account.
- One direct question, such as whether someone on the phone asked for this payment, where the answer changes what happens next.
- A callback from the bank on a number the customer already knows.
The cost of getting this wrong has also moved. Since October 2024, UK payment firms have had to reimburse most victims of authorised push payment fraud. In 2025, £354.3 million went back to victims, about 61% of the losses. When the provider pays for the scam, interrupting it becomes a product requirement.
Score the action, not only the login
Account changes are the quiet front door. Changing the phone number or email redirects every future code. Enrolling a new device hands out a permanent key. So I would put a risk decision on each sensitive action, in addition to the one at the start:
| Action | Why it matters | Response |
|---|---|---|
| First payment to a new payee | Most scams end here | Hold and warning; step up if device signals look wrong |
| Raising a transfer limit | Often comes right before a large transfer | Cooling-off period, confirmed on a trusted device |
| Changing phone number or email | Redirects every future code and reset | Step up with the existing factor and notify the old contact |
| Enrolling a new device or passkey | Gives the holder a permanent key | Approve from a device the customer already trusts |
| Checking a balance | Low risk | No challenge |
The last row matters as much as the others. A policy that challenges everything trains customers to approve everything.
When an AI agent is in the session
Customers are starting to let AI agents act for them: paying bills, booking, buying. That breaks behavioural signals. An agent has no typing rhythm and no swipe pattern, and it often runs from a cloud network. A behavioural model will either flag every agent or learn to ignore them, and neither outcome is safe.
For agents, the answer comes from identity. The agent gets its own delegated credential: who it acts for, which actions it can take, and for how long. When it reaches an irreversible step, such as a payment to someone new, the challenge goes to the person behind it. It is the rule I apply to the agents I work on: reversible steps run alone, and the commit waits for a person. I wrote about the identity side in identity for AI agents, explained for product teams.
Buy the signals, build the policy
For a company running many products on one identity platform, I would split the work this way.
Buy the signals. Behavioural biometrics, device and network intelligence, and phone-number checks such as a recent SIM swap get better with traffic from many banks and apps. Most single companies don’t see enough fraud to train them well. That work belongs with a specialist that plugs into the identity provider you already run.
Build the policy. Which actions are risky in your products, which response fits which risk, and how much friction each product can carry are business decisions. Put them in one shared service that every product calls, so 200 products don’t each invent their own version of step-up.
It is the session version of a rule I already use: buy authentication, build entitlements. The platform I lead works this way at login. Multi-factor rules are configurable per customer domain and per product, with requirements set by clients and product teams. Session risk is the same decision, stretched across the whole session.
One caution: treat behavioural signals as personal data. Collect the minimum, keep scores instead of raw keystrokes where you can, and tell customers in plain language what you check.
Four numbers that tune the policy
- Challenge rate: the share of sessions or actions that get a step-up or a hold.
- Pass rate: how many genuine customers clear the challenge.
- Drop-off: how many customers abandon after a challenge.
- Fraud loss per million in payments, broken down by action.
Read them together. A rising challenge rate with flat losses means good customers are paying for nothing. Falling losses with rising drop-off means the friction is landing on customers you wanted to keep.
Login is one checkpoint. The money moves later, so identity work now runs until the customer signs out.
