Risk-based authentication is a control that evaluates a login or transaction using context signals such as device posture, IP reputation, location, time, user behavior, and session history. It assigns a risk score and then chooses a response: allow the action, require step-up authentication, or block it entirely.
This matters because not every access attempt deserves the same friction. In defense, it reduces exposure to credential theft, account takeover, and suspicious payments by tightening checks only when the situation looks unusual. In attacks, criminals often try to mimic normal behavior, reuse stolen passwords from familiar networks, or probe weak scoring logic to avoid triggering stronger controls. Effective deployments tune thresholds carefully so legitimate users are not blocked while high-risk activity gets challenged.