Step-up Authentication
Step-up authentication is a security procedure in which a system requires an additional identity check in the middle of a session — but only when an action is particularly sensitive. This keeps everyday use convenient without sacrificing security.
Anyone who opens an app logs in once — and is then in. But some actions are riskier than others. A banking app lets you check your balance without asking any questions. But if you want to transfer 5,000 euros, it suddenly demands a PIN or a fingerprint. That is exactly what step-up authentication is: the system raises the security requirement in the middle of the session — not across the board for everything, but specifically for sensitive actions.
Why step-up authentication exists
Security and convenience usually get in each other’s way. Anyone who has to enter their password with every click gets annoyed. Anyone who checks nothing at all risks a stranger being able to do anything with a stolen device. Step-up authentication is the compromise: low risks remain frictionless, high risks trigger an extra check.
The principle also has a legal side. In the EU, the PSD2 payment services directive requires banks to demand so-called Strong Customer Authentication for transfers above a certain amount — meaning at least two independent verification steps. Step-up authentication is the technical implementation of this requirement in practice.
How the system decides when to step up
In the background, a risk module evaluates every request. It takes various factors into account: How large is the amount? Is the request coming from a known device? Is the time of day unusual? Has the location just changed abruptly? These signals combine to produce a risk score.
If the risk score exceeds a threshold, the system triggers the step-up. The user then has to confirm a second factor — for example, an SMS with a one-time code, a fingerprint, or a confirmation in a separate app. Only afterward does the system carry out the action. If the risk stays low, nothing happens at all — the user doesn’t even notice the mechanism.
A common misconception: step-up authentication is not a new login. The original session keeps running. The system only briefly raises the requirements for a single critical action, after which the security level drops back to normal.
Where step-up authentication shows up in everyday life
The procedure is most commonly encountered in online banking and payment apps like PayPal or Apple Pay. Checking your account balance works without an extra step, sending money does not. Large e-commerce platforms use it too: Amazon, for instance, requires re-entering your password for certain purchases even though you’re already logged in.
Enterprise software uses step-up authentication as well. Anyone logging into their company account in the morning can read emails. But if they want to access the HR system containing all employees' payroll data, the system demands a second factor. This way, companies protect particularly sensitive data without holding up every employee at every login.
In news and product reports, the term often comes up in connection with identity platforms like Okta or Microsoft Entra. These services offer step-up authentication as a configurable tool: administrators determine which actions receive which risk score — and what the system then demands.