Glossary

Step-Up Authentication

Published 2026-09-05

Step-up authentication raises the verification bar for a specific action rather than for a whole session. A principal might log in with a password for routine browsing and then be asked to reverify — with a second factor, a fresh credential, or an explicit confirmation — the moment it requests something consequential, like changing a payment destination or altering account recovery settings.

This avoids two extremes: demanding the strongest possible verification for every action, which trains people to treat the extra step as noise, and applying only the initial login's verification level to everything that follows, no matter how much riskier a later action becomes.