Risk-Based MFA: How to Use IP and Network Signals to Decide When to Step Up Authentication

Introduction

Multi-factor authentication (MFA) is one of the most effective account security controls you can deploy. The hard part is not turning it on. The hard part is deciding when to ask for it.

Prompt too often and real users get annoyed, abandon checkouts, or start approving prompts without reading them. Prompt too rarely and a stolen password is enough to take over an account. Risk-based authentication solves this by asking for a second factor only when the context of a request looks unusual.

This guide covers what MFA is, how the common methods compare, and how to use IP, network, and phone signals to decide when to step up authentication. To be clear up front: Greip does not sell MFA. Your identity provider or auth stack sends the prompt. Greip supplies risk signals that help you decide when that prompt is worth showing.

A 2023 Microsoft Research study of Azure Active Directory accounts found that MFA reduced the risk of account compromise by 99.22% overall, and by 98.56% for accounts with leaked credentials. Source: Microsoft Research, May 2023

What Is Multi-Factor Authentication?

MFA verifies a user with two or more independent factors, so one stolen secret is not enough to get in. The factors fall into three groups:

1. Something you know: a password, PIN, or security answer.
2. Something you have: a phone, hardware security key, or authenticator app.
3. Something you are: a fingerprint, face scan, or other biometric.

A password plus a security question is still single-factor, because both are knowledge. Real MFA combines factors from different groups.

MFA vs 2FA: What Is the Difference?

Two-factor authentication (2FA) is MFA with exactly two factors. Every 2FA setup is MFA, but MFA can use more than two factors when the risk justifies it. In everyday product talk the terms are used interchangeably, and for most login flows a strong second factor is enough.

Common MFA Methods Compared

Not all second factors offer the same protection. Here is how the most common examples of multi-factor authentication stack up:

The same Microsoft study found that dedicated authenticator apps outperformed SMS, though both were far better than no MFA. If SMS is your fallback, read our guide on detecting SIM swap fraud.

Where Always-On MFA Hurts

Prompting on every login sounds safe, but it has real costs:

• Friction: repeat prompts slow down loyal users and hurt conversion on checkout and signup flows.
• MFA fatigue: when prompts are constant, people stop reading them and approve by habit.
• Push bombing: attackers who already have a password flood the user with push requests, hoping one tap gets approved just to make the noise stop.

How Risk-Based Authentication Works

Risk-based authentication, also called adaptive MFA, scores each sensitive request before deciding what to do. A typical flow looks like this:

1. Collect context for the request: IP address, location, network type, device, and account history.
2. Compare it with what is normal for that user.
3. Allow, step up, or block based on the result.

Step up authentication means asking for an extra factor only at the moment the risk rises. A returning user on a familiar network logs in smoothly. The same account on a new hosting network in another country gets challenged.

Signals That Should Trigger a Step-Up

These are the signals worth watching, and where Greip can help:

• New country: a login from a country the user has never used. IP Location Intelligence returns the country and city for any IP.
• VPN, proxy, or Tor: anonymized traffic is not always malicious, but it removes location context. VPN & Proxy Detection flags these connections.
• Hosting networks: real users rarely log in from data center IP ranges, while bots and attack tools often do. Network Intelligence shows the ASN and network owner behind an IP.
• Impossible travel: two logins far apart in too short a time. Greip does not calculate this for you, but the coordinates it returns let you compute it against the previous session.
• Risky phone number: a disposable or invalid number on the account weakens SMS as a factor. User Data Scoring scores phone numbers and emails.

A Sample Step-Up Decision Flow

Here is a simple starting point using fields from the Greip VPN/Proxy Detection docs and phone scoring docs. Tune the rules to your own traffic.

if security.tor is true:
    block or require the strongest factor
else if security.vpn_or_proxy is true or security.hosting is true:
    step up
else if geo.country_code is new for this user:
    step up
else if phone.is_disposable is true:
    step up with a non-SMS factor
else:
    allow without a prompt

Start in log-only mode for a week or two. See how many real users each rule would challenge, then turn the rules on.

Where to Step Up: Login, Password Reset, and Payout Changes

Risk matters most at a few moments:

Login

The most common use. Challenge only logins that break from the user's normal pattern instead of every session.

Password reset

Attackers love reset flows because they skip the old password entirely. A reset from an anonymized or unfamiliar network deserves a second factor before the change goes through.

Payout or bank detail changes

Changing a payout account, withdrawal address, or saved card is where account takeover turns into real money loss. Step up on every change from a risky context, even if the session itself looked fine at login.

Best Practices for Adaptive MFA

• Offer phishing-resistant options such as passkeys, and do not rely on SMS alone.
• Remember trusted devices so low-risk users are not prompted constantly.
• Rate limit MFA prompts to blunt push bombing.
• Log every step-up decision with the signals that triggered it, so you can review false positives.
• Re-check risk at sensitive actions, not only at login.

Compliance Notes

Requirement 8.4 of PCI DSS v4.0 requires MFA for access into the cardholder data environment, and the future-dated parts of that rule became mandatory on March 31, 2025. If you handle card data, MFA for that access is not optional.

Other frameworks, such as GDPR, ask for appropriate security measures without naming MFA as a specific requirement. Adaptive MFA can support that goal, but check your obligations with your compliance team.

What Is Next for MFA

The direction is clear: passkeys and other phishing-resistant MFA based on FIDO2 and WebAuthn. They bind the login to the real site, so a fake page cannot capture a reusable code. Risk signals still matter in a passkey world for account recovery, new device enrollment, and high-value actions.

Conclusion

MFA works, and the data backs it up. The real gains come from asking at the right moments. Use IP location, VPN and proxy flags, network ownership, and phone risk to step up only when something looks off, and let trusted users move without friction.

Greip will not send the prompt for you, but it can tell your auth flow when a prompt is worth showing.