How should banks balance step-up authentication with device trust checks?

Why step-up authentication and device trust are different control layers

Step-up authentication answers a narrow question, can the person who is acting prove themselves strongly enough for this transaction. Device trust answers a different one, is the handset or browser session itself in a condition that should be allowed to approve value-moving activity. Banks need both because a valid user challenge does not neutralize a compromised device, and a clean device posture does not prove the current user is the legitimate actor.

That distinction matters most in mobile banking and payments, where the approval channel is often the same device used to initiate the transaction. If the handset is rooted, jailbroken, malware-infected, or being controlled through session theft, the attacker can still observe prompts, relay approvals, or ride a legitimate session.

For that reason, device trust should be treated as an input to the authorization decision, not as a cosmetic trust badge. The approval outcome should depend on the transaction context, the device posture, and the session state together. A bank that only escalates challenge strength without checking device integrity is relying on a single barrier that may already be inside the attacker’s control.

What banks should tie to transaction context

A practical model is to reserve the strongest checks for the combination of high-risk action and weak trust signals. Small, low-risk actions may not justify friction, but adding a new payee, changing payout details, raising limits, or approving an out-of-band transfer should trigger stronger binding between the user, the device, and the transaction details.

That binding should be specific, not generic. The approval should reflect what is actually being authorised, including amount, beneficiary, device, geolocation or network anomalies where appropriate, and whether the session has suspicious characteristics such as recent re-authentication, multiple failed attempts, or rapid device switching.

In practice, this means banks should avoid treating step-up as a one-time checkpoint. The stronger design is contextual authorization, where the device and session posture influence whether the transaction proceeds, whether it is held for review, or whether a different approval path is required. Customer IAM (CIAM) Guide covers the step-up authentication patterns and risk-based decisions that underpin this model.

How device trust reduces approval fraud and session abuse

Device trust is most useful when it helps detect that the approval path itself is unsafe. A device with signs of tampering or malware may still complete a biometric or push challenge, but the result cannot be assumed trustworthy if the endpoint is able to intercept notifications, replay tokens, or manipulate the application flow.

That is why banks should prefer device signals that are hard to fake and that are evaluated continuously rather than only at enrollment. Secure device identity, attestation, OS integrity, and app-level runtime checks provide more value than simple fingerprinting or passive reputation alone. Device and IoT Identity Guide is useful here because it frames device trust around identity, attestation, onboarding, and lifecycle, not just hardware inventory.

The operational point is that device trust should narrow the set of devices that can meaningfully approve sensitive transactions, while step-up should narrow the set of users who can act. Used together, they reduce both account takeover and device-side approval interception. NIST SP 800-63 Digital Identity Guidelines is a strong external reference for authenticator strength and phishing-resistant sign-in, while MFA Guide explains why stronger user verification still needs to be paired with resistance to relay and token theft.

Risk and Threat Considerations

The main risk is assuming that stronger user authentication automatically makes the transaction trustworthy. In mobile banking, an attacker who already controls the device or session can often wait for the legitimate user challenge, then capture, relay, or replay the approval at the right moment.

Failure mechanism: The bank authenticates the user but does not verify that the device and session are trustworthy enough to approve the transaction, so malicious control of the endpoint can subvert the approval path even after step-up succeeds.

Impact: Fraudulent transfers, beneficiary changes, and limit increases can be approved with valid credentials and valid user interaction, which makes the abuse harder to distinguish from normal customer activity and raises the chance of delayed detection.

Practitioner Guidance

What to prioritise: Treat high-value and irreversible actions differently from routine sign-in. If the event can move money, change payout destinations, or alter recovery paths, require both strong user verification and a device trust decision before allowing the transaction to complete.

What to verify: Confirm that the device trust signal is tied to the current device and current session, not just to a previously enrolled handset. Verify that the approval cannot be completed from a copied session, a browser handoff, or a stale push approval flow.

Decision rule: If device integrity is unknown or degraded, step-up alone should not be treated as sufficient for a sensitive transaction. Either downgrade the action, route it to an alternate control, or require a stronger attested device before approval is accepted.

Practitioner takeaway: The safest banking pattern is not “authenticate harder”, it is “authorise only when the user, the device, and the transaction all agree.”

Related resources from NHI Mgmt Group

• How do passkeys fit into step-up authentication and zero trust?
• How should financial services teams balance step-up authentication with a low-friction returning user experience?
• How should security teams implement step-up authentication in a Next.js app without relying only on client-side checks?
• How should consumer applications implement zero trust step-up authentication without creating too much friction for legitimate users?