Card-not-present payments lack the physical and visual checks that exist in store, so the issuer has to infer legitimacy from context. Step-up authentication helps when risk signals are weak or inconsistent, because it adds higher-confidence proof before the transaction is approved. Without it, fraudsters can exploit thin evidence and legacy flows.
Why step-up exists in card-not-present flows
Card-not-present transactions rely on signals that are weaker than an in-store purchase. The merchant cannot inspect the card, the cardholder, or the physical environment, so the issuer has to judge legitimacy from device, network, behaviour and historical context. When those signals are thin, step-up raises confidence before approval and helps separate genuine customers from fraud.
That matters because card-not-present fraud often succeeds by exploiting exactly those blind spots. A transaction can look normal at first glance, yet still be materially risky if the account is newly used, the device is unfamiliar, the velocity is odd, or the purchase pattern does not fit the customer.
How issuers decide when to challenge
Step-up authentication is usually triggered by risk-based decisioning, not by a fixed rule that every transaction must follow. The issuer or payment flow looks for combinations of weak evidence, anomaly, high-value spend, unusual geography, account change events, or other signals that make the transaction harder to trust.
In practice, the decision is less about whether a transaction is technically possible and more about whether the current evidence is strong enough to let it pass without extra proof. That is why step-up is common in checkout, cardholder verification, account access, and payment approval paths that share the same identity risk surface.
- Low-risk traffic can pass with minimal friction.
- Higher-risk traffic is challenged for additional proof.
- Very suspicious traffic may be declined outright rather than stepped up.
What step-up changes for fraud and customer experience
Step-up is a control for balancing fraud reduction and conversion. If the control is too aggressive, legitimate customers abandon checkout. If it is too weak, fraudsters can exploit thin evidence and push stolen credentials, synthetic profiles, or compromised accounts through the flow.
For that reason, the best design is selective, context-aware and recoverable. The issuer should be able to explain why a challenge happened, what evidence triggered it, and how the user can complete it without creating a new path for takeover or account recovery abuse.
Risk and Threat Considerations
Card-not-present payments are attractive to fraudsters because the usual physical checks are absent and many fraud decisions depend on incomplete context. If the challenge policy is poorly tuned, attackers can abuse weak authentication flows, test stolen data at scale, or pivot through account recovery paths that are easier to game than the payment itself.
Failure mechanism: The system relies on thin contextual signals, so a stolen card or compromised account can look legitimate enough to clear unless a higher-confidence check interrupts the transaction.
Impact: Weak step-up logic increases carding, account takeover, chargebacks and false approvals, while over-challenging legitimate customers increases cart abandonment and support burden.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL — Identity Assurance Level | Card-not-present step-up relies on stronger proof when contextual evidence is weak. |
| Recommendation — Use higher-assurance authentication when transaction risk exceeds baseline confidence. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Cardholders are external users whose payment flows need stronger authentication controls. |
| Recommendation — Apply external-user authentication controls to raise confidence before approving risky payments. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Step-up often depends on federated sign-in and reauthentication patterns in customer flows. |
| Recommendation — Enforce strong reauthentication steps when customer risk signals require additional proof. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Step-up is an access decision that limits approval when confidence is insufficient. |
| Recommendation — Define access decision criteria that require additional proof for elevated-risk actions. | ||
Practitioner Guidance
What to verify: Treat step-up as a fraud-control decision, not a generic MFA toggle. Verify that the trigger model is using signals that are hard for attackers to imitate, such as device consistency, account age, transaction pattern and recent recovery activity, rather than only amount thresholds.
Decision rule: If the transaction depends on weak or inconsistent evidence, challenge it before approval; if the risk signal is strong but not conclusive, prefer step-up over blind decline so you preserve legitimate conversion. Reserve hard declines for repeated abuse, clear bot behaviour or obvious fraud patterns.
Practitioner takeaway: Step-up works best when it is selective and evidence-driven, because the goal is to add confidence exactly where card-not-present commerce is most exposed, not to burden every customer equally.
Related resources from NHI Mgmt Group
- Why do organisations still need step-up verification after strong authentication is in place?
- Why do passwordless programmes still need MFA and step-up authentication?
- Why do ephemeral credentials still leave risk in machine access models?
- Why is it crucial to adopt new authentication methods in MCP usage?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org