---
id: ext-risk-based-authentication
title: "Risk-based Authentication (TS12)"
description: "Protect login and sensitive actions with Strong Customer Authentication using an SCA Attestation presented from the user's EUDI Wallet."
hide_title: false
sidebar_label: Risk-based Authentication
keywords: [Risk-based Authentication, SCA, login, step-up authentication, PSD2, EUDI Wallet, TS12, Organisation Wallet, European Business Wallet, fraud prevention]
slug: /extensions/risk-based-authentication
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import NoteBox from '@site/src/components/NoteBox';
import ApiEndpoints from '@site/src/components/ApiEndpoint';

The Risk-based Authentication extension enables an organisation to protect online banking login and other sensitive actions with Strong Customer Authentication using an SCA Attestation presented from the user's EUDI Wallet. The flow uses the `urn:eudi:sca:login_risk_transaction:1` transaction data type defined in the [TS12 Electronic Payments SCA Implementation with Wallet](https://github.com/eu-digital-identity-wallet/eudi-doc-standards-and-technical-specifications/blob/main/docs/technical-specifications/ts12-electronic-payments-SCA-implementation-with-wallet.md) specification.

## How it works

1. The organisation enables the Risk-based Authentication extension from the dashboard.
2. An administrator defines the protected actions (e.g. login, changing beneficiaries, raising a transfer limit) and the description shown to the user.
3. When a risk engine flags an action as requiring step-up, a presentation request with an `urn:eudi:sca:login_risk_transaction:1` transaction data payload is triggered using the configured presentation definition.
4. The user reviews the action description in their EUDI Wallet and presents an SCA Attestation.
5. The system verifies the presentation, validates the Key Binding JWT (including `amr` with at least two different authentication factors) and approves or denies the action.

## Configuration

### Transaction data

The verification request carries an `urn:eudi:sca:login_risk_transaction:1` transaction data object describing the action the user is authenticating:

| Field | Type | Description |
|---|---|---|
| `transaction_id` | String | Unique identifier for the authentication transaction |
| `date_time` | DateTime | Timestamp of the authentication request |
| `service` | String | Name of the service requesting authentication |
| `action` | String | Short identifier of the action (e.g. `login`, `add_beneficiary`, `increase_limit`) |

### Integration

Once configured, the system automatically generates a **Presentation Definition** bound to the `urn:eudi:sca:login_risk_transaction:1` transaction data type. This presentation definition can be viewed from the extension configuration page and is used when initiating step-up requests via the API.

**API endpoints:**

<ApiEndpoints endpoints={[
  { method: 'get', path: '/v3/config/extension/risk-based-authentication', description: 'Retrieve current configuration' },
]} />

<NoteBox title="Caution:" variant="caution">
Disabling the Risk-based Authentication extension deletes its configuration. This action is not reversible.
</NoteBox>