FIG. 6 presents a flow chart illustrating operations a client performs during the authentication process in accordance with the disclosed embodiments. First, the client sends a query to the query component asking to authenticate a user (step 602). The client then receives a security score from the query component in response to the query (step 604). Then, the system determines whether the security score is greater than a threshold (step 606). (Note that the threshold can be different for different services and actions.) If the security score is greater than the threshold (YES at step 606), the client authenticates the user (step 612). In some embodiments, this may involve combining a cryptographically signed response received from the query component with local cryptographic data to perform the authentication operation.

In some embodiments, instead of using the security score for an authentication decision, the security score is used to detect fraud. In these embodiments, the security score is fed to a fraud/risk engine, which makes a determination about whether an interaction may be fraudulent, and if so performs some action, such as: blocking the transaction; flagging the transaction as potentially fraudulent; or logging the transaction to be investigated at a later time.

Otherwise, if the security score is not greater than the threshold (NO at step 606), the client causes a challenge to be issued to the user (step 608) either on the same device or on a different device. The challenge can be an “active challenge” that requires the user to perform some action, or a “passive challenge” that happens unbeknownst to the user and requires the system to obtain more-detailed sensor data or perform more-sophisticated processing of the sensor data.