Flexible authentication

1. A method, comprising:

categorizing, by a system comprising a processor, a set of financial interactions into different levels of authentication;

designating, by the system, an authentication policy for each level of authentication;

evaluating, by the system, an interaction of the set of financial interactions being performed at a device, wherein the interaction is performed over a communication link enabled between a financial entity and the device, and wherein evaluating the interaction includes:

assigning a risk level based on whether the interaction indicates an anomaly relative to a historical pattern of interactions previously performed by the device,

assigning a confidence level based on a characteristic of the device or an indicator of an identity of a user of the device, and

assigning, for the interaction, a level of authentication based on the risk level and the confidence level, wherein assigning of the level of authentication includes: (i) identifying a set of rules associated with the interaction, the set of rules being defined by a matrix; (ii) selecting, from the matrix, a rule of the set of rules based on the assigned risk level and confidence level; and (iii) applying the rule to the interaction to determine at least one type of authentication required to authenticate the device before approving the interaction;

as a result of the evaluating, causing a security challenge to be outputted at the device, wherein the security challenge comprises a prompt to perform a set of passive and active actions, wherein the set of passive and active actions are determined based on the at least one type of authentication identified by the level of authentication, wherein a passive action of the set of passive and active actions identifies an action to be performed by the device without user input, and wherein an active action of the set of passive and active actions identifies an action to be performed by the user of the device;

authenticating the user of the device based on a result of the set of passive and active actions meeting a predetermined threshold for the level of authentication; and

approving, by the system, performance of the interaction at the device based on authenticating the user.

2. The method of claim 1 , wherein approving performance of the interaction comprises continuing the enablement of the communications link between the device and the financial entity as a function of an expected response to the security challenge.

3. The method of claim 1 , wherein not approving performance of the interaction comprises disabling the communications link between the device and the financial entity based on an unexpected response to the security challenge.

4. The method of claim 1 , wherein assigning a confidence level to the interaction further comprises:

determining a location where initiation of the interaction occurs; and

evaluating historical information associated with the location.

5. The method of claim 1 , further comprising requesting a third-party token or a biometric identification as at least a portion of the security challenge.

6. The method of claim 5 , wherein the biometric identification is captured without alerting the user.

7. The method of claim 1 , wherein the passive action comprises providing one or more of an external security token, a secure token, or a session token.

8. The method of claim 1 , wherein the active action comprises receiving one or more of: audio from the user, an image of the user, or a response to a security question from the user.

9. The method of claim 8 , wherein the image of the user comprises an image of one or more of the user's face, eye, or finger.

10. The method of claim 8 , wherein the audio from the user is compared to a voiceprint of the user.

11. A system comprising:

a processor configured to:

categorize a set of financial interactions into different levels of authentication;

designate an authentication policy for each level of authentication;

evaluate an interaction of the set of financial interactions being performed at a device, wherein the interaction is performed over a communication link enabled between a financial entity and the device, and wherein evaluating the interaction includes:

assigning a risk level based on whether the interaction indicates an anomaly relative to a historical pattern of interactions previously performed by the device,

assigning a confidence level based on a characteristic of the device or an indicator of an identity of a user of the device, and

assigning, for the interaction, a level of authentication based on the risk level and the confidence level, wherein assigning of the level of authentication includes: (i) identifying a set of rules associated with the interaction, the set of rules being defined by a matrix; (ii) selecting, from the matrix, a rule of the set of rules based on the assigned risk level and confidence level; and (iii) applying the rule to the interaction to determine at least one type of authentication required to authenticate the device before approving the interaction;

as a result of the evaluating, cause a security challenge to be outputted at the device, wherein the security challenge comprises a prompt to perform a set of passive and active actions, wherein the set of passive and active actions are determined based on the at least one type of authentication identified by the level of authentication, wherein a passive action of the set of passive and active actions identifies an action to be performed by the device without user input, and wherein an active action of the set of passive and active actions identifies an action to be performed by the user of the device;

authenticate the user of the device based on a result of the set of passive and active actions meeting a predetermined threshold for the level of authentication; and

approve performance of the interaction at the device based on authenticating the user.

12. The system of claim 11 , wherein approving performance of the interaction comprises continuing the enablement of the communications link between the device and the financial entity as a function of an expected response to the security challenge.

13. The system of claim 11 , wherein not approving performance of the interaction comprises disabling the communications link between the device and the financial entity based on an unexpected response to the security challenge.

14. The system of claim 11 , wherein assigning a confidence level to the interaction further comprises:

determining a location where initiation of the interaction occurs; and

evaluating historical information associated with the location.

15. The system of claim 11 , wherein the processor is further configured to request a third-party token or a biometric identification as at least a portion of the security challenge.

16. The system of claim 15 , wherein the biometric identification is captured without alerting the user.

17. The system of claim 11 , wherein the passive action comprises providing one or more of an external security token, a secure token, or a session token.

18. The system of claim 11 , wherein the active action comprises receiving one or more of: audio from the user, an image of the user, or a response to a security question from the user.

19. The system of claim 18 , wherein the image of the user comprises an image of one or more of the user's face, eye, or finger.

20. A non-transitory computer readable medium comprising program code that when executed by one or more processors is configured to cause the one more processors to:

categorize a set of financial interactions into different levels of authentication;

designate an authentication policy for each level of authentication;

evaluate an interaction of the set of financial interactions being performed at a device, wherein the interaction is performed over a communication link enabled between a financial entity and the device, and wherein evaluating the interaction includes:

assigning a risk level based on whether the interaction indicates an anomaly relative to a historical pattern of interactions previously performed by the device,

assigning a confidence level based on a characteristic of the device or an indicator of an identity of a user of the device, and

assigning, for the interaction, a level of authentication based on the risk level and the confidence level, wherein assigning of the level of authentication includes: (i) identifying a set of rules associated with the interaction, the set of rules being defined by a matrix; (ii) selecting, from the matrix, a rule of the set of rules based on the assigned risk level and confidence level; and (iii) applying the rule to the interaction to determine at least one type of authentication required to authenticate the device before approving the interaction;

as a result of the evaluating, cause a security challenge to be outputted at the device, wherein the security challenge comprises a prompt to perform a set of passive and active actions, wherein the set of passive and active actions are determined based on the at least one type of authentication identified by the level of authentication, wherein a passive action of the set of passive and active actions identifies an action to be performed by the device without user input, and wherein an active action of the set of passive and active actions identifies an action to be performed by the user of the device;

authenticate the user of the device based on a result of the set of passive and active actions meeting a predetermined threshold for the level of authentication; and

approve performance of the interaction at the device based on authenticating the user.