Learn in the textbookUser Authentication (Knowledge-Based and Possession-Based)
DefinitionRisk-based authentication (リスクベース認証) compares the device, location, and other conditions of a login with the user's usual pattern, and asks for additional authentication only when it judges the risk to be high.
ExplanationPutting every user through a heavy check every time adds effort, so the check is tightened only when something looks suspicious. The extra check might be a verification code sent to a registered smartphone or the answer to a question set up in advance. The point is to keep things easy for legitimate users while making impersonation (なりすまし), where someone pretends to be the user, hard to pull off with a stolen password alone.
AnalogyIt is like building security that waves familiar staff through with just a badge, but questions anyone trying to get in through an unusual door in the middle of the night.
Memory hookRead it literally: the check is based on risk, rather than applied the same way to everyone.