  Risk-based authentication (RBA) aims to protect end-users against attacks
involving stolen or otherwise guessed passwords without requiring a second
authentication method all the time. Online services typically set limits on
what is still seen as normal and what is not, as well as the actions taken
afterward. Consequently, RBA monitors different features, such as geolocation
and device during login. If the features' values differ from the expected
values, then a second authentication method might be requested. However, only a
few online services publish information about how their systems work. This
hinders not only RBA research but also its development and adoption in
organizations. In order to understand how the RBA systems online services
operate, black box testing is applied. To verify the results, we re-evaluate
the three large providers: Google, Amazon, and Facebook. Based on our test
setup and the test cases, we notice differences in RBA based on account
creation at Google. Additionally, several test cases rarely trigger the RBA
system. Our results provide new insights into RBA systems and raise several
questions for future work.
