  Risk-based Authentication (RBA) is an adaptive security measure that improves
the security of password-based authentication by protecting against credential
stuffing, password guessing, or phishing attacks. RBA monitors extra features
during login and requests for an additional authentication step if the observed
feature values deviate from the usual ones in the login history. In
state-of-the-art RBA re-authentication deployments, users receive an email with
a numerical code in its body, which must be entered on the online service.
Although this procedure has a major impact on RBA's time exposure and
usability, these aspects were not studied so far.
  We introduce two RBA re-authentication variants supplementing the de facto
standard with a link-based and another code-based approach. Then, we present
the results of a between-group study (N=592) to evaluate these three
approaches. Our observations show with significant results that there is
potential to speed up the RBA re-authentication process without reducing
neither its security properties nor its security perception. The link-based
re-authentication via "magic links", however, makes users significantly more
anxious than the code-based approaches when perceived for the first time. Our
evaluations underline the fact that RBA re-authentication is not a uniform
procedure. We summarize our findings and provide recommendations.
