The Increased Authentication risk engine works invisibly in the background so that only suspicious activity is challenged by entering a one-time password to let the system know the login has been authenticated and can proceed normally.