I need advice on authentication for a consumer app with low friction login and fraud protection.

For a consumer app, the usual goal is low-friction sign-in for legitimate users while still adding step-up checks for risky activity. A good pattern is:

Recommended approach

1. Use passwordless or “magic link” login first

Best for low friction:

• Email magic links
• Email OTP codes
• SMS OTP only if you really need phone-based login

Why: fewer passwords to remember, lower support burden, and less credential-stuffing risk.

Tradeoff: email-based methods are usually safer and cheaper than SMS. SMS is convenient but weaker against SIM swap and interception.

---

2. Prefer passkeys as a primary or optional login method

If your audience includes returning users on mobile/desktop:

• Add passkeys as the best UX/security option
• Let users fall back to email magic link/OTP

Why: passkeys are phishing-resistant, fast, and reduce account takeover risk.

---

3. Use risk-based authentication for fraud protection

Don’t challenge everyone the same way. Add checks when risk is higher, such as:

• New device
• New location or impossible travel
• High-value actions
• Unusual velocity/patterns
• Suspicious IP / VPN / proxy
• Known bad device fingerprint or bot signals

Then apply step-up auth:

• Passkey re-auth
• Email OTP
• SMS OTP
• TOTP as backup

---

4. Protect sensitive actions separately from login

Even if login is easy, require extra verification for:

• Changing email/phone
• Adding payout methods
• Password reset
• Large purchases/transfers
• Changing device/session settings

This preserves convenience while reducing fraud impact.

---

What I’d recommend in practice

Best default stack

1. Passkeys
2. Email magic link / OTP fallback
3. Risk engine + step-up auth
4. Session/device trust
5. Rate limiting + bot detection

If you need phone-number-first onboarding

• Use phone number + OTP for signup
• Encourage adding email and passkey afterward
• Avoid making SMS your only long-term factor if fraud risk matters

---

Things to avoid

• Password-only login for consumer apps with fraud exposure
• SMS as the only security factor for high-risk accounts
• Forcing MFA on every login if you want low friction
• Overly aggressive device fingerprinting without a clear privacy policy

---

Fraud controls beyond auth

Authentication alone won’t stop fraud. Add:

• Email/phone verification
• CAPTCHA or bot checks at signup and suspicious login attempts
• Velocity limits on account creation, OTP requests, and failed logins
• Session anomaly detection
• Account recovery safeguards
• Manual review for risky transactions

---

Good user experience pattern

• First login: email magic link or passkey setup
• Subsequent logins: passkey when available, otherwise remembered device
• Step-up only for risky or sensitive actions
• Offer backup methods and recovery codes

---

Simple recommendation

If you want the shortest answer:
Use passkeys + email magic links, add risk-based step-up authentication, and reserve SMS OTP for fallback or onboarding.

If you want, I can also suggest:

1. a best-practice auth flow diagram,
2. a vendor comparison (Auth0, Cognito, Clerk, Firebase, etc.), or
3. a decision tree based on your fraud risk and user base.