Risk-based authentication works better the more it knows about the device in front of it. That is uncontroversial. What is less obvious is that the protocol provides a way for the cardholder themselves to confirm the link between a device and…