Step-up challenge after a password spray is a control — logs still have to show it fired

Cyber Desk · Insight. Series: Digital disputes, as Indian courts actually see them.

Step-up challenge after a password spray is a control — logs still have to show it fired.

After a credential-stuffing wave, the bank says “we triggered a second factor.” That is a claim, not proof. The record lives in the logs: when the challenge fired, to which channel, whether it validated, and what the session did next. A control that cannot produce its own event trail is a policy on paper — not evidence of authentication.

Step-up claimed.

Not step-up proved.