Abstract: An improved technique involves sending a user's authentication information to a local authentication device that computes a risk score and sends the risk score to a remote authentication server that determines whether the user is able to be authenticated. When the user makes an authentication or transaction request from an electronic device such as a computer or smartphone, the electronic device sends predictor values such as geo location and wireless signal strength to the local authentication device. The local authentication device then computes a risk score based on the received predictor values and historical predictor values. The local authentication device sends this risk score to a remote authentication server which determines from this risk score and other factors whether the user is able to be authenticated.