Abstract: Improved techniques of performing authentication involve extracting metadata from posts made by legitimate users on a social networking website and generating authentication results based in part on the extracted metadata. For example, in response to an authentication request being made from a device of a legitimate user, an authentication server obtains metadata describing one or more posts made by the legitimate user on the social networking website. The authentication server may then input the metadata to a risk engine, along with information gathered from the user's device. The risk engine then generates a risk score that indicates a likelihood that the request is fraudulent, based at least in part of whether the metadata obtained from the social networking website is consistent with the information obtained from the user's device.