Risk signals are events or telemetry that suggest a user’s identity conditions may have changed. In practice, they include carrier-side changes, new devices, unusual login locations, SIM swaps, number porting, or sudden loss of cellular service. Security systems use these signals to decide whether an existing session should still be trusted.
They matter because identity is not static. A login that looked valid a minute ago may become risky if the phone number tied to recovery or SMS verification is moved to an attacker-controlled SIM. Modern defenses treat these signals as triggers for step-up authentication, re-verification, or blocking sensitive actions such as changing recovery details or enrolling a new authenticator. Attackers try to exploit weak or delayed responses by using the changed identity context before defenders react.