Risk-based authentication means that when you want to get into a website or an app, the website or app will look at how likely it is that you are actually you. They do this by looking at things like your password, where you're logging in from, and how you are typing. If the website or app thinks that you might not be you, it might ask you to prove that you are you in some other way, like by sending a code to your phone or by answering a security question. This is because sometimes bad people try to pretend to be you and steal your information, and the website or app wants to make sure that they are really talking to you before they let you in.