[blowski]

That's the whole point of RBA, though. That two requests have the same user agent doesn't tell me much, but if you have two different user agents from two different IPs that may sound really risky (use case dependent, of course).

[ocdtrekkie]

Unless someone is sitting at their desktop computer with their phone connection to 4G...

Privacy initiatives will probably make some risk-based authentication tricks break, but they probably weren't robust methods anyways.