Device risk level based on device metadata comparison

A non-transitory computer-readable storage medium comprising executable instructions that when executed by a computer processor perform actions comprising:

• associating, by an authentication system during a device enrollment process, authentication credentials and first device metadata with a first client device for authenticating access requests, the authentication credentials including an authentication key that is a secret key shared between the first client device and the authentication system;
• responsive to an access request associated with a second client device impersonating the first client device, obtaining an authentication token generated using the authentication credentials and second device metadata describing one or more infrequently changing characteristics of the second client device, wherein the authentication token is a one-time password multi-factor authentication (MFA) token generated by the second client device using the secret key and provided as an MFA factor to the authentication system;
• determining, using the secret key, that the authentication token is valid;
• responsive to determining that the authentication token is valid, comparing the first device metadata to the second device metadata in order to detect device metadata anomalies;
• determining a risk level for the second client device based on the comparison, the risk level indicating a likelihood that the second client device is not the first client device;
• and
• denying the access request based on the risk level, despite having determined that the authentication token is valid.