Systems and methods for suspicious login intercept using authentication confidence score on a trusted login

A method, comprising:

• receiving, by a computer program executed by an electronic device, a current login attempt by a user using a user electronic device;
• generating, by the computer program, an authentication confidence score based on the current login attempt;
• storing, by the computer program, login event attributes for the current login attempt;
• sending, by the computer program, an out-of-band message to the user requesting user login confirmation;
• receiving, by the computer program, confirmation for the current login attempt from the user;
• and
• performing, by the computer program, step-up authentication using the user electronic device.

A non-transitory computer readable storage medium, including instructions stored thereon, which when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

• receiving a current login attempt by a user using a user electronic device;
• generating an authentication confidence score based on the current login attempt;
• retrieving login event attributes for a past login event with a low authentication confidence score in response to the current login attempt having a high authentication confidence score;
• displaying the login event attributes on the user electronic device;
• receiving a request to deactivate a user electronic device involved in the past login event;
• and
• deactivating the user electronic device involved in the past login event.