The recheck: proving who you are inside a session

A live session is evidence that someone signed in, not that the person at the keyboard is the account holder. This page is about the second proof, the one that interrupts a session that is working perfectly well.

Open the partner account What signing out does not do

Session spec

actions: 6
rechecked: 3
not rechecked: 3
what it blocks: the action, not the session

the sessionThe interval between signing in and being signed out. It holds your authenticated use of the account and nothing else; the balance, the bets and the limits are held by the account and survive it.

the two clocksThe idle clock runs from your last counted action and restarts; the absolute lifetime runs from the sign-in and never restarts. On the samples 30 minutes and 12 hours, and the earlier one always decides.

the tokenWhat a persistent sign-in leaves on a device, so the next visit needs no password. On the samples 30 days - 1,440 idle windows - and only a sign-out or a revocation removes it.

Direct answer

A recheck asks for the password again inside a live session before an action that can move money out or change how the account is secured. On the samples three of six actions carry it. It does not end the session and it does not mean the session was compromised. It is a second proof for a single action.

Where the second proof falls

Sample H is one invented rules document listing six actions inside a session and marking which of them carry a recheck.

Sample H - six actions and whether each asks for the password again
Action	Recheck	Reason given in the rules
changing the password	yes	the credential itself is being changed
adding a payout method	yes	money can be sent to it later
requesting a withdrawal	yes	money leaves the account
placing a bet	no	the stake moves between balances inside the account
depositing	no	money arrives at the account
opening a game	no	nothing about the account changes
6 actions	3 rechecked / 3 not	the line is money out and security

sample H - the recheck is a property of the action rechecked = 3 of 6 → 50% of the actions on the list of the three rechecked, 3 of 3 can move money out or change the credential of the three not rechecked, 0 of 3 can do either so the test is not "is this important" but "can this change the exit or the lock".

What a recheck is not

It is not a sign-out. The session, its clocks and its identifier all carry on, and after the password is entered the action continues in the same interval. It is not a warning about your account either: on the samples it fires on every withdrawal the same way, whether the account has ever been touched by anyone else or not. The one thing it does do is create a moment when the person at the keyboard has to produce something a bystander does not have - which is exactly why a shared or borrowed device is the case where it matters, and why the desk's page on the shared device is the one that follows it.

The other side of the line is worth naming too. Half the list goes through without a second proof, and the two largest items on it are a deposit and a bet. Someone who has a live session can put a stake on and move money into the account without re-proving anything, which is what makes the session itself - rather than the password - the thing worth guarding on a device you do not control.

Expect the recheck at withdrawal and at anything that changes the password or the payout route.
Do not read a recheck as evidence of a problem with the account: it is a property of the action.
Use the moment to check the payout destination before confirming, not after.
Sign out on a device you do not control, because a deposit and a bet will not ask for a second proof.
Treat a recheck prompt you did not trigger as a reason to sign out and check the session record.

The recheck: proving who you are inside a session

Where the second proof falls

What a recheck is not

Read next