When an authentication system receives a request to determine whether to authorize a transaction, the authentication identifies one or more rules applicable to the transaction. The authentication system determines whether conditions of the applicable rules are satisfied based on historical authentication information received from a mobile device of a user involved in the transaction. The historical information is generated by the mobile device prior to receiving the request and based on a limited-range connection between the mobile device and authentication system. The authentication system authorizes or denies the transaction based on whether the conditions of the applicable rules are satisfied.