A risk assessment platform receives an indication of a first user authentication event associated with a user's attempt to access a first protected resource, and collects first user and device attributes associated with a first authentication process applied to the user and the user's device. The risk assessment platform receives an indication of a second user authentication event associated with the user's attempt to access a second protected resource, and collects second user and device attributes associated with a second authentication process applied to the user and the user's device. The risk assessment platform determines a level of risk of identity fraud associated with the user based on the first and second user and device attributes, and grants or denies the user access to the second protected resource based on the determined level of risk of identity fraud associated with the user.