A computer-implemented method for authenticating an online user includes steps including receiving, from a requestor server in communication with a merchant website, an authentication request message including authentication data collected from a user computing device during an online interaction with the merchant website. The steps also include extracting the authentication data from the authentication request message, and applying a risk-based authentication (RBA) engine to the authentication data to obtain RBA result data including a reason code that includes no more than three bytes of data. The steps further include causing the reason code to be embedded in an authorization request message generated during the online interaction and routed to a decisioning server via a payment network. The authorization request message is formatted according to a set of proprietary communications standards promulgated by the payment network for exchange of data between institutions that are members of the payment network.