Techniques are described for determining account features based on a risk assessment. A first set of account features may be determined, including security feature(s) such as mode(s) for authenticating and/or verifying the identity of a user associated with account(s). Based on the first set of features, a risk metric may be determined for the account(s). The risk metric may indicate a risk that fraud may be committed against the account or using the account. Based on the determined risk metric, a second set of account features may be determined for the account(s). The first and second sets of account feature(s) may be applied to the account(s). Disabling a particular feature may cause a reevaluation of the risk metric and a redetermination of the feature sets to be applied to the account(s).