In general a Risk Management Service would be a hosted co-signing service. It would be up to a specific implementation how your device is notified.

I chose WebFist, because most users don't have a domain they control.
Do you happen to know if there is any solid implementation of the Fist Bump server except Brad Fitzpatrick's go implementation?