Overview
Problem
Create a secure and seamless authentication experience
Keep my account information safe and easy to access.
Keep us compliant with federal regulations with minimal to no effect on login efficacy.
Account management built using a vendor’s template
The product team had signed a contract with the vendor without involving the design and engineering teams. As we dug deeper, we discovered a few limitations that severely impacted the experience.
Ideation
Map vendor’s process and address key limitations
Heuristic evaluation
Imagine you share an account with your partner. If you don't have access to the phone number used to authenticate. You try clicking the button to add a new method, which makes it disappear (huh??).
This page is reused for two very different use cases, leading to obvious confusion for users (used in authenticating, and adding a new authentication method).
Heuristic evaluation
The vendor's template only allows for styling of existing components, no new assets, pages, or functionality is supported.
The two pages shown are the first two pages when enrolling in authentication. Ideally, we'd combine these into one page, add a progress indicator, and introduce a back button after the user reaches step 2.
Competitive analysis
Manage authentication in account settings post-login
Many other financial services only allow users to manage authentication methods in their account settings. This significantly simplifies the experience when a client is asked to authenticate at login.
Solution
Proof of concept, iterate, then roll out publicly
We set up tight, controlled feedback loops with internal teammates allowing us to quickly identify problems and improve iteratively.
Launching first in a closed environment allowed us to identify and address legal and security risks based on user behavior before rolling out to external clients.
Enrollment
Clients enroll in 3 simple steps. In the absence of a progress stepper, the next step is introduced in the subtitle.
Authentication
We migrated the “add authentication method” flow to a user's account settings (see screenshot below). This allowed us to simplify the authentication process and clarify what action to take if methods are inaccessible.
Results
>2 million accounts enrolled, high authentication success
of active accounts enrolled within 4 months of public launch
of clients successfully authenticate in one session
accounts successfully enrolled in secondary authentication
Improvements
API-driven authentication experience
The flaws inherent in the vendor's template led us to build a duplicate custom authentication experience in account settings. If we had realized these flaws before signing a contract, we could have built a first-class experience and ensured security and compliance via calls to the vendor's APIs.
I would add a progress steppers and simplify passcode entry
.png)
Passcode input area assumes a 6-digit passcode and would automatically submit once 6 characters are entered. Single CTA focuses attention on passcode entry.
I would streamline the choose authentication method experience
