When is a good time to set a Pincode?

Question

I'm working on a Mobile Wallet for Android that hast the following sign up flow:

1) Download and install

2) Opening screen

3) Enter Phone number

4) Phone number verification (entering a code sent via text message)

5) Password setup

6) Profile setup (full name + email)

7) Pincode setup

8) Wallet's home screen.

We need the user to have a pincode set up as a safety measure (they will be storing money in this app), but I am not sure about prompting the user to set it up during the sign up.

The user will also need to set up a recovery code that needs to be written in paper. We prompt the user to do this upon receiving money for the first time.

Is there a proper time to make the user set up a pincode?

Answer 1

From my experience, the best time to ask for a pincode setup is right after the application request is filled out. In your case, that would at the very end.

The credit card company I worked for had things set-up in a way that they first had to verify information before they could generate an account. They could however ask the user to setup a pincode before doing all that. We did it right after requesting a credit card because the leap from applying for a card and setting up a pincode for that card, was smaller than if we would ask for it at a later date. Users would still be in that 'celebratory' stage of the application request; result being that we could ask 'more' from them (e.g. start the portal onboarding process with less drop-off). Another benefit is that it feels like the application has been definitive and the card is now really yours.

Having a pincode is a defining moment of the process; once you have it, the wallet/card is yours and the process feels complete. It being at the end of your wallet creation process seems worth testing.

Answer 2

I'm not aware of any case studies focusing on the time of setting password/pincode especially for cryptocurrency wallets, as a current user of different exchanges, I can emphasize the necessity of password, pincode, and recovery code even I either don't like them.

IMHO as a single user, I like the idea of getting over the sequential sign up process ASAP.

To say, if I'll be asked for a password and a pincode both, I'd prefer asked at once, because I used to associate them or rather I prefer to choose one of them make me remember or evoking another.

Asking after the profile setup as you plan is also acceptable I guess yet, it seems like you're letting user to be able to quit during the process of profile creation (otherwise no problem if you can give the feeling or awareness of an uncompleted profile to the user).

Asking to note down the recovery code at the point transaction become fact makes more sense which I agree also.

PS: Feel free to ask more if I can supply any complementary info.

Answer 3

Consider that your user was motivated enough to download and install this app. How much potential value can you show or provide to your user before security is a concern? It seems to me that a pin code set up at signup might discourage some users from exploring the app and prevent them from being aware of the product.

I'd recommend identifying the moment where your user becomes product aware (e.g. they deposit money) to request the pin code information.

Answer 4

You will need to test the order of execution, but I would suggest trying the option of setting the pin code just after the password setup.

Many bank applications offer transaction password, which is different from the log in password. These passwords are set together, one after the other. When the user is setting a password, validating a mobile phone, she is forming a bond with your application and investing in the ecosystem. At this time the user has the mental model of considering the security concerns, (she has just set up a primary password). At this time, it is good to offer the additional security feature of pin code.

When the user sets up pin code, she will be more comfortable entering the full name and email, as the trust value on your application is now increased. So full name+email comes after the pin code lock.

You might want to think leveraging the existing security feature user is using to unlock the phone. Some wallets on android offer this option of putting the same security on top of the app as well.

You can have the recovery phrase step as an optional step at the initial account creation process. Optional because we are dragging out the security systems for three steps. User may need to skip it for now, which you will definitely discourage the user from.