2

For a consumer product where a customer has an account, and receives invoices from us ($10k+), and is asked to pay those invoices using a saved payment method (bank or credit card) -- we are debating whether it makes sense to re-prompt the user for their password to finalize a payment, even if they have checked the "stay logged in" box. It could be implemented as dual login cookies -- one long term (no expiration), one short-term (30 minutes). If the short-term login session is expired, then when a key action is taken (like a payment greater than $10k), then the short-term login would need to be refreshed by entering a password.

Argument for: These are potentially large amounts of money and it seems like the conservative thing to do. Examples of this in the wild: When making admin changes on Twilio, or when changing addresses on Amazon, a password re-prompt is often required.

Argument against: Adds friction. Neither PayPal nor banks require you to do this. Why should we?

What else would you consider to make the right UX decision here?

  • It depends how concerned your users are with security. I've had internet banking that uses it and it makes me feel more secure. But other users might feel its a pain in the ash. Depends on the context and how safe your service seems already. – RobbyReindeer Sep 27 '18 at 6:47
  • Is the issue making the payment (for a recurring service that was already ordered and hasn’t changed) or is it about ordering (and paying for) new services? Can those services be ordered / used by someone else? As you see, Amazon does not ask for a password again if it’s shipped to an existing address. It will ask for (including card details) if you ship to a new address as it could be someone who hacked into the account trying to make the purchase using your card. – jcaron Sep 27 '18 at 12:19
  • "nor banks require you to do this" My bank (UK) does sometimes do this (or something like it). In my case, certain payments (and other account-maintenance actions) require you to use a card-reader to confirm you have one of the credit/debit cards linked to your account in your possession. – TripeHound Sep 27 '18 at 14:57
1

Two things come to mind for me:

  1. Payment gateways will not retain all credit card information and will require the customer to enter the CVV number (this is the conventional where I am). Is this doing the same thing you are trying to achieve with your re-authentication concept? If so, then there is a double up.

  2. If you are asking people to stay signed in, then you are not honouring that when you ask them to login for a second time. Could this interaction undermine your system is i.e. you can't complete the simple request of keeping me logged in, what else can I not trust?

If you do go down the path of using a revalidation, you should design the interaction to be contextual and frame it accordingly. Make sure the user knows it is a security measure, and not a malfunction.

0

You can use an opt-in 2-factor authentication (2FA), which is a compromise between increased friction and security.

The user can enable 2FA. You can also make it mandatory to use 2FA for paying in general, or for paying more than a certain amount.

0

Banks to it two ways: after submitting payment a)the user is directed to a final confirmation screen (no password) OR b)just before submitting payment the user has to reenter a password.

We tested the latter and it works well because our users felt it gave an additional feeling of security, even though the logged in state didn't need the password again.

I've seen the former option with some of the banks I use and I also like it. I think either option gives the user a feeling of extra security TBH

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.