How to explain the concept of choosing password to user

Question

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with.

She doesn't choose any password.

We have a feature that's like a store credit balance—users can easily and quickly make purchases using their balance, and add credit any time while logged in. (The reason our store credit exists is because of outdated payment solutions in our country.)

It's important for us that if someone’s device is stolen, the thief should not be able to use their store credit...

So we make the user choose a password first time they want to add store credit.

Because the user hasn't chosen a password to log in with, we’re worried she might be confused by a password only for store credit.

• Is there any better way to protect their store credit instead of using password?
• If not, how can I explain this mess (of choosing a password) to the user?

Answer 1

Follow these 2 steps

1) When user logs in first with your auto-generated password, ask them to create your own password with which they will login next time.

2) When user make a purchase or do any transcation on your wallet (store credit feature) ask for a OTP. Tell the user that they can opt out of this OTP but it is not recommended. This password will be different than their login password, it will be called transaction OTP.

From your side

Just ensure that you communicate to your users that there is a customer-service number to call (preferably toll free) in case their phone is stolen so that they can block requests coming from a specific IMEI number (or email id or phone number).