4

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with.

She doesn't choose any password.

We have a feature that's like a store credit balance—users can easily and quickly make purchases using their balance, and add credit any time while logged in. (The reason our store credit exists is because of outdated payment solutions in our country.)

It's important for us that if someone’s device is stolen, the thief should not be able to use their store credit...

So we make the user choose a password first time they want to add store credit.

Because the user hasn't chosen a password to log in with, we’re worried she might be confused by a password only for store credit.

  • Is there any better way to protect their store credit instead of using password?
  • If not, how can I explain this mess (of choosing a password) to the user?
  • make user choose a password do you give your users a list of passwords to choose from? – gurvinder372 Jan 30 '16 at 19:17
  • @gurvinder372 nope, I just meant specifying some password. – Keyhan Asghari Jan 31 '16 at 13:12
3

Follow these 2 steps

1) When user logs in first with your auto-generated password, ask them to create your own password with which they will login next time.

2) When user make a purchase or do any transcation on your wallet (store credit feature) ask for a OTP. Tell the user that they can opt out of this OTP but it is not recommended. This password will be different than their login password, it will be called transaction OTP.

From your side

Just ensure that you communicate to your users that there is a customer-service number to call (preferably toll free) in case their phone is stolen so that they can block requests coming from a specific IMEI number (or email id or phone number).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.