Validation of scanned images

Question

I have been asked to appraise an interface

On the right is a scanned image and it contains information about a user. It contains a unique ID, name fields and an address.

The user has to find out if this information is already held on the system and types in the name and address information as contained in the scanned image. The user is not allowed to type in unique identifier at this time.

On click Find and match the system validates if the information is already held on the system, and if it is, returns a validated state for name and address

The final step is for the user to input the Unique identifier and the system automatically checks if this matches what's held on the system for the name and address and if it matches, returns a valid state:

The reason for this breakdown in input and validation is an extra security measure. After the name and address Find and match, the system does not auto populate the unique identifier even though it knows what it is: it forces the user to input it as an extra security measure.

My question: if the system knows all the data, why can't the user just input the unique ID? The system returns back all the information and the user clicks a button that might say 'confirm data' if everything matches up. Why force the user through so many validation steps?

Further complication: the unique identifier might contain tiny errors (like one digit smudged or missing) in which case the user will get a validation error when checking unique identifier and they would have to do another search to find out what is held on the system and judge whether or not the scanned form contains a genuine typo or not.

Answer 1

The approach that you have used here is reasonable but it needs some tweaks to make the user better understand the flow of the validation process.

As a user, I would prefer to have the details that have to be filled first to be kept on top and once the user fills the details they can click the find & match button to enable the unique identity field. There is no point in having all the fields to be mandatory in details part as it takes too much time to fill all the fields (if there are hundreds of validations to be made by one person), we can keep any two fields that are hard to guess and unique as mandatory fields like the first name and the address.

On click of the Find and match button, if the details match with the details from the server then we can enable the unique identifier field to be filled. If verified we can move on to next data. There should also be a "Match not found" message, that indicates the user for potential errors on the details entered. As I see this as the best approach.

For security concerns, we can keep the unique identity field to be wrong only twice else block the account so it's hard for hackers to run a random numbering code to get verification done(in case if the unique id comprised only of numbers).

We can provide phrases like "Enter 9 digit unique identifier to validate the details" to make the user aware of the errors that might have occurred while scanning the copy like one digit smudged or missing. They can contact the authorised person in case of any errors in the scanned copy.

Answer 2

Actually you have already answered your half of the question.

Que - "If the system knows all the data, why can't the user just input the unique ID?"

Ans - "The reason for this breakdown in input and validation is an extra security measure."

But the important thing here is the flow.

Current Flow (doesn't make any sense):

• Step 1: Personal Details Check
• Step 2: Unique Identifier Check

My Suggestion :

• Unique Identifier & Full Name(Su Maka Suzuka)

If validates then:

• Address Details

^{download bmml source – Wireframes created with Balsamiq Mockups}

If matched then previous form disappears and form below appears as final step.

Why? Don't put all at one time in users plate, let them digest few and serve more.

^{download bmml source}

Benefits:

• If user fails to enter correct ID, he would not to have fill address, as filling all details and then finding you have an incorrect ID is really torturing.
• Also as i mentioned, guiding user step by step is better than to show too many(all) fields at once. And if possible merging field would be better (Example: Full Name).

PS: The above was assuming you cannot change the functionality and layout. But if you can i would suggest you to add security questions which if they able to answer they need not to verify address.

Answer 3

It sounds very important to the business that this information be exactly correct. You're right--it could be done with just a primary key entry, however, being this strict with the matching process decreases the likelihood of mistakes or incorrect matches.

I have worked on a similar project where we validate data based on user-uploaded documents, and there are several times where issues get sent to me (a developer) because someone mistyped a unique identifier and the document got associated with the wrong data.

By forcing you to first match the non-unique information then be able to input the unique identifier, the user is being much more explicit and thus less susceptible to human error or mistypes.

Answer 4

It seems like security matters the designers of the system, not UX.

The identification process is indeed confusing and, from first site, does not make sense. I would like to raise another point. You are saying:

...the unique identifier might contain tiny errors (like one digit smudged or missing)...

But in case the name and address are are strictly matched, then each of them is much more typo-sensitive than the numerical unique id.

So, we have:

1. Two steps validations.
2. User has to know the exact unique id and
3. (probably) the exact name and address of the user.

Which leads me to the conclusion that: the designers of the system just put security on top priority, before UX or any other matter.

With this in mind, they could have not satisfy with validating only using the unique id simply because it is easier to guess.

More than that, if it is security that concerns the customer, then it may be that we would also want to avoid a hacking of the system by guessing the unique id. In case it is numeric as in the image, then one can just run all numbers and get all the data out of the system. Full name and address are harder to guess, also manually, and all the more by automatic tools (scripts, etc.).

Answer 5

I can think of three reasons:

1. Security -- requiring multi-factor authentication of the database record is a pretty effective security measure; very important for sensitive data like voter records.
2. Error checking -- it's very easy to make a mistake when entering a number. It would be easy to attribute the scan to the wrong individual, many times over. The additional steps prevents that.
3. Preparation for an audit -- any company involved in handling sensitive data needs to have their process survive an audit, and planning for it in advance is wise. Taking these additional steps, while not a great user experience for the workers, makes it more likely that the auditors will accept their validation process. Imagine some of the precautions microbiology lab workers have to take in order to prevent contamination of samples. This interface is comparable. It is better to introduce additional steps as safety measures than introduce errors or contamination into the process and undermine the integrity of the database.

Answer 6

I would like to voter for 'if the system knows all the data, why can't the user just input the unique ID’

We can have it this way, User experience will be good cos the effective and easing would be better in this approach.

Currently if we see most of the application, user has to input the data. Its forcing user to remember something before proceeding to the search. It doesn’t work all the time. Thats the reason i vote for your thought which is stated above.

How do we achieve this

• Provide auto suggestion for all the fields, as and when user start typing will show the Suggestion. In this approach user need not to remember all the things. Just type 2 letter or 3 letter will show the possible auto suggestions. This is where user feels in command, and this will improve the effectiveness.
• Providing the Auto suggestion is tough job for dev guys, if they able to get there. Then it will be awesome
• With the autosuggestion, input for search will be exact and this will result in Quality Search Result

Answer 7

I'll start with the stat of image recognition in general, It is getting better but still has a long way to go.

The process would seem very straightforward if the user can enter his/her ID into the system first. It will break the process into minimal and simple steps -

Actions: 1. Enter the ID 2. Scan the document

Outcome: 1. If it's a match - nothing else needs to be done which should be a considerable amount of interactions, Thus ending the flow in two-step for many users.

2. In case it doesn't, the verification needs to be done by the users manually (If I am understanding the statement correctly) which can be done in the third step.

Either way - it's the minimum and most simple way I can think of without going into technical details.