Mobile App Auth Friction
summary
Research downloads the top 50 US financial apps and measures login flows for known versus new devices, recording factors offered, persistence, screens and fields and time to complete. Findings: passwords remain primary (100% for new devices), biometrics appear on ~75–80% for known devices, and 62% use SMS OTP as the secondary factor for known devices (75% for new-device setup). New-device login averages 53 seconds, with 25% taking over a minute; only 0.5% of new-device attempts are fraud, and customers replacing SMS with device/behavior signals cut ATO by ~90–95%.
AI-written summary · about
chapters (20)
- 0:00Introduction to session
- 0:30Purpose of the research
- 1:36Research agenda overview
- 3:04Account takeover fraud problem
- 4:06Device switching statistics
- 6:18Research methodology details
- 7:03Known device authentication
- 8:29Primary and secondary factors
- 9:55Login persistence methods
- 10:15Secondary factor vulnerabilities
- 11:42Unauthorized device setup
- 12:04New device login time
- 13:11Secondary factor on new devices
- 13:52Behind-the-scenes techniques
- 16:19Key takeaways summary
- 17:24Q&A session begins
- 18:00Question about login screens
- 19:46SMS OTP challenges
- 20:30Fraud prevention solutions
- 23:03Closing remarks
related talks
23mPasswordless Authentication in the Regulatory MFA Landscape
17m2FA in 2020 & Beyond
37mBuilding simple and secure account systems on Android
32mPasswords are so 1990
42mChallenges in User Authentication: Balancing Security & User Experience
01h 13mMake your authentication flow perfect
22mA Usability Study of Five Two-Factor Authentication Methods
24m2FA in 2020 and Beyond