“Create a top-down mobile banking password-reset user journey: open the app, select Forgot password, enter a customer ID, and receive a one-time passcode. If the passcode is invalid, route to bank support and account recovery review. If valid, create a new password, optionally enroll Face ID or fingerprint, sign in, receive a security alert, and restore account access.”
看懂背後的決策。
A failed one-time passcode does not continue to password creation and instead enters recovery review.
The customer ID step anchors the reset request before the passcode is delivered.
Biometric enrolment is optional, so customers can complete the reset with a password alone.
A notification after sign-in gives the customer a visible record of the credential change.
Use this for a consumer financial app that supports one-time-passcode recovery. Replace the identity and escalation steps with the controls required by your bank's risk policy.
常見問題
Why does an invalid passcode go to support?
The diagram treats an invalid code as a point for assisted account recovery rather than permitting a reset.
Is biometric sign-in required?
No. It is an optional branch after the new password is created.
Why send a security alert after sign-in?
It notifies the customer that credentials changed and can help reveal an unexpected reset.