Ensure customers can access their accounts securely, quickly, and easily.
Member identity management encompasses login, authentication, session security, device management, account recovery, and risky transaction verification. The goal is to reduce the risks of account hijacking, credential stuffing, and phishing without burdening the customer with unnecessary steps.
A single verification method may not be suitable for all customers and transactions. While easy login is provided for low-risk sessions, transactions such as address, email, payment method, or high-value order changes may require additional security.
Authentication options
Password-based login and secure password policies.
One-time links and codes via email or SMS.
Federation with social and external identity providers
Multi-factor authentication
Passwordless access with FIDO-based passcodes.
Trusted device and risk-based verification.
Passkey and password-free experience
Passcodes are open-standard based credentials that allow a customer to log in using biometrics, PINs, or patterns, the same methods they use to unlock their device. Because they don't use shared password secrets and operate tied to a site domain, they offer a more resilient option against phishing attacks.
When adding passkey support, incremental transitions, recovery options, multi-device usage, and accessible user guidance should be designed together for existing customers using passwords.
Session and device security
Session durations and inactivity timeout
New device or unusual location alerts
Policies for simultaneous use of the same account
Option to log out of all devices.
Secure storage and renewal of session tokens.
Additional verification or temporary restriction on risky behavior.
Account hijacking and abuse controls
Failed login speed limit
Checking for known leaked passwords.
Detection of bot and credential stuffing attacks.
Risk assessment in account recovery requests.
Customer notification of critical profile changes.
Reviewing suspicious session and transaction history.
Accessible authentication
Authentication flows should not rely solely on visual puzzles, memorization requirements, or fields that prevent copying. Forms should be usable with keyboards and assistive technologies; error messages should be clearly explained, and alternative authentication methods should be offered to the customer.
Construct identity management not just as a login screen, but as a risk-based security system that protects the customer's account and transactions throughout their lifecycle.