DUOLABS
Work

Mobile banking app overhaul

We owned sign-in and authentication in the full overhaul of a mobile banking app used by millions, rebuilt so that banking, card, securities, and insurance services sit in one app. If sign-in fails, customers can neither check balances nor send money, and authentication is tangled across many screens and external modules, so fixing one place easily breaks another. We rewrote the legacy sign-in and authentication screens in a new way of building screens, and reorganized identity verification, biometric authentication, and ID-card verification into separate business units. We integrated an external face-recognition solution into the app and its authentication flow, and designed a calling interface so other developers could use authentication easily.

Launch
2024
Client
A major Korean bank
Type
Banking & Identity
01 / 04

Sign-in rewritten while old and new screens ran side by side

We rewrote the mobile banking app's sign-in and authentication screens in a new, declarative way of building screens. Screen state, inputs, validation results, and authentication progress were organized to be managed in one place, making it easy to follow when and why a screen changes. During the overhaul, old and new screens lived together in one app, so we weighed the impact of each screen and checked the points where existing flows might break. The app on the other platform was changing its screen approach at the same time, so we aligned with it: implementations differed, but the user flow and authentication policy looked the same.

Sign-in rewritten while old and new screens ran side by side
02 / 04

Authentication split into sign-in, identity check, biometrics, and ID card

Authentication in a banking app weaves sign-in, identity verification, biometric authentication, and ID-card verification across many screens and external modules. We split this flow into business units and managed navigation separately from authentication state. Each screen's developer now calls only the authentication functions they need, reliably.

Authentication split into sign-in, identity check, biometrics, and ID card
03 / 04

Identity checks that hold up when face recognition or the camera fails

Face-recognition identity checks in the mobile banking app were built by integrating an external face-recognition solution into the app. We plugged the solution directly into the sign-in and authentication flow and tied its setup, camera permission, capture results, failure responses, and retries to the app's authentication state, so the customer's flow does not break even when a step fails. We also tracked down camera problems that varied by device model and OS version. Exceptions in permission states, camera startup, releasing and re-entering the camera when moving between screens, and passing on capture results were found and fixed one by one.

Identity checks that hold up when face recognition or the camera fails
04 / 04

An auth module others can call without knowing what is inside

In a large banking app, authentication is shared by several developers working on sign-in and by many screens. To cut the cost of coordination among them, we designed and provided the calling interface for the authentication module. Internals stay hidden; only what goes in, what comes back, and how results are reported are clearly defined, so any screen can attach authentication easily.

An auth module others can call without knowing what is inside

Highlights

01

An authentication structure split by task: sign-in, identity check, biometrics, and ID card

02

External face-recognition integration and camera fixes across devices and OS versions

03

An auth-module interface other developers can call without knowing its internals

Insights

Read the blog