OTP authentication: from 48 hours to 2 minutes
Verification code — enter it to continue with your application.
4802The product
A 48-hour wait sitting in the middle of the sale
The sales conversation stopped there. The customer went home; the momentum went with them.
Credit bureau
Consultation authorization
Cost of the gap
What the customer could not see
No limits, no risk level
No amount ceiling, no risk score, no way to know whether they already had an active loan.
Over-indebtedness and default
Decisions made without data opened the door to loans the customer could not carry.
Talking without data
The advisor had to hold the conversation with nothing on the table to back it up.
Cross-team leadership
Five teams, five different pressures
Speed
Keep the conversation alive, not send the customer home for two days.
Trust
A method people already recognize and don't have to be taught.
Fraud & AML
Identity had to hold up. Compliance rules were not negotiable.
Cost
Limited resources, and room to test before committing to a channel.
Stability
No resend loops, no server strain in a critical flow.
Holding and managing coherent decisions
My role was to translate the coherence between the core work I carried from the first exploration through to managed delivery in Scrum.
Method
Design Thinking first, Scrum once the hypothesis held
Phase 01
Design Thinking
- Empathize
- Define
- Ideate
- Prototype
- Test
Phase 02
Scrum
- Backlog
- Sprint
- Review
- Iterate
The hypothesis
Initial hypothesis
We aim to give an immediate, trustworthy answer in front of the customer without losing legal rigor and churn risk
Can we cut the customer's waiting time and run the process more transparently?
The customer stays in the conversation
Research design
A comparative journey, not a survey
Type of research
Qualitative comparative journey, run on a navigable prototype — including the simulated push notification and a working code-capture field.
Figma prototypeSample
Customers who had already taken out a loan, signed on paper.
They were the only ones who could give us the real contrast between "before" and "after".
The prototype we tested
The flow people had to navigate, not read about
Test results
We tested trust before we picked a mechanism
Accepted the digital notice
Why it worked
Most people already knew the process from other banks or store credit cards — the checkbox wasn't new to them.
Exception · 01
They were waiting for the message on their phone and couldn't find where it had arrived.
Exception · 02
The message felt unclear when it asked for the code right after the privacy notice — they would rather have the notice on paper, to read it calmly.
The channel decision
Three channels, three trade-offs
Cheapest option, but not every user keeps an active inbox. It broke the promise of an immediate answer.
DiscardedSMS
Could take up to 5 minutes to arrive, pushing people to request resends and creating a loop on the server.
DiscardedHigher cost per message, but consistent delivery — and a place people already check every day.
ChosenDesign system
Requests to the system, not local exceptions
Central repository
Design System
Available for
Any future authentication flow in the company — not just this case.
I pushed to build and request a set of scalable components, because a single slot does not meet the need to reuse OTP elements across other projects.
The friction we found
The timer was the real friction
One minute
The code arrived in time, but users were looking for an SMS and ran out of clock searching the wrong place.
Two minutes + clearer copy
We widened the window and rewrote the push so the message itself said what it was.
WHATSAPP · NOW
Verification code — enter it to continue with your application.
The principle
Adapt the system, not the user
Faced with a usability problem, the temptation is to educate the user. I pushed for the opposite: redesign the signal so the system meets the user, cutting cognitive load instead of demanding learning.
Managed delivery
From findings to a prioritized backlog
Backlog
In sprint
Released
I defined how the Design Thinking findings translated into prioritized backlog stories, and required any scope change to be revalidated against user logic — not technical criteria alone.
Results
Sales could finally move at the speed of the conversation
Validation time
Down from 48 hours per person before the bureau check.
Teams aligned
Sales, UX, Legal, Business, and Tech behind one decision.
Unplanned win
Customer file and banking history enriched from first contact.
I spotted and proposed reusing the bureau data already captured in this flow to enrich the customer's file and ID process — a use that wasn't in the original scope.
Reported today
The improvements coming back from the field
Shared phone lines
Users share numbers that aren't theirs, so we need a validation limit of one verified line per person.
Accessibility for 60+
They aren't the core audience, but they do apply for credit — the flow has to work for how they receive and find notifications.
Push that lands in place
Releases confirmed the OTP is a code delivered by push — and pushes now take the user straight to the field when the app is already open.