Skip to content

Moment 02 · Login

Passwordless login for banking apps: one tap, and no code to steal.

What login checks. Against what came before.

  • Not read here

    The face

    Not asked.

  • Checked

    The number and SIM

    The network or the SIM confirms the number.

  • Checked

    The phone

    The phone bound at sign-up, passed by the device risk gate before any route runs: no emulator, hooks or remote access.

  • Not read here

    The payee

    Not read at login.

  • Checked

    The session

    Typing and touch that match the owner rather than a script or a device farm.

Where fraud shows. And the decision.

BlockCredential stuffing and botsScripted logins from emulators and device farms break the owner’s rhythm and the device check.

The decision. Allow, in the example.

Everything holds

  • Why

    The bound SIM in the bound phone, confirmed by the network, a device known for 412 days and typing that matches the owner.

  • The customer sees

    Nothing to type. They are signed in.

  • A good customer

    One tap and nothing to type. A one-time code appears only when no stronger check can confirm the number.

Your FRM receivesALLOW · number verified · bound SIM · known device · owner rhythm

What to measure. Agreed before the pilot.

Where they start
  • SuccessAttempts that end signed in.
  • RouteWhich check verified each login.
  • CodesCodes sent per login, against today.
  • SpeedFrom Continue to signed in.

Rules it supports.

  • India, Singapore, the UAE, Malaysia and the Philippines

    One-tap login that tries the network check, the SIM check and Aadhaar consent before any one-time code, and face checks with injection defence where identity is in doubt.

    The rules, market by market
  • India, Singapore, Malaysia, Australia and Saudi Arabia

    Device, behaviour, scam and payee signals read at login, new payee and payment, returned as one decision with its reasons.

    The rules, market by market
  • India and Malaysia

    SIM and device binding at onboarding and re-binding on change, with the number confirmed by the network and device integrity read every session.

    The rules, market by market

Start with sign-up, login or payments.

Pick one, test it on your own traffic before you commit, and add the others on the same SDK when you’re ready.