Other people’s experience is a great teacher, isn’t it?
Nigeria digital savings app Piggyvest did not wait to have its own security scare with a customer. Learning from the events of the past week involving Cowrywise, the startup enabled two-factor authentication for withdrawals and other “sensitive actions” on Wednesday evening.
Until the new feature was activated, a user only had to provide their Piggyvest password to withdraw money
from the app. Provided the destination account conformed to the Bank Verification Number registered to the user, the transfer was approved.
The difference going forward is the requirement to tap an orange tab to generate a one-time password, as an additional security layer. The password – a six-digit pin – is sent to the user’s email address, and is programmed to expire after ten minutes.
The idea is that a user requesting a withdrawal will have no problem quickly accessing their email to get the OTP needed to complete the transaction. The feature was received well by the app’s users. But it’s worth asking – given the apparent email compromise in the Cowrywise case – if email is a better alternative to SMS which banks typically use. More on this and Cowrywise’s product philosophy on TechCabal.com later today.
|
