We're running some experiments to test authenticating on app open

[ConnorPB (Product Manager)]

Hey everyone

I wanted to give you an update about an experiment we’re going to be running in the App Evolution squad.

Today, we ask everyone to authenticate on app open once every 90 days, unless you’ve chosen to turn on ‘app lock’ in Settings. You also have to authenticate to complete sensitive actions like making a bank transfer or revealing your card details.

While some customers like the convenience of this approach, research tells us that many customers expect to unlock the app each time they open it. Not having this on by default can be concerning to some customers, and it drives regular feedback (here’s an example from the forum).

At the same time, device biometrics have improved, making it more convenient and secure to authenticate - 99% of Monzo customers have a biometrics capable device.

So we’ve decided to do an experiment with a small group of customers to find out more about how an app lock changes how customers use the monzo app. Starting this week, we’ll be asking a group of customers to authenticate every time they open the app (unless they’ve already done so in the last 5 minutes).

If you’re in the experiment, you can use biometrics to authenticate quickly and easily. If you don’t have biometrics or choose not to use them, then we’ll ask you for your primary account card PIN.

We’re also testing ways to make it easy to quickly access some information right from the lock screen. We’re experimenting with a version that includes a preview of your balance on the lock screen, so you can see important information without needing to enter the app. We’re looking to understand whether customers value this type of preview content, before we explore other ways we could use it.

The experiments will go to randomly assigned groups so we get representative samples to find out more about how the wider customer base responds.

If you do happen to be on an experiment, let us know your feedback. And even if you aren’t, thoughts are also welcome!

[N26throwaway (Sir Tom MacMonier)]

Love this. Finally. Thank you.

It solves the biggest pet peeve I’ve had with your app security model for many years.

[Ordog]

@ConnorPB

While some customers like the convenience of this approach, research tells us that many customers expect to unlock the app each time they open it. Not having this on by default can be concerning to some customers

I’m likely being naïve, but why does it need an experiment then? Why don’t you just enable it for everyone by default?

[gt94sss2]

@ConnorPB

If you don’t have biometrics or choose not to use them, then we’ll ask you for your primary account card PIN.

I would suggest that you allow customers to set up a passcode to login which is separate from the card PIN.

That is what most banks do as the alternative to using biometrics if needed.

Edited: to remove a misunderstanding on my part

[N26throwaway (Sir Tom MacMonier)]

Baby steps. It’s better than falling back to device passcode, like it does now. Which is the problem with what happened to that guy. The attacker had the device passcode and got into Monzo with it. Not the card pin.

Normally another thing you know shouldn’t be necessary. And if Monzo do, it won’t prevent that scenario either. The issue is an entropy. An extra digit or two makes it significantly harder to crack.

[npc_06]

I’ve had biometrics turned on since I can remember and honestly forgot that you could open the Monzo app without it! Good news though!

[mts (ᴊᴏɪɴᴛ ᴀᴄᴄᴏᴜɴᴛ ᴘᴀʀɪᴛʏ)]

@ConnorPB I agree, having a separate app PIN, of 6 to 8 characters would be ideal.

The 4 digit PIN for login, if widely used, would be easily remembered by thieves if seen out in the wild.

See the PIN, steal the card.

I like the idea of this additional security, it’s a welcome improvement, if implemented.

[dub]

I do like the convenience of not meeting to authenticate every time I open the app. But there are more and more news stories of people’s accounts being emptied because their phone got snatched so I understand things need to be tightened up. Early days but instead of account balance I’d love the ability to pick one of the numbers from the widgets at the top of the home screen like left to spend.

[Ordog]

@dub

But there are more and more news stories of people’s accounts being emptied because their phone got snatched

That can’t happen, even now. You need the card PIN to move any money if you don’t have biometrics enabled.

[HoldenCarver (Nick)]

@ConnorPB

Starting this week, we’ll be asking a group of customers to authenticate every time they open the app

If I find myself in this group I’m going to be so upset. I’m very much in camp “my phone is locked whenever I’m not using it, further locks to access the app are unnecessary friction for me”.

@ConnorPB

You also have to authenticate to complete sensitive actions like making a bank transfer or revealing your card details.

That’s already the way it works, isn’t it? And why I don’t feel the need for enforced authentication on just opening the app.

@dub

there are more and more news stories of people’s accounts being emptied because their phone got snatched

Are there really? The stories I always see are people who were frauded by sophisticated social engineering rather than physical phone snatches.

I tried Googling “phone stolen and bank account emptied” and the first result was this story from Reddit:

https://old.reddit.com/r/UKPersonalFinance/comments/17g3jib/phone_stolen_bank_emptied_and_now_they_are/

Unfortunately, I’m not sure an extra PIN would have helped in their case:

they forced me to hand over the pin at knifepoint

[michaelw90 (Michael)]

@HoldenCarver

Unfortunately, I’m not sure an extra PIN would have helped in their case:

Nah, it wouldn’t - but the other security feature they’re building should help

[dub]

@HoldenCarver

Are there really? The stories I always see are people who were frauded by sophisticated social engineering rather than physical phone snatches.

Oops, I think I’ve mixed a couple of stories up in my head

[Nightpaws]

The idea of PIN to authenticate seems off to me, I’d rather have a separate number to log into the app with, longer if wanted, but not my PIN. Seeing balance and spending money aren’t the same level of risk in my eyes so I’d want to keep my authentication to get into the app separate from my authorization to modify my account.

[Caol (Caol Crawford)]

Unsure if this is likely to be related to issues some users are having this morning trying to open the app while using a rooted android device.

Can you clarify whether this is intentional behaviour?

[duncang (Duncan)]

Sounds like a great addition to the app to me!

[andrew_fishy (Biggest horse fanatic in Leeds)]

Not to be “That guy” as it’s nice for Android users to see the main account balance, but iOS has this in the wallet app on iOS 17

Still very good to see improvements

[Chris_R (Chris Rimell)]

I’m happy that this is being looked at. I’ve already set biometrics as I don’t think it’s secure to not have it locked. It won’t fix fraud in general, but it’s another barrier to unauthorised access

[RichardL (Rich)]

@ConnorPB

Starting this week, we’ll be asking a group of customers to authenticate every time they open the app (unless they’ve already done so in the last 5 minutes).

Could I suggest/request that you run a further test where this 5 minute window is extended? Maybe 15 mins / 30 mins / 1 hr?

With Face ID being so fast, authenticating doesn’t bug me as much as it used to, but 5 minutes feels too short. I imagine this will quickly become annoying on a payday when I’m pinging between apps moving money about.

[lpoolrob (Rob)]

@ConnorPB

So we’ve decided to do an experiment with a small group of customers to find out more about how an app lock changes how customers use the monzo app. Starting this week, we’ll be asking a group of customers to authenticate every time they open the app (unless they’ve already done so in the last 5 minutes).

What change would you expect to see? It isn’t a gaming app which people choose to play at random times of day. Surely opening the Monzo app is a conscious thought because you want to do something in the app.

[Carlo1460]

A monzo one of these please.