Martina your words suggest bunq does not have 2FA, but they do; the record-selfie-video-authentication as additional factor.
If you want to express wanting a third factor, which one would you prefer? When?
Secondly, and this is a question for all: What could be the recovery method for when OTP app/generator is lost or inaccessible? (@Alex)
Or when a synced Passkey is lost/inaccessible?
Or when a device-bound Passkey lost? (On phone / computer)
Or a Security Key is lost? (Device-bound Passkey on usb-stick size hardware.)
Personally, if I prefer not to fall-back on backup codes for banking.
I would suggest multiple recovery paths and let users choose. (Guide them.)
Examples:
- TimeDelay with Trusted contact (like Apple also uses).
- I guess the selfie-video-authentication could also be a fallback if the options mentioned above are an alternative path to it.
- If you allow your users to hardlock it to several Passkeys (so it works in sequence to the current authentication), the recovery method if all of them become inaccessible for some reason, could be to authenticate by transferring by 1 cent from another bank account. (iDIN) This unfortunately does not cover everybody.
- Not sure if allowed, but DigiD?
- …?…
If you have any suggestions, share. This topic’s feature (request) is not simple when you get into it. 😅
P.s. If you want to support a feature, also mention your reason why, it might help designers/developers.
