Identity & Authentication case study
Card paymentswithout SMS codes
01
The problem (2021)
Since 2009, rules in India have required a second factor on online card payments, and in practice almost every bank met it with an SMS one-time passcode. On congested mobile networks those codes arrived late or never, and checkouts timed out, so a delivery problem became a compliance problem. Many phones in use had no fingerprint or face sensor, so biometrics couldn’t work for everyone. Most of these were small, everyday payments, where any friction loses the sale.
02
The insight
People already knew and trusted a 4-digit PIN from years of ATM and card-machine use.
03
The design
At registration, the phone binds a 4-digit PIN through FIDO, and the PIN never leaves the device. At checkout, the phone’s FIDO proof travels with the 3-D Secure data, a FIDO server checks it, and only then does the payment go for approval. No SMS needed, it works on any phone, and the second factor stays compliant.
How the payment is checked
No SMS code. The PIN stays on the phone. A FIDO proof travels with the 3-D Secure data, a separate FIDO server checks it, and only then is the payment approved or declined.
Register: the phone binds a 4-digit PIN with a FIDO server.
Pay: the PIN unlocks the phone’s FIDO proof.
Send: the proof travels with the 3-D Secure data.
Verify: a FIDO server checks the proof.
Approve: only then does the payment go for approval.
04
Timeline and outcome
Designed in 2021. Patent filed in 2022, granted in 2025 (US 12333542). I directed the team that built it and was one of its architects and co-inventors.