Case study · Security
Passkeys, and extra checks for new withdrawal accounts.
Two security features for Bitcoin Suisse Online. Passkeys let clients confirm it's them with a fingerprint or face scan. EAS adds three security layers before a new withdrawal account can be used: an email code, an SMS code and a 24-hour lock.
Problem
Security is our first priority. Signing in and adding a withdrawal account both needed to meet modern security standards.
What I did
Designed passkeys as a new way to confirm it's you, and three new security layers for new withdrawal accounts, shown as one timeline.
How I worked
Turned security rules from compliance and the business into screens that explain each step.
Result
Both features are live. Stronger security that meets modern standards.
01 / The two features
Two features that work together.
Passkeys protect who is using the account. EAS protects where the money goes. They meet when a client adds a new withdrawal account: first they confirm it's them with a passkey, then the new account goes through the EAS security layers.
01
Passkeys
A fingerprint, face scan or security key instead of typing a 6-digit code. Faster, and it protects clients from fake login pages.
02
EAS (External Account Service)
Three new security layers before clients can send money to a new withdrawal account: an email code, an SMS code and a 24-hour lock.
02 / EAS
Three new security layers, in one timeline.
Adding a withdrawal account already asked for the account details and proof of ownership. We added three more layers: an email code, an SMS code and a 24-hour lock. All five steps are shown as one timeline, so the client always sees what’s done and what’s next.
Account details
1
Already in place
Proof of ownership
2
Already in place
Email code
3
Confirm by email
New
SMS code
4
Confirm by SMS
New
24-hour lock
5
Wait before first use
New
Decision 01 · One timeline
Show every step, every time.
- Problem
- Three extra steps could make adding an account feel long and unclear.
- Decision
- A progress list sits next to every step. It shows all five steps, marks the current one and keeps finished ones visible.
- Why
- Clients always know how far they are and what’s left, so the extra security feels manageable instead of endless.
New layer 1 · Email
A one-time code sent by email.
The client enters a 6-digit code sent to their registered email. For security, the code expires after a few minutes. They can resend it, and the screen reminds them to check their spam folder.
New layer 2 · SMS
A second code, sent to the phone on file.
The number is shown partly hidden. It can’t be changed inside this flow: if it’s wrong, the client contacts their relationship manager. That way, someone with access to the account can’t simply swap in their own phone.
New layer 3 · 24-hour lock
A 24-hour wait before first use.
Once all confirmations are done, the new account is on hold for 24 hours before money can be sent to it. This gives the client time to notice if the account wasn’t added by them.
Decision 02 · Ready time
A date, not a countdown.
- Problem
- After all the checks, the new account still can’t be used for 24 hours.
- Decision
- The last step shows the exact day and time it will be ready, and says we’ll notify the client.
- Why
- A countdown makes people wait and check back. A date answers the real question: when can I use it?
03 / After creation
Clear status for every account.
The Withdrawal Accounts list says in plain words where each account stands, for example "SMS Confirmation Pending", "Unlock pending – ready Fri 14:34" or "Proof of Ownership expires in 12 days".
Account page
One page per account.
The network and address are at the top, with a button to make a withdrawal. Below is every withdrawal made from this account.
The same flow also works on mobile.
04 / Passkeys
A fingerprint instead of a 6-digit code.
After the password, clients used to type a code from an authenticator app. A passkey does the same job with a fingerprint, face scan or security key. It’s faster, and it only works on the real Bitcoin Suisse site, so fake login pages can’t steal it.
Decision 03 · Passkeys
Offered, not forced.
- Problem
- Passkeys are new for many clients, and a new habit can’t be forced.
- Decision
- Passkeys are offered with a “Maybe later” option, and at sign-in the 6-digit code stays right next to the passkey button.
- Why
- Clients switch when they’re ready, and nobody gets locked out.
In Settings
A short explanation before adding one.
Clients read what a passkey is before they add one. A tip suggests saving the first passkey on a phone or password manager, so it works on all their devices.
Signing in
Code or passkey, on the same screen.
Clients can type their 6-digit code or tap “Passkey”. When someone signs in from a new device, we send a 6-digit code to their email to approve it.
Confirming important actions
The same passkey protects sensitive steps.
Before an important action, such as adding a new withdrawal account, clients confirm it’s them with their passkey. This is where passkeys and EAS work together.
05 / How I worked
From security rules to clear screens.
The security steps were fixed. My job was to make them easy to understand and easy to finish.
The usual team
I worked with the product owner, front-end and BFF developers, stakeholders and compliance.
Explain each step where it happens
Every screen says why the step exists, instead of hiding it in a policy page nobody reads.
Always a way forward
Resend a code, choose "Maybe later", use the 6-digit code instead of a passkey, or contact support. Clients never get stuck.
06 / Outcome
Stronger security that meets modern standards.
Both features are live.
Passkeys
A faster way to confirm it's you, and protection from phishing.
EAS
Three new security layers for new withdrawal accounts: email, SMS and a 24-hour lock.
Live
Both features are live on web and mobile.