Authentication method comparisons - image from Microsoft
It took ~20 minutes just to log in to my TaxAct account --> the same amount of time it took me to file my entire return with a competitor.
Reviewed and documented the complete authentication experience for TaxAct. Proposed my insights and recommendations to management.
Unfortunately, management chose not to invest in the authentication space since they had already done so six months earlier.
Objectives
Findings
Documented the current experience of account creation, sign in and forgot password.
Documented TaxAct's login flow
Creating an account before verifying email (email is the unique identifier)
TaxAct violates AAL2 security standards by creating an account before verifying email ownership
Saying a code was sent to your phone when nothing was sent
- Violates AALS (Authentication Assurance Level), integrity and anti-enumeration protections
On the last page it says a code was sent to your phone when nothing was sent
Customers call in about these issues...
On top of these painpoints is when users call in and the agent gives further misleading information as seen below:
Code doesn't show up - rep suggests dif browser and restarting phone
Code doesn't show up - rep suggests waiting an hour
Code doesn't show up - rep suggests creating a new account
Valid password entered but cannot sign in and says 'Sign in error'
- No indication of what's wrong or how to fix the problem
Entered a valid password and tried to change to a new password meeting all requirements but shows an error
Customers call in about these issues...
"It's got to be the system.....I definitely feel like it's a site thing though because I've been going through this for days....How do we fix it? I do not not want this to happen again. Ever."
- User who called in for 27 minutes and said they haven't been able to sign in for days
TaxAct doesn't meet expectations compared to competitors and other financial companies.
TaxAct compared to competitors
TaxAct has 10 fields vs competitors with 4 or less fields when retrieving an account. With every number of field allows the opportunity for an error and
Taxact asks for 10 fields when competitors ask for 4 or less.
TurboTax and H&R login flows and notes
Documented competitor screens and flows
Design Objectives
During this phase, I mocked variations of new screens trying to focus on necessity of information, level of security needed and simplicity of the experience. The final solution was to use email as a unique identifier for the account and implement passkeys to eventually remove future passwords from being stored on the servers.
Ideation verifying both mobile and email during account creation
Ideation using different security methods and designs
Current experience and Recommended experience
Initial ideations for introducing Passkeys
Final sign on recommendation with Passkeys
Creating an account without a password to remember or store on a server to get hacked
Within just six months, there had been so much turnover that the director of product, product manager, and UX designer who had previously worked on account authentication were no longer in place to continue addressing issues. The CEO was reluctant to allocate additional budget to accounts, given recent investments, and the current IT leader did not believe any problems existed. Meanwhile, the customer service team confirmed my findings that account issues were a major driver of support calls. Ultimately, leadership did not view the problems as significant enough to warrant further investment.
Why this didn't work
Takeways
