I was looking at some posts lately where people get locked out of their accounts because their phone numbers are now inaccessible. It seems that the current method of 2FA (more commonly known as 2-factor authentication) used by neo is very antiquated.
SMS-based 2FA is easily bypassed by hackers by social engineering the victim’s cellular company (porting the number to the hackers own device, so they can get the codes instead). It also has a problem when the codes don’t get delivered or if the user is not in an area with cellular service.
There are new, more secure methods to login such as:
Passkeys (authenticate with device security to login, user never sees a password or has to remember it),
OTP apps (6 digit codes that reset every 30 or 60 seconds, similar to the codes sent to SMS, but are not tied to a phone number),
Security keys (physical devices that you insert and tap to send security info that verifies it’s you).
All of these would have to be setup by the user prior, but passkeys are already deeply integrated into iOS, Android, macOS, and Windows.
It was very dissapointing when I joined to learn that neo doesn’t support basic 2FA methods like OTP codes beyond SMS. Adapting the current system to add OTP apps should not be difficult at all.
Just confirming, the biometrics prompt definitely says use a passkey? Passkeys are an alternative to passwords for logging in, even for the first time, so the neo app may support biometrics but that is not the same as a passkey.
On iOS, Apple unifies passwords and passkeys by making them virtually transparent to the user, so you may be using a password without realising it.
Can anyone else confirm if neo supports passkeys now?
I actually agree that more, and more secure, login methods are very important features. A little more context on the posts you see here:
Sometimes people do lose access to their phones and need to get back into their Neo accounts. Passkeys and authenticators fail in this situation as well, we’ll always need to be able to authenticate people via support just in case. This is typically a very easy process, unless you have also lost your Canadian ID. We don’t have a great solution for this.
In these forums, we also get people posting because their accounts are frozen. This can happen for a variety of reasons. Sometimes we do it because we suspect someone has compromised their email and/or phone and are attempting to steal, sometimes we do it because the user is suspected of wrongdoing. There’s nothing we can do to speed this up, our investigations team needs time to go through the evidence and make a decision.
All that to say, I personally support alternate verification methods. If you’ve got more ideas, maybe this extra context helps!