Why Intuit picked FIDO

One of the long-time FIDO supporters gave testimony to its biggest benefits at the recent Authentication 2020 conference. The speaker was Marcio Mello, who is the head of Product for Intuit’s identity and profile platform. The benefits are saving money and time when users have to login to their SaaS financial offerings from Intuit.

Intuit was interested in FIDO for many years, and at the beginning of 2020 rolled out a FIDO application for iOS users of TurboTax, its tax preparation package. Now, if you are like me and if you use some form of this software, your goal is to spend as little time as possible using it. When you are done with your taxes and file them with the IRS, you hope this is the last time you will ever see this software until next year. Well, that works against usability in a big way, because most of us don’t remember our account passwords. Mello reminded his audience of this fact: “We have yearly active TurboTax users,” he said during his presentation. “Our users don’t come back anytime soon, so often they don’t remember their account sign-in information and then have to hassle with recovering their accounts.”

This is a perfect use case for FIDO, and Intuit created a new process so they wouldn’t have any passwords to remember. Their goal was to require as few clicks as possible to sign in. “We didn’t want to remain the identity police because we had a poor user experience,” he said. “With the old pre-FIDO ways, users had a lot of data entry to key in. The faster we can get them into our app, the better for everyone. This is because we are all in this together for a passwordless journey. And it is a long-term journey, because it isn’t just offering a quick fix.”

Intuit evaluated various FIDO vendors and picked NokNok’s S3 Authentication Suite. As part of their evaluation, they ran various stakeholder education sessions with everyone that would be involved in the rollout. They approached the project by first building the user interface for sign on and account management, then did a phased launch with the iOS version of TurboTax. Their goal was to get rid of OTP SMS for sign ins. Here is a diagram from Mello’s talk that outlines how they intended to evolve their user interface and authentication policies. 

He mentioned during his presentation that FIDO offered many benefits:

• The ability to future-proof identity standards that are also scalable and customizable.
•  An opportunity to lower our operational costs.
• Improve both security and privacy by having identity credentials that remain on your mobile phone. 
• Adding friction at the appropriate times when users are doing something riskier on their accounts. 

That last point is an important one, because it is a sign of assurance and mutual trust. Before FIDO, there was friction all over the place, which promoted just the opposite intention. They intended to use a combination of visible and invisible signals for fraud detection such as user behavior as part of the authentication process, which is the last line on the chart above.

So what happened? Their results were impressive. They found that since the beginning of the rollout in January 2020, there was a 99% reduction in users having to recover their authentication details and a corresponding big reduction in support costs and phone calls. There was also a 20% improvement in successful sign-ins, when previously moving the needle 1% had proven to be very difficult.  There was a 60% reduction in the time it takes to onboard new users through account creation on the iOS app. They quickly got 2/3rd of mobile app sign-ins via FIDO  and 23% of their users are now totally passwordless. “It is only a matter of time before all of our users will activate FIDO biometrics on their devices,” said Mello. As part of the FIDO project, they have extended FIDO authentication to other Intuit apps. “One of the advantages of FIDO is that we can customize how the initial authentication dialogs are presented for each of our applications. It isn’t a one-size-fits-all anymore around here.” They are also working on extending FIDO authentication in their  browser applications leveraging Nok Nok’s ability to support passwordless authentication across any touchpoint – mobile app, mobile web, pc web and even SmartWatches.