Loading case study…
Loading case study…
Insurance / Authentication UX
Etiqa
Rethinking Authentication Beyond Passwords
Modernising a basic login experience into a more comprehensive authentication journey, balancing user needs with technical, security and compliance requirements.
01Etiqa / Internal platform
Enterprise Authentication Experience is the sign-in experience for an internal Etiqa platform. I was the UX/UI Designer for its redesign, a real internal project for Etiqa Insurance & Takaful.
The work expanded a basic username and password login into a more comprehensive authentication system, adding password reset and management, OTP verification, passkey registration, sign-in and management, Maybank Single Sign-On (SSO), and session timeout with re-authentication.
02Where It Started
The previous authentication experience supported only a username and a password.
It also lacked a Change Password feature, leaving the account experience with limited password management capabilities. The project was an opportunity to support additional authentication methods and improve how users manage their sign-in.
03The Challenge
Introducing new authentication methods required more than adding buttons to a login screen. Each journey had to align with technical requirements, existing identity systems and compliance expectations.
The challenge was to make several sign-in methods understandable while respecting the constraints defined with IT and other stakeholders. The key challenge was balancing usability with IT and compliance requirements.
How might we
How might we create a more flexible authentication experience while maintaining clarity and meeting IT and compliance requirements?
04My Role
I designed the authentication experience across the relevant user journeys. My deliverables were UX flows and high-fidelity UI designs in Figma, and I stayed involved through development with Design QA against those designs.
05Requirements & Collaboration
Requirements were gathered mainly through discussions with the IT department and other stakeholders. They established the authentication needs, technical feasibility and compliance considerations, which I translated into user-facing journeys.
Gathering authentication needs from IT and stakeholders.
Turning technical requirements into clear flows and interfaces.
Reviewing design decisions against implementation and compliance constraints.
06Experience Architecture
Authentication methods included username and password with OTP verification, passkey sign-in, and Maybank SSO, with account management for passwords, passkeys and MFA methods, and session expiry leading back to sign-in. The diagram is a conceptual view of the designed journeys; each method follows its own verification steps.
Platform sign-in
Username and password
Passkey
Maybank SSO
Account management
Session management
Each method follows its own verification steps.
07Standard Sign-In
Username and password stayed part of the redesigned experience. The new login presents the available methods, password, passkey and Maybank SSO, within one coherent entry point, so users can see their options without moving through separate, unrelated entry screens.
08Password Management
The previous login had no Change Password feature. The redesigned scope added password reset and password management, so recovering or changing a password became part of the account experience.
09Passkey Experience
I designed the passkey experience end to end, covering registration, sign-in, guidance and management, including adding passkeys for other devices and removing registered ones.
A passkey has to be registered before it can be used to sign in, and registration starts from the user’s existing Etiqa credentials. Guidance explaining this prerequisite helps users move from a familiar password to a different way of signing in.
Guidance
Sign-in
Passkey sign-in is a different mental model from a password, so the interface states what a passkey is, what to do when none is registered yet, and keeps the standard sign-in one step away.
Registration journey
Conceptual system prompt · provided by the device, not designed UI
Create a passkey?
Confirm with your screen lock to save a passkey for this site.
Passkey management
Management was part of the designed experience from the start, with a list of registered passkeys, adding another one and removing one, with clear actions.
10Multi-Factor Verification
Verification after the password is by OTP, by email by default, with SMS as an alternative. The designs also present further verification options and a resend control, and an account security page organises passkeys and MFA methods with their status. These are designed options; not every method is claimed as enabled or released, and the code lengths, timers and options shown in the illustrations are sample values, not project rules.
11Maybank SSO
The redesigned login includes Maybank Single Sign-On as another way in. The experience had to communicate this alternative clearly while respecting the external identity authentication it hands over to, and bring the user back to the platform afterwards.
12When security shapes the experience
Session timeout was a confirmed IT and compliance constraint. When the session expired, the user was required to log in again. The design makes it clear why they can’t continue and what to do next, with a direct route back to sign in.
13UX Decisions
Present the different authentication methods clearly within the login experience.
Explain that a passkey must be registered before it can be used to sign in.
Dedicated interfaces for managing passkeys and MFA methods.
Turn a compliance-driven requirement into an understandable re-login journey.
Flows designed together with IT and stakeholders.
14Design Process
Discussed authentication needs and constraints with IT and other stakeholders.
Translated requirements into authentication and account-management journeys.
Created high-fidelity UI screens in Figma.
Refined the designs through discussions about implementation and compliance requirements.
Worked with developers and reviewed the implemented interfaces through Design QA.
The application was developed and entered security testing. Real-user testing was handled by the testing team.
15Outcome & Status
Developed · Security testing in progress
The redesigned authentication experience has been developed and is currently undergoing security testing. I supported it through implementation and Design QA.
Delivered design scope
16Key Takeaways
Sign-in, verification, recovery, management and expiry are one experience, not separate screens.
Technical and compliance requirements shaped the flows as much as the interface did.
New methods like passkeys need guidance about prerequisites, not just a button.
The result came from design, IT and development working through the details together.