Something you know
Password — still present, no longer sufficient alone.
Fintech and Web3BankingFlagship
15 / 21
NationalBankofPakistan:Web3multi-factorauthentication
An MVP of a multi-factor authentication product that adds a Web3 credential as a login factor.
Client
National Bank of Pakistan
Region
Pakistan
Practice
Fintech and Web3
Engagement
National Bank of Pakistan: Web3 multi-factor authentication
National Bank of Pakistan wanted stronger customer authentication than passwords and one-time codes alone — with a Web3 credential as an additional login factor, tested before bank-wide rollout.
Password + device + wallet key. A stolen password alone no longer opens the account.
Who stronger MFA protects
Customers
Accounts that do not open on a stolen password alone.
Security teams
A factor harder to phish or intercept than SMS codes alone.
Product
An MVP path to stronger security before a bank-wide programme.
The authentication factors
Something you have
Device as a second factor in the login path.
Something only you hold
Wallet key as the Web3 credential factor.
MVP for the bank
Tested build for NBP security and product teams.
How we approached it
Add a Web3 factor without pretending passwords disappear overnight.
Step 01 / 04
Layer, don’t replace
MFA that strengthens the existing mental model — know / have / hold.
Step 02 / 04
Raise the phishing bar
Design against interception patterns SMS OTPs are known for.
Step 03 / 04
Prove with an MVP
Security and product can evaluate a working path before bank-wide rollout.
Step 04 / 04
Stay aligned to evidence
Framed against industry MFA effectiveness — not novelty for its own sake.
Outcome
A stolen password alone no longer opens an account, phishing gets harder than SMS codes, and NBP has a tested route to stronger security before bank-wide rollout.
The need
NBP wanted stronger customer authentication than passwords and one-time codes alone.
What we built
An MVP of a multi-factor authentication product that adds a Web3 credential as a login factor.
A stolen password alone no longer opens an account
Harder to phish or intercept than SMS codes
A tested route to stronger security before bank-wide rollout
Proof metrics
Industry benchmark
99.9%
of automated account attacks are blocked by multi-factor authentication
Source · Microsoft
By design
MVP
tested build for the bank's security and product teams
How to read the numbers
- Verified. Measured on the named deployment.
- Industry benchmark. Published third-party reference; our delivery tracked in line with them.
- By design. A property built into the product.
Related work
See where this applies to your operation.
Free audit. You get the findings whether or not we work together.