Indonesian digital identity firm VIDA has demonstrated a production deployment of passwordless authentication at a Malaysian digital bank, using the case to argue that passwords and one-time codes have become the weak link that lets organised fraud chains take over accounts.
Presenting at a technology conference in Malaysia, VIDA founder and chief executive Niki Luhur walked through how a single compromised device can set off a chain of fraud, from malware hijacking banking sessions to stolen funds moving through mule accounts and offshore. Once a device is compromised, he argued, fraudsters can intercept one-time passwords, hijack authenticated sessions, and impersonate legitimate users, which makes authentication built on shared secrets and texted codes structurally vulnerable no matter how careful the customer is.
The alternative VIDA showed replaces passwords and one-time passwords with device-bound credentials and biometric authentication, verifying the customer through a trusted device rather than through codes that can be stolen or intercepted. In the deployment Luhur presented, at a digital bank he did not name, the approach secures the full customer journey from onboarding and logins through high-risk transactions and account recovery. “Authentication should not be treated as a one-time event. We need continuous authentication throughout the session to prevent advanced attacks such as session hijacking,” he said, adding that with the right architecture there does not have to be a trade-off between security and user experience.
VIDA is a licensed certification authority registered under Indonesia’s Ministry of Communication and Digital Affairs. Founded in 2018, it provides digital identity services combining electronic certificates, digital signatures, identity verification, and transaction authentication, built on public key infrastructure and biometric verification.
The demonstration speaks to a Southeast Asian market where carriers and banks alike have been shifting away from codes that travel over networks, with Maxis launching mobile identity authentication in Malaysia, and it echoes a global trajectory in which Microsoft has made passwordless authentication the default for new accounts.
Sources: VIDA
–
By the ID Tech Editorial Team
