Virgo — New Device Login Security

01Impact first

We shipped a two-sided login verification system that alerts users the moment a new device signs in — with device type, location, and time — and lets them approve or block instantly. Competitive analysis showed no major Indonesian wallet (OVO, DANA, Gojek, Grab, LinkAja) let users respond to suspicious logins from their current device. Virgo led instead of following, reducing phishing-based takeover risk and setting the internal benchmark for security flows.

02The problem

"I didn't even know someone had logged into my account until my money was gone." — Virgo user

As digital wallets became daily habits, phishing and social engineering grew quietly. Most competitors simply logged users out without warning — no notification, no control, just confusion.

03Key design decisions

• Two-sided flow: the new device waits on a verification screen while the trusted device receives a push — "Did you just try to log in from a new device?"
• Full context up front: device type, location, time — laid out simply
• Two clear actions: "Yes, it's me" or "No, block this". Blocking locks out the new device and prompts an instant passcode change
• Emotional calibration: illustrations that signal concern without panic. The goal was to calmly empower, not alarm

04Reflection

Security UX isn't about locking people out — it's about letting the right person in. It's easy to add security; it's harder, and more powerful, to design confidence.