Repeated pin failure locks account

BillHodghead commented 7 years ago

From @bhcrosslake on January 11, 2017 22:26

As a phone user my account pin is protected against someone trying to guess it.

If someone is trying to guess another person's account pin they could try many numbers. We should block attempts after enough retries

Acceptance Criteria:

[ ] After 3 failed retries, an account is put on hold, where money can be received but not sent.
[ ] A DFSP agent to release a hold through the operational UI.
[ ] A DFSP agent can see a list of holds
[ ] Releasing the hold requires some validation of the user identity.

Copied from original issue: LevelOneProject/Docs#332

BillHodghead commented 7 years ago

Since we haven't implemented putting an account on hold, we may simply want to raise an alert that there is a PIN issue.

BillHodghead commented 7 years ago

From @gstaykova on June 29, 2017 12:9

Hi @bhcrosslake, I am not sure how to handle this issue - is it icebloxed since we do not have a good idea about how exactly to solve it or because it is blocked by some pending work for locking accounts (which is not planned at all either, so I am not sure if it will be covered in this PI)? Do we work on implementing such an alert? Where should this alert be raised/viewed? Please let us know what you think.

BillHodghead commented 7 years ago

It doesn't make sense to add these features in phase one. Let's move this out.

LevelOneProject / leveloneproject

Repeated pin failure locks account #13