Giving customers control over card security at Bank of New Zealand
Snapshot
Role: Product Designer — Cards & Payments
Feature: Card Pinning
Timeline: 3 months (MVP)
Impact: 70% of card PINs set by customers, 1,000+ hours of bank staff time saved annually
At the Bank of New Zealand (BNZ), customers were required to visit a physical branch to set or update the PIN for a new or replacement debit or credit card.
This dependency on branch staff created friction for customers — particularly those in remote locations — and placed a significant operational burden on the bank.
I designed and delivered a mobile-first solution that allowed customers to securely set their card PIN themselves, reducing reliance on branches while maintaining strict security requirements.
Context & Problem
BNZ is one of New Zealand’s “big four” banks, with a mature digital platform and strong mobile adoption.
Despite this, one critical task remained locked behind a teller-only process:
Setting a card PIN.
Customers had to physically visit a branch
Bank staff spent significant time on low-value, repeat tasks
The experience conflicted with BNZ’s broader digital self-service strategy
The opportunity was clear:
How might we give customers control over their card PIN without compromising security, and deliver it quickly with limited engineering capacity?
Constraints & Timeframe
This project was shaped heavily by non-negotiable constraints:
Regulatory & security requirements
Cards must still be mailed to a physical address
A PIN could only be set once the customer physically had the card
Delivery constraints
Limited developer availability
Mobile engineers were best positioned to deliver within the timeframe
Time pressure
The solution needed to be delivered within 3 months to reduce branch dependency ahead of major hub closures
A deliberate decision was made to:
Focus on mobile apps only for the initial release
Defer desktop support unless post-launch data justified it
This concession allowed us to ship value sooner while aligning with existing customer behaviour around card management.
My Role
I worked closely with product, engineering, and legal stakeholders to:
Translate operational and security requirements into a usable experience
Design and validate a mobile-first PIN setup flow
Balance speed of delivery with trust, clarity, and compliance
I owned the end-to-end design from concept through to release
Design Approach
Designing within security constraints
Rather than fighting the constraints, the design leaned into them:
Visual confirmation of the specific card being activated
Requiring entry of the CVV number to prove physical possession
Clear, step-by-step screens that mirrored in-branch conversations
This allowed us to meet security expectations while keeping the experience simple and reassuring.
Usability Testing & Iteration
I prototyped the flow and tested it with 6 customers.
Key learnings:
The term “CVV” was not universally understood and required clearer explanation
Breaking the flow into single-task screens reduced cognitive load
A clear success state was critical to customer confidence
These insights directly informed the final design.
Final Experience
The released flow guided customers through:
Confirming the card they received
Proving possession via the card’s security number
Understanding PIN safety expectations
Setting and confirming a new PIN
Receiving clear confirmation the card was ready to use
The experience deliberately mirrored familiar mobile security patterns to reduce friction and speed adoption.
Results
Following release, we saw immediate impact for both customers and the bank:
70%
of card PINs were set by customers via the app
1,000+
hours of bank staff time saved annually
Reflections
Speed through constraint
Accepting a mobile-only release enabled faster delivery without sacrificing outcomes.
Security doesn’t have to feel complex
By translating compliance requirements into clear, human steps, we maintained trust while improving usability.
Focus beats completeness
Shipping a focused, high-impact solution created value quickly and left room for future expansion.