Qualify IMB Bank’s leads more efficiently with a secure solution

Context & challenges

IMB, a major Australian bank, asked us to take on a critical challenge:

• Enhance form security on their Webflow site to prevent fraudulent submissions.
• Improve lead qualification by ensuring that only verified users can submit requests.

As a banking player, IMB had to meet high standards of security and reliability, while guaranteeing a fluid user experience for its visitors. The objective was therefore to implement a robust system, without introducing excessive friction for legitimate users.

Understanding & consulting

We started the project with a scoping and audit phase in collaboration with :

• IT team: to ensure technical integration and compatibility with internal systems.
• Security & Architecture team: to meet banking compliance requirements.
• Design team: to maintain a UX consistent with IMB's brand identity.

This collaboration enabled us to define an optimized technical and UX solution, reconciling security and frictionless user experience.

Solution implemented: OTP with Twilio Verify + Webflow

Enhanced security via SMS verification

We have implemented an OTP (One-Time Password) authentication system to filter out fraudulent submissions. In concrete terms, the workflow works as follows:

1. The user enters his or her telephone number in a field on the Webflow form.
2. A verification code is sent by SMS via Twilio Verify.
3. The user must enter this code to validate the submission.
4. The form is sent only if the code is correct.

Technical implementation details

• Multi-step form in Webflow via Formly to streamline the process.
• Integration of a country selector for the telephone number with the Intl Tel Input library, guaranteeing a format compatible with Twilio and a better user experience.
• Backend scripts on Twilio Functions to manage :
  • /start-verify: sending the SMS with the OTP code.
  • /check-verify: verification of the code entered.
  • Implementation of secure CORS, hidden cookies on the server side and HTTPS queries.

Why not use reCAPTCHA?

reCAPTCHA would have added an extra friction to the user experience. The OTP system offers a better UX while being more robust against bots, which can't receive and validate an SMS.

Collaboration & results

Thanks to agile collaboration with the various IMB teams, we have achieved significant results:

• Optimized user experience: smooth process, without unnecessary friction.
• Efficient spam elimination: elimination of fraudulent submissions.
• Respect for banking security standards: compliance assured.
• Scalable and documented system, for easy maintenance and future enhancement.

Deliverables to customer

• Detailed technical documentation.
• Technical configuration demo in read-only Webflow.
• Explanatory Loom video for in-house team.
• Customized, secure scripts, ready for deployment.

Stack used

• Webflow: front-end and forms management.
• Twilio Verify API: OTP authentication service.
• JavaScript: custom scripts for integration.
• Formly: advanced Webflow-based form solution.
• Intl Tel Input: management of international numbers.

Conclusion

This project illustrates how a bank can strengthen the security of its Webflow forms while guaranteeing a fluid UX. Thanks to the strategic integration of Twilio and Webflow, IMB now has a robust, scalable system that meets its security requirements.