Hi Ergumen,

Olan here from FNSValue. Thanks for reaching out.

This is a great question! Here are a few security features we have in place for this scenario:

1. Onboarding Information - Name and Username (aside from email and phone number) are part of our security measures, and these information are only used for device registration, and not for the authentication process. While some organizations may want specific usernames like employee IDs or account numbers, you can register any string of letters and symbols that are case-sensitive for these two fields. This prevents attackers from registering another person's account on a new device. Just remember them exactly in case you need to register a new device.
2. Physical Access to the Mobile Device - BSA requires user authentication when the app is opened using the device's security method (such as biometrics or pattern). BSA also employs the same biometrics/pattern security layer prior to successfully authenticating a user. This ensures that no one else, even with physical access to the device, can access it without the user's approval.

I hope this answers your questions!

Olan