We replaced sign-up with a face scan. Old accounts had other plans

After we moved login on gross.uz to a face scan through MyID (Uzbekistan's national ID service), one question became loud: why does a registration form still exist? Filling in forms is where typos, duplicates and fake data are born - while the face scan already gives us a verified, passport-backed identity. So we retired the form. Your first scan is your registration.

No account is born silently

The tempting shortcut was: scan passed, no account found - just create one instantly. We refused that shortcut, because of the rule from the previous post: the only proof of a phone number is a code you type back.

So a brand-new user's first login looks like this:

1. Face scan passes, but no account matches your passport data.
2. A window asks for your phone number - you type it, we don't guess it.
3. An SMS code confirms the number is really yours.
4. Only then is the account created - already verified, no password to invent, nothing to fill in.

The old registration form wasn't deleted - it's switched off behind a flag, ready to return if we ever need it. Removing things gently is cheaper than removing them bravely.

Then a real user hit a wall

Shortly after, a complaint came in: a user passed the face scan, typed their number, entered the SMS code correctly - and got told "this number already belongs to an account." Dead end. Scan again, same wall. The system was refusing to let a person into their own account.

I dug into the request logs and found the story. Back in 2023 this person had created an account the old way - just a phone and a password. That account had no passport identity attached at all (like most accounts from that era, made before face login existed). The new flow searched by passport, found nothing, tried to register - and then discovered the phone was "taken"... by the user's own forgotten account.

The fix: recognize, don't block

The fix reads simply: if the number you just proved belongs to an old account that nobody's identity is attached to, you don't get blocked - you get your account back. The face-scanned identity attaches to it, and all its history (policies, documents) comes home. No duplicate, no dead end.

The security thinking mattered more than the code:

• Proving a phone by SMS already unlocked that account through "forgot password" - our fix grants nothing the old flow didn't.
• Actually it grants less blindly: a face scan tells us exactly who is claiming, with passport-grade certainty.
• Accounts with anything elevated on them - agent access or a money balance - are excluded and stay locked to a human review.

From the complaint to a tested, security-reviewed fix: one working day.

Replacing a form with a face scan was the easy half. The real work was respecting years of legacy accounts created under older rules - the "taken" wall was invisible in every test with fresh data and appeared only when history walked in. Now I test new auth flows against the oldest accounts in the system first, not the newest.