Hapitas should replace outdated security questions with passkeys

What does Hapitas check when you redeem points?

On August 18, 2025, Hapitas extended security questions to point redemptions. Its official desktop guide describes these checks in order.

1. Security questionEnter the answer you registered.
2. Phone verificationGet a code by SMS or voice call using your registered number.
3. Account passwordReview the redemption details and enter your sign-in password.

The security answer and password both rely on information you know. Phone verification checks that you can use the registered number. In the cash redemption example via Digital Gift, the claim email arrives after you submit the request and is used to claim the gift. See step 5 of the redemption guide for screenshots.

Security questions are outdated for redemption approval

Other people may learn your hobbies or pet’s name from social media or everyday conversation. You may also forget exactly how you wrote an answer years ago. Hapitas limits answers to 10 hiragana characters. An easy-to-remember answer can be easy to guess. A hard-to-guess answer gives you another secret to manage like a password.

A fake redemption page can collect both your security answer and your SMS code. Checking access to the registered phone number has value, but adding a security question does nothing to stop a fake site from collecting what you type. Hapitas should rethink a design that asks users to remember another old answer to protect their points.

How Moppy differs, and why Hapitas should adopt passkeys

Moppy describes facial verification based on registered facial data for situations including a first redemption request. Hapitas’s official redemption guide lists a security question, phone verification and the account password. It does not list facial verification.

Hapitas should adopt passkeys. A passkey uses a cryptographic credential tied to the site where it was registered. You can approve its use on your device with your face, fingerprint or PIN. A fake site cannot use the credential registered to the real site, which protects against phishing that collects passwords or SMS codes.

Start with sign-in, then let users approve a redemption with a passkey after reviewing the destination and amount. Design recovery for lost and replaced devices, then retire security questions. If a guessable answer is enough to recover an account, it remains a way for attackers to take over.

What you can do now: strengthen your password

1. Use a password unique to Hapitas. Replace a reused password or one that differs from another password only at the end.
2. Generate and save it in a password manager. Choose a long, random password within the limits shown in the settings.
3. Start the change on the official site. Open Hapitas yourself, change the password in your account settings, then complete the confirmation from the email you receive.

A unique password reduces the risk that someone will try a password leaked by another service on your Hapitas account. A fake site can still steal a strong password you type into it. Check which site you are on before entering your password, SMS code or security answer.