How One Enterprise Built a Secure MFA Session Handoff System for Shared Store Tablets

An anonymized enterprise developed a custom multi-factor authentication platform to handle secure session transfers between shared in-store tablets and customers' personal phones. The challenge arose because multiple users — employees, managers, and customers — interacted with the same device during a single transaction, making standard MFA insufficient. The solution used a serverless architecture built on AWS AppSync, Lambda, DynamoDB, and CloudFront, with a React and TypeScript single-page application on the customer side. A short-lived handoff record was created for each session, storing a sensitive single-use signing URL that was never exposed until identity verification was confirmed. The system was designed to prevent session token leakage, block duplicate QR code scans, and push real-time status updates to the customer's phone.