Multilingual MFA in 34 Languages: Avatier's Identity Challenge Card

Multilingual MFA is multi-factor authentication whose prompts, instructions and credentials reach each worker in a language and script they read. Avatier's Identity Challenge Card™ ships in 34 languages, including right-to-left Arabic and CJK Chinese, Japanese and Korean, with the same card and the same three-factor flow in each.

Avatier puts it in one line: "Same card, same three-factor flow — localized for every worker." For global and frontline workforces, that is the design goal. The check stays identical whether a worker reads Spanish, Arabic or Japanese. Only the language changes.

Why language belongs in MFA design

MFA is a short set of instructions as much as a security check. A worker has to read a prompt, understand what it asks for, and answer it correctly, often under time pressure. As a general rule, a prompt a worker can't read is a prompt they guess at, skip, or escalate to the service desk.

NIST's authentication guidelines, SP 800-63B, treat this as part of usability. Under common usability considerations for authenticators, NIST advises: "Write user-facing text (e.g., instructions, prompts, notifications, error messages) in plain language for the intended audience." It adds: "Avoid technical jargon, and write for the audience’s expected literacy level." And on legibility: "Illegible text contributes to user entry errors."

For a global workforce, plain language means more than one language, and more than one script. The W3C's internationalization guidance explains why direction matters: "Languages don't have a direction. Scripts have a writing direction, and so languages written in a particular script, will be written with the direction of that script." Arabic and Urdu are both written in the Arabic script, which runs right to left. Japanese, in the W3C's words, "uses several scripts." A prompt or card laid out only for left-to-right Latin text asks those workers to do extra work at the moment they are trying to get back in.

The card adds a spoken step, too. At the service desk, Avatier describes the check this way: "The agent reads a coordinate down the line. The caller reads the word back off a printed card. And that value is spent." When that exchange runs in a second language, both people work harder than they need to. For the service desk side of caller verification, see AI Call Center Authentication.

The 34 languages on the Identity Challenge Card

Avatier's product page states that the Identity Challenge Card "ships in 34 languages" and shows each one as a tile. The page's opening list puts it briefly: "Multilingual — RTL and CJK included." The live demo repeats the point: "Works in any language, including RTL and CJK."

Grouped by script, using the Unicode CLDR script code for each language and keeping Chinese, Japanese and Korean together as CJK the way Avatier's page does, the 34 tiles break down like this:

Script	Languages on the card
Latin	English, Spanish, Spanish (Mexico), French, French (Canadian), German, Portuguese (Brazil), Portuguese (Portugal), Italian, Dutch, Polish, Swedish, Danish, Norwegian, Finnish, Czech, Hungarian, Slovak, Turkish, Indonesian, Swahili, Catalan
Cyrillic	Russian
Greek	Greek
Arabic (right to left)	Arabic, Arabic (Egyptian), Urdu
Devanagari	Hindi
Bengali	Bengali
Thai	Thai
CJK	Simplified Chinese, Traditional Chinese, Japanese, Korean

That spread is what lets one program cover a mixed workforce. A Polish line lead, a Hindi-reading technician and a Korean-reading nurse can all carry the same card design and answer the same check, each in a language they read.

The 34 languages on the Identity Challenge Card span Latin, Cyrillic, Greek, Arabic, Devanagari, Bengali, Thai and CJK scripts.

Same card, same three-factor flow, in every language

The localized card keeps the same three factors. Avatier describes them this way:

1. Challenge Card Factor. "A printed grid of word pairs. At login, the system asks for a specific coordinate — the user reads the answer directly off the card."
2. Private Knowledge Factor. "A short PIN that only the user knows." Avatier describes the PIN as "never stored on a device."
3. Identity Anchor Factor. "The user's directory identity — Employee ID, badge, or SCIM-provisioned principal."

In Avatier's login explainer, the sequence runs: "The screen types out a coordinate. The worker reads the matching word off the printed grid, then adds the private PIN. Directory Identity resolves automatically, nothing to approve." Avatier says the three factors resolve "all locally, all without a device, and all in under 10 seconds," and that "Each coordinate value is one-time."

Because the flow is the same, the training can be the same. As general guidance, a shift lead can teach the check once, in the team's own language: find the coordinate, read the word, add the PIN. The steps hold for a Turkish reader and a Korean reader alike. For how the three factors work together, see Three-Factor Authentication Explained.

The same three-factor check runs in all 34 languages: the coordinate, the word from the card, the private PIN, and the directory identity.

Where multilingual MFA matters most

• Service desk calls. The caller reads a word back to the agent. Reading it in their own language keeps the check quick and accurate.
• Shared workstations and frontline floors. Avatier's login explainer opens with "This workstation had a different worker an hour ago." The next worker at that screen may read a different script, and the factor travels with them: "It's in the worker's pocket." For frontline teams, see MFA for Frontline Workers Without Phones.
• Self-service reset. A locked-out worker resolves it with the card, and Avatier says the reset "still works when the phone is dead, out of signal, or in a locker." In its words: "Proof first, then the password."
• Issuance at scale. Avatier says "Every card is issued through the existing IGA workflow," and names the enrollment options "Self Enrollment or Auto Enroll Everyone at Once." A lost card "is revoked in seconds and replaced the same day." For the full lifecycle, see Issuing, Revoking and Replacing the Identity Challenge Card.

A few rollout practices help, too:

• Ask workers which language they read. As general guidance, base the choice on what each worker reads every day, not on the site's country.
• Train in that language. Teach the three steps in the same language as the card.
• Pilot across scripts. Before a broad rollout, test with readers from each script on your list, including right-to-left and CJK readers.

What Avatier ships toward this pattern

• Identity Challenge Card™. The printed three-factor card for the service desk, login and password reset, in 34 languages with RTL and CJK included. Avatier describes it as deployed in under an hour, with "No MDM, no app, no hardware." For the product and a live three-factor demo, see the Identity Challenge Card.
• Strong MFA Login. Pillar 5 of Credential Governance™ binds a strong second factor, including Microsoft Authenticator, Okta Verify, Duo, RSA or the Identity Challenge Card, to every password authentication event. Avatier says it "verifies users in their native language — covering 34 languages across MFA prompts and verification workflows." For details, see Strong MFA Login.
• The wider platform. For Avatier's AI-native identity platform, see the Avatier Identity Anywhere 2027™ preview. For the full product line, see avatier.com.
• Security posture. Avatier is SOC 2 Type II audited with no exceptions noted and ISO/IEC 27001:2022 certified. For details, see the Avatier Trust Center.

Getting started

To see the check yourself, try the live demo on the product page: "No signup. No download." It lets you resolve a live three-factor challenge against a printed card, the same flow a worker runs during an identity outage. From there, map your workforce's languages against the 34 on the card and pick the first sites to pilot.