A radically simple new cybersecurity technology for organization webservers to prevent identity theft and account takeovers by making web logins invisible to hacker malware. Technology An API inverts WebServer-Browsers architecture on specific data fields. The user's phone is harnessed by the webserver and used as a data input device. The keypad is an illusion created by the webserver. Encrypted websockets ensure nothing can intercept the communication. User on-screen actions can only be decrypted by the webserver session which generates characters inside the webserver. This is also the only place where context exists to marry the username with the password. Only asterisks are echoed back to the user's screen so there is literally nothing to intercept on any user device. Multi-Factor Authentication (MFA or 2FA) is invisible to the user and created seamlessly using unique device identifiers on the mobile. The system supports multi-signature transactions by allowing multiple input devices to work in parallel. Competitive Advantages Identity and Access Management (IAM) security solutions, such as biometrics or MFA, require significant changes to backend infrastructure along with the distribution and education of new technology to users and customers. All websites use passwords and will continue to do so for another 10 years. BankVault isn't changing this. It simply makes user input invisible to malware, even from compromised devices. The integration of the API into the webserver is 20 lines of code and about as many minutes. There is no change to backend infrastructure and it is completely intuitive for users. They already have their passwords. The solution addresses 6 of the largest cybersecurity issues targeting identity theft: