1

I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security.

We need a method of validating that the user who has received the email is the same as the user in our system. i.e if the user added to the system is John Doe, but the email mistakenly (or maliciously) is picked up by Jane Doe, they wouldn't be able to access the system.

The current intention is to match the user's Last Name, Date of Birth and Postcode, but my feeling is that these are pieces of data which are readily available and could therefore be spoofed. We can't rely on a 2FA piece, as we don't have reliable mobile phone data for all users.

Can anyone recall a system that has a similar invite process and how they solved the problem? Alternately any ideas on how we might make this system more secure?

Thanks in advance.

Improve this question
4
  • You say "invite via email/SMS" but also "we don't have reliable mobile phone data", so we can assume you can use SMS or not? Also would these customers have an account with the company already that you could reuse their credentials?
    – DasBeasto
    Sep 19, 2017 at 13:24
  • Thanks for the question. We don't have a mobile number for every user. An email OR mobile is required to setup a user, not both. IF a mobile number is provided, then the system will invite via SMS. The customers don't have an existing account with the company.
    – Rob
    Sep 19, 2017 at 13:54
  • If you believe (and are worried about) an email for John Doe being responded to by Jane Doe, why do you appear not to be worried about SMS activation? Jane Doe might have got to John's phone before him, or Jane might have entered her mobile when providing the number?
    – TripeHound
    Sep 20, 2017 at 10:04
  • you are right and we are concerned about SMS messages too. The activation flow will be the same whether the user clicks through from an SMS or Email.
    – Rob
    Sep 20, 2017 at 14:42

1 Answer 1

Reset to default
3

A suggestion for making the system more secure. A provider of some of my student loans secures users by showing them a random person's face during registration with the directions to remember the face. There was some practice screens asking you to pick the proper face from a group of other individuals to get the user familiar with the purpose of this process.

When you send the email and the user returns to the login, you could ask them to pick their assigned face as a confirmation that the user is the same one who signed up. It's like a matching game.

This method does have lots of potential for drop-off or people not remembering...but adding a visual method authentication can help appeal to other sensory input. I'm not familiar with any system where the company registers people without some sort of initiation on the user's part.

Improve this answer
2
  • In the UK, NS&I (National Savings & Investments; "Ernie" the drawer of Premium Bonds) does something like this when signing-up online. When registering, you "select" and image and a phrase. I think the image was used as suggested (you select it from others when responding to the confirmation email) and both are subsequently shown during "normal" logins to reassure you that you're on the right site (a "phishing" site wouldn't [shouldn't!] be able to show the correct image).
    – TripeHound
    Sep 20, 2017 at 10:11
  • I've experienced this - Santander bank have the same functionality for their online banking. I wrote a silly phrase in mine! You don't have to confirm that it's the correct image, it just shows it as assurance you're in the right place. It's a nice feature.
    – Rob
    Sep 20, 2017 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.