I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security.
We need a method of validating that the user who has received the email is the same as the user in our system. i.e if the user added to the system is John Doe, but the email mistakenly (or maliciously) is picked up by Jane Doe, they wouldn't be able to access the system.
The current intention is to match the user's Last Name, Date of Birth and Postcode, but my feeling is that these are pieces of data which are readily available and could therefore be spoofed. We can't rely on a 2FA piece, as we don't have reliable mobile phone data for all users.
Can anyone recall a system that has a similar invite process and how they solved the problem? Alternately any ideas on how we might make this system more secure?
Thanks in advance.