I've been asked to review a system where a user can request a new login by having an access code sent to a mobile.

The business is wondering how many requests a user can have so that:

  • costs paying for excessive amounts of text messages are kept to a minimum
  • hacking/brute force attacks are minimised
  • user experience is kept as pleasant as possible.

They have two options:

  1. as many requests as one likes as long as one doesn't exceed 2 per minute
  2. 10 requests in one day, but as frequently as one likes until the 10 requests are reached

Which is the better option? Is there another option the industry uses?

1 Answer 1


Let's talk about the scenario when users have to send repeated access request.

They did not receive the code for original request because,

- There was no cellphone network (Edge Case): Can the system identify the cell network to make sure their device is capable of receiving a text? Y/N

N: Limit it to 2-3 attempts.
Y: Inform user that they don't have cell network to receive a text at that point of time, try after some time. And provide an alternate method, maybe email.

- They have changed their number and they don't remember which number was used for registration: Always show which number (XXXXXX8320) is the code being sent to with option to use an alternate method in case they don't have access to the number. Be simple and crisp in the solution, nothing pisses off more than a lengthy process of setting up a new number when you need to have access instantly.

- There is some technical glitch: You can't do much here, just limit it to 2-3 attempts.

- There is phishing attack so request being sent automatically Study how this attack happens? What is the frequency? What do all hackers need to know? And plan your defense accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.