Verifying an account with SMS as opposed to email address

Question

In order to be more secure we're looking into account verification. The two options are:

1. Email address verification (Asking the user to click a link in an email sent to their account to verify the account)
2. SMS verification (Asking the user to enter 4 numbers sent to their mobile into a form on the screen)

For me, I much prefer the SMS approach. Here's why:

• I don't have to leave the interface.
• It's quicker than opening/authenticating your email client.
• From a security perspective, it's much harder to create a 'fake' phone number than it is a 'fake' email account.
• If I'm using a laptop, when it's email verification, I usually use my phone to open the email and click the link. Then I have to go back to the laptop and refresh or navigate somewhere.

So does using SMS verification without email verification make sense from both a usability and security perspective?

Are there any valid reasons why a user couldn't receive an SMS message in order to complete their registration?

Answer 1

A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and clicking on the provided link. I don't think it's fair to assume SMS is quicker, as some people also don't carry a smartphone on themselves at all times (especially older folk).

Ideally, you'll want to verify both email and phone number if you have a sensitive service. Both for security of the account and data collection quality. The email verification aspect is the first barrier to prevent fake accounts, prevent people from using other people's email addresses, enable a password/login retrieval system, and more certainty that the user will receive any communication you send through mail. As a business you'd want good quality data, and this kind of validation ensures the email address is valid. You do have no way of knowing if the email was just a throwaway...

Generally you'll need a good reason to ask someone to verify a number, as its a known conversion killer and can be part of privacy laws. Depending on where you're at, you may have to deal with the General Data Protection Regulation or equivalent soon. Asking only necessary data becomes more relevant then. Email verification only is more 'justified' in that case, because you can tie it to login retrieval. It's kind of weighing the perceived security benefit with the hassle of all the verifying.

Answer 2

It's best to offer both email and SMS sign-up -- some users prefer the control that an email address provides, such as in cases of householding (when a couple or family signs up for an account, and wants a shared space for communications and transactional information.) SMS is very convenient and preferred by the mobile-first generation.

Answer 3

I would share my experience with lots of banking, wallet, Social apps which are actually asking for verification via an SMS. Even Apple is sending a verification SMS to its servers before activating iMessage and FaceTime only after you would be able to use 'Handoff' functionality on your phone and Mac.

Even I have observed SMS penetration even when calls are not able to connect.

Therefore to your preference for SMS, I would simply add my +1

Answer 4

"Are there any valid reasons why a user couldn't receive an SMS message in order to complete their registration?"

Sure ... Consider the following scenarios:

• Why should I give you my real cell phone # when I can use the throwaway email address I use for all such service sign ups? Is my phone # critical to the service you provide? If not, you don't get it from me.

• I'm over age ## so I still use a landline phone.

• I'm blind and use a screen reader for my computer, but haven't figured out how to get Siri to read me my texts yet.

• I registered w/my office landline # because that's where I'll use the service & they paid for it.

• I'm overseas w/o a working cell phone, but I have Internet access. Any business travelers or vacationers who might use your service?

• I live in a rural area w/o good cell reception, but I have a landline phone & Internet access.

• I work in an underground bunker or vault. Any military/gov't, banking, or other such industry employees using your service where no cell phones are allowed?

• My awful phone provider still charges $10/mo for texts so I don't pay for them out of spite

• I can't afford or don't want to spend $50+/mo for a cell phone, but I happily use free/public wi-fi to do all sorts of things, including registering for your service. (Visit your local library, career center, or starving grad student for examples).

BTW, people fake phone #s all the time now too - don't you get those scam calls from a number that looks almost like yours but isn't?

Offering both options for registration seems to still be preferable. Let people register via SMS if it's a possibility for them & they're ok giving your their real phone # , but offer email registration/codes as well for these & any number of similar reasons.

You could still offer opt-in SMS-based 2-factor authentication for added security while using the service, but don't make use of the service contingent on that without valid reasons.

Answer 5

Two-factor authentication (2FA) with the use of text messages is a great way to automated registrations and stop users from having many accounts used for various activities.

Remember that user validation during registration goes well with signing-in process. There are a lot of articles about specific aspects of 2FA if you would like to get more information on this topic. The great thing about being able to send user a text message is that with it does not matter what the password is, as even if attacker can "guess" the password, the code sent to users mobile device will remain unknown.

Answer 6

SMS is a convenient but not secure way to deliver OTPs. National Institute of Standards and Technology (NIST) issued new proposed digital authentication guidelines urging organizations to use other forms of two-factor authentication. Why don’t you consider hardware or software tokens? For example, Google Authenticator. It’s convenient and reliable. Or you can use a hardware alternative to Google Authenticator. Protectimus Solutions, the company where I work, offers Protectimus Slim NFC. It has a form of standard banking card and doesn’t require any internet or network connection.

Answer 7

SIM-swapping is a thing. People are essentially stealing your phone number, so that they can intercept any sms messages sent to your number.

The best approach, above email or sms verification, is to use an authenticator app. Authy is good because you can backup your accounts so, if your change your phone, you don't have to manually re-enter all your accounts, like you would with other popular authenticator apps.

Answer 8

First thing first, where does the most of the traffic comes from?

There would be certain percentage coming from both mobile and desktop, whichever is higher, optimise for that.

If it is from mobile, we should not discount the fact that both iOS and Android has autofill sms feature which works like charm.

If it is desktop, email and sms both can be better option but give them ability to choose from where they want to verify. Sometimes people don’t have mobile devices handy or just don’t want to be distracted by picking it up for a mere code.

Now to answer your question about sms failure, it happens on edge cases like no network, sms sending server glitch etc. Optimise for failure by giving them option to verify via email or resending the code on sms.