2

We will be asking our users to generate an account verification code that will be texted to them in order for them to sign in (as an alternative to emailing a password reset link). How many digits of the (mainly UK) telephone number can you show (so users can tell it's the right one), without compromising security? I have seen this on other sites:

07*****1234

  • 1
    Prefix + 4 last numbers should be enough for anyone to recognize if his phone number is right. – Pectoralis Major Feb 20 '18 at 10:22
1

A general principle to follow is to provide enough information for a user to identify the known phone number, while restrict others from any unintended use of it.

Most commonly, last two digits will be enough to recognize a phone number.

Let's have a look how a verification may be implemented.

Google provides just two last digits:

enter image description here

Yahoo shows two last digits, and the first one:

enter image description here

It is notable that Yahoo page itself named

"Phone obfuscation challenge"

that clearly reflects its purpose to hide a phone number from an unwanted use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.