3

We will be asking our users to generate an account verification code that will be texted to them in order for them to sign in (as an alternative to emailing a password reset link). How many digits of the (mainly UK) telephone number can you show (so users can tell it's the right one), without compromising security? I have seen this on other sites:

07*****1234

1
  • 1
    Prefix + 4 last numbers should be enough for anyone to recognize if his phone number is right. Feb 20, 2018 at 10:22

1 Answer 1

3

A general principle to follow is to provide enough information for a user to identify the known phone number, while restrict others from any unintended use of it.

Most commonly, last two digits will be enough to recognize a phone number.

Let's have a look how a verification may be implemented.

Google provides just two last digits:

enter image description here

Yahoo shows two last digits, and the first one:

enter image description here

It is notable that Yahoo page itself named

"Phone obfuscation challenge"

that clearly reflects its purpose of hiding the phone number from an unwanted use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.