0

For our 2FA (2nd Factor Authentication) process, we default to having an SMS sent to the user's phone. This is causing issues for users who can't receive SMS messages; eg, they're overseas. The safety-net we have to allow an alternate method of verification is a 'verify another way' button on the SMS code entry screen, where the user will be directed to answer security questions they have set up. However, we are receiving feedback from users, and the business, that there are problems actioning the alternate method, with suggestions being everything from 'make the button bigger' to an interstitial screen to select between SMS or Security Questions. Any thoughts? I was hoping a technical solution could change the default, from SMS to security questions, if we could find out the user's phone was not able to receive SMS messages - but that's not possible atm.

Improve this question
1
  • 1
    security wise: Security questions suck! you can make users set a 2FA app like Google auth, even better than SMS.
    – Spoody
    May 24, 2018 at 11:06

1 Answer 1

Reset to default
1

Slight rant here, skip to Adjust your call to action for the actual answer.

IMHO, security questions are super gross in terms of UX. It causes a harsh break in the normal flow of authentication and not many designers use them anymore because of the aforementioned UX problems and the user stigma that has built up around them. Security questions make people want to use a different app.

Use Email instead of security questions

You mentioned that your users are interacting with a mobile app, which means email could be an alternate option over the internet connection you're already using to verify the user's answers. This is mostly a preference tidbit, and you should still consider the section below if you go this route.

Adjust your call to action

Without seeing the UI, it's hard to gauge whether that's part of the issue (as mentioned with the button size suggestion). I would imagine that making the SMS vs. Security Questions an explicit step would be better than your authentication just not working, but that would really suck if the secondary method is used for every authentication.

A potential way to make this more manageable while being more clear is to instead present two buttons, one for entering an SMS code, and one for using "verify another way".

I get the impression that the actual user experience is something like this:

  1. As a user, when I'm presented with an input field, I start looking for the SMS message because that's what I'm used to.
  2. When I don't find it, I then see the button for "verify another way" (which is probably below the input field without enough contrast), which is undesirable.
  3. If I don't see the "verify another way" button, I circle back and try to figure out how I messed up, or retry the operation.

Having two buttons and presenting the user with a speed bump could make them think about whether or not they can even receive SMS before switching over to their messenger app of choice. I would still put the "Additional method" button on the SMS entry screen as a way to bridge over in case of a different problem preventing SMS, but I think this will help your users more.

Edit: There's a demonstration of the idea here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.