registering to an account by an sms link in a mobile

Question

It is well known that when using email for registration, one puts a registration link inside the email. It is also known, that when using a phone number (SMS) for registration, one uses a registration code (e.g. 4 digits) and needs to enter it into the screen of the mobile.

We would like to use a confirmation link in the SMS, in the same manner, it is done by email but for some reason its less of a standard. Am I missing something here? is it bad practice to put a confirmation link inside an SMS. Assume the link will be short (so it can fit the 140 characters limit)

Answer 1

I don't think it's a bad pattern to use in particular. It's probably just developed historically to be seen problematic in overall implementation and usability because of rules and restrictions. I think there are a number of factors in play here which add to the reason this has not become a popular pattern.

1) Operators may auto-block SMS containing hyperlinks. It all depends what rules operator has sets for this. so it may have caused people problems in the past which made the development community to stay away from this pattern. See thread here

2) You mentioned you will use link shortener, but again maybe it seems easier for people to create activation code workflow then have a link shortener.

3) Believe it or not there are still quite a few phones without a browser in circulation a few years ago and it is only in recent years this number started to dramatically to drop.

When it comes to international communications and sending SMS over different carriers etc i can say from personal experience that email is far more reliable.

Hope this helps, good luck!

Answer 2

It's not that it would be a bad practice. It's potentially a security issue here: a link could be phishing. Especially with something private like a phone number.

I would stick with emails or generated code. It creates a lot more user confidence that their credentials and personal data (such as phone number) would not be mishandled.

Hope this helps.

Answer 3

I agree, with data sensitivity these days I would be apprehensive tapping on a link via my phone. it would raise phishing scam concerns for a user. Giving them a sense of control is better by allowing them to input a 4 digit code on a page they access by themselves.