We are working on a financial related desktop app. The user can commit their money in an escrow for a period of time, and the user must be online about/within 24hrs before the expiration of the escrow or their money could be at risk.
We need a way to alert users that it is about to expire and they need to come online. The only problem is that we must do this in a way where the alerts don’t depend on our software being benevolent. The user must get alerted even if we have been hacked/malicious.
We wanted to link a user’s phone number and send an SMS to tell them to come online, but if we were hacked we wouldn’t send that SMS. And an SMS messaging service like Twilio isn’t appropriate because the hacker would just disable or cancel that service.
An email is okay but I don’t think it is urgent/visible enough. Some people don’t have emails set to notify them on their phone or desktop, or don’t even have emails set up on their phone at all. And same problem as SMS, if we were hacked we would not send the email.
One possible route is through calendars. If the user linked their mobile phone calendar in some way such that upon creation of the escrow it creates an event in their calendar (like creates an .ics file for them to download), they would be notified to come back to the app regardless of if we have been hacked or not. The notification would come from the user, not from us.
Is this a good practice? I think it has similar problems to emails - some users won’t have calendars set up or linked between devices, or won’t want to give us access to it.
Is there some other way that would be better that I have not thought of?