I'm working on integrating an OTP (one-time password) through SMS before a user is allowed to change their personal details. It's a banking environment, so the verification must be done regardless of circumstance. Users could be leaving their browser open while logged in, and that's not a risk the fraud department is willing to take.

With simple fields like name and address, asking for an OTP wouldn't be an issue. However, we also have to ask a user to do this when they want to change their mobile number or email address. That step contains its own verification aspect. We are essentially stacking verifications; one to prove the person is who he says he is, and one to prove the number is theirs.

Is it possible to verify both the user identity and the mobile number/email without bombarding the user with identification requests for every single change? And if not - how can this be made as painless as possible?

And in a similar note; how to deal with sending an OTP to a number that's no longer in use? Users that want to update their phone number will be sent a code to their listed number first.

  • I don't have a full answer for you, but I did take a look at how Steam achieve this and I think they have the ability to recover by email or phone too. Taking a look there could help your investigations. – Fractional Sep 21 '18 at 14:02
  • Is it even possible ? If you send a verification of identity on mobile A, then the user changes to mobile B, don't you want to verify he owns both mobile A and B ? – Arthur Hv Sep 21 '18 at 14:34
  • @ArthurHavlicek Yes, that is currently the only way to change your mobile number: if you own both. If you lose mobile A then you can't change the number to correspond to mobile B. I'll ask how they deal with that now for log in because the same issue would be encountered there. Though the answer would probably be: they have to call support. – Wendy Wojenka Sep 21 '18 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.