Easiest "two factor verification" method (sending verification codes to cell phones)

Question

I'm testing out my app with real people. They sign up, including entering a phone number, and it text messages them a code. The person responds to the text with the code and viola, mission accomplished.

So I chose a 4 letter, uppercase code without any letter 'O's (that might be mistaken for zeros). It works pretty well cognitively because research says we can remember 4 to 7 items... 4 being the most comfortable and accommodating number. 25 letters^4 = 370,000 letter combinations. Sweet.

The only problem is people's dang autocorrect on their cell phone. It keeps suggesting new words and before they send it, it replaces the word for them!!! So I'm thinking of adding numbers to the word in addition to letters. But I also remember my mom using her iPad and wondering how to enter in letters. It seems many people don't initially know how to get the secondary number keyboard. So is there any way to effectively send codes to people that won't get autocorrected, or otherwise result in errors? Anyone have test/research experience on this?

Answer 1

You can compose your verification code entirely out of numbers, and define the input field as numerical, so that only the numbers keyboard comes up to begin with.

If you're worried that it reduces the number of possible combinations, you can add a character or two. You can also limit the validity of the issued codes to a day or two, so you can reuse the same codes after they expire. Google makes do with 6-char numbers-only codes, I guess there's no reason it shouldn't work for you.