In our site, we send the password to user's mobile number when he/she sign up. But user tends to ignore the fact that password will be sent to his/her mobile number. For this reason some user intentionally give a wrong mobile number and afterwards failed to login. What would be the best way to warn the user about this in the sign up process?
I work with some products that use SMS so I have some experience with this issue.
First, it is considered rude if you don't tell users you are going to SMS their mobile phone number well in advance. In most countries, an SMS may actually cost the user a small amount of money, so not telling the user before she provides her mobile number is a breach of trust.
Now, rather than asking the user to enter a valid number, I would suggest being very clear to the user around what the number will be used for instead. That is better UX principle, and also better moral principle since mobile phones are nowadays used in a lot of secure- and trust- based transactions.
So I would instead suggest:
I don't think clarity is the issue here. People simply don't want to give you their mobile phone number.
I'd be very reluctant to share such private information too especially because you don't seem to explain anywhere why this information is needed.
If you actually need the phone number explain why. If you don't need it don't ask.
Instead of trusting the user, do some verification on the backend. As your website seems to be catered to software developers in Bangladesh, there's probably a pattern that phone numbers follow in Bangladesh. You can use that to do some simple pattern matching and return an error to the user if phone numbers don't match.
That way the user will know that a valid phone number is indeed required. Of course there is nothing you can do if they choose to enter in a fake number that passes your validation.
Why are you even sending passwords in SMS?
From a security perspective,this can prove costly because whomever has access to the phone for whatever reason can ultimately get your user's username & password combination as though it was written on a napkin.
From a UX perspective, if you are sending me a password that is system generated; chances are that I will not remember it. It is hard enough trying to remember passwords that I create, so the less cognitive load on me the better. (Could be one of the reasons OAuth-Social login has taken off)
Have you considered sending One Time Passwords instead, that are tied to a session?