In our site, we send the password to user's mobile number when he/she sign up. But user tends to ignore the fact that password will be sent to his/her mobile number. For this reason some user intentionally give a wrong mobile number and afterwards failed to login. What would be the best way to warn the user about this in the sign up process?

  • What about users who don't have mobile numbers?
    – jamesqf
    Commented Feb 22, 2015 at 19:26
  • @jamesqf This is solved via email requests but don't you think providing this option clearly in the form will result in more fraudulent case than the original one. Commented Feb 22, 2015 at 19:35
  • Why do you need the mobile number anyway? Commented Feb 22, 2015 at 22:03
  • 2
    @Taufiq Ahmed: No, I don't offhand see how it's less possible to use an untraceable mobile than an untraceable email. But as others have mentioned, it's a lot more costly (both money & aggravation) if you misuse a mobile number (or landline) for spam, than it is for email. So unless your site is important and trustworthy to me (my bank or broker, perhaps), you won't be getting a valid phone number.
    – jamesqf
    Commented Feb 23, 2015 at 0:01
  • Users – from experience with other sites no apps – probably expect that they will choose their password, because they do not want anyone else to know it. If you generate it and send it by SMS (or email or whatnot), you have to know it. Your users would need to trust you a lot. One-time transaction numbers (TAN), however, are frequently send to mobile phones etc.
    – Crissov
    Commented Feb 23, 2015 at 7:58

4 Answers 4


I work with some products that use SMS so I have some experience with this issue.

First, it is considered rude if you don't tell users you are going to SMS their mobile phone number well in advance. In most countries, an SMS may actually cost the user a small amount of money, so not telling the user before she provides her mobile number is a breach of trust.

Now, rather than asking the user to enter a valid number, I would suggest being very clear to the user around what the number will be used for instead. That is better UX principle, and also better moral principle since mobile phones are nowadays used in a lot of secure- and trust- based transactions.

So I would instead suggest:


  • Yes I did exactly as you suggested in my site. The problem is they give fake number not realizing that it would be used to have his password. Check my page devskill.com/registration Commented Feb 22, 2015 at 19:08
  • @TaufiqAhmed Your site says "your password will be sent to this number". Although that is clear to you, it is not very clear to users because there is no field for "password" and it isn't clear what the password will be used for. The user is trying to create an account, so make it clearer that the text message must be received before the account is created....see the wording above in the answer.
    – tohster
    Commented Feb 22, 2015 at 19:12
  • Your wording is very clear. I will definitely use it instead of the current one. Commented Feb 22, 2015 at 19:15
  • 1
    Try it and measure the results. If you have made the requirement clear and are still getting too much abandonment, you may want to revisit the requirement to have a mobile phone number. Users don't like giving out mobile phone numbers because spam controls for text messaging are very poor.
    – tohster
    Commented Feb 22, 2015 at 19:19

I don't think clarity is the issue here. People simply don't want to give you their mobile phone number.

I'd be very reluctant to share such private information too especially because you don't seem to explain anywhere why this information is needed.

If you actually need the phone number explain why. If you don't need it don't ask.

  • Previously I had a button like 'why we need mobile number' linked to an modal explaining the reason. But most user doesn't click that button. You are right that default tendency is to not sharing the phone number. I will implement the fix I found here and see if that's improve the result. I think brand's trustability might play a role here. Commented Feb 23, 2015 at 1:40

Instead of trusting the user, do some verification on the backend. As your website seems to be catered to software developers in Bangladesh, there's probably a pattern that phone numbers follow in Bangladesh. You can use that to do some simple pattern matching and return an error to the user if phone numbers don't match.

That way the user will know that a valid phone number is indeed required. Of course there is nothing you can do if they choose to enter in a fake number that passes your validation.


Why are you even sending passwords in SMS?

From a security perspective,this can prove costly because whomever has access to the phone for whatever reason can ultimately get your user's username & password combination as though it was written on a napkin.

From a UX perspective, if you are sending me a password that is system generated; chances are that I will not remember it. It is hard enough trying to remember passwords that I create, so the less cognitive load on me the better. (Could be one of the reasons OAuth-Social login has taken off)

Have you considered sending One Time Passwords instead, that are tied to a session?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.