The verification process at checkout can be a pain for consumers and merchants alike.
As a merchant, you don’t want to lose revenue and merchandise to fraudsters, but you also want to avoid rejecting legitimate buyers due to false positives. At the same time, consumers want a fast, simple checkout process that introduces as little friction as possible. Not to worry, though: SMS verification may offer a solution.
While imperfect as a standalone security service, SMS verification does provide its share of benefits for both parties. So, let’s take a moment to examine SMS verification codes as tools to reduce fraud risk and identify genuine customers.
[noun]/əs • əm • əs • vər • əf • ə • kā • SHən/
SMS Verification is a fraud prevention practice that allows merchants to send SMS (short message service) messages to a buyer’s device during the checkout process. The buyer will typically be asked to enter a 4- to 8-digit code sent via text as a way to verify the purchase.
As the name implies, SMS verification involves sending a text message to the buyer as part of the customer verification process. You’ve probably encountered this before; maybe you tried to submit an online form or log in to an account, only to be prompted to type a code into your browser that was sent to you via text message. This is basically how SMS verification works.
The tool isn’t something you’d necessarily use to verify every purchase. However, it can be implemented as part of a first-line verification process for new buyers. Sending an SMS code may also eliminate the need to perform a manual review when buyers can’t be verified immediately.
SMS verification is pretty simple, actually. You start by using conventional fraud detection tools, as well as fraud scoring, to gauge each transaction’s relative risk.
If the transaction has certain fraud indicators that pose a heightened risk level, you could then trigger an SMS verification code to send. This would be a one-time-use numeric code confirming the phone number connected to the user’s account.
A well-rounded fraud detection strategy is the key to prevent losses.
Once a user signs in, they will receive a text message with an SMS authorization code. The user will then be prompted to enter that code directly into the app or website. The act of verifying the SMS code lets you authenticate the user. So, you may now process transactions from that user as normal.
This fraud prevention method is considered an “ownership-based” authentication factor because the user would need physical possession of the device in question to make purchases. Ownership-based authentication is generally the easiest to defeat. However, SMS verification is predicated on their being a second layer of authentication, in that the user also had to unlock the device in question. This is usually done by passcode or biometric scan, which are much stronger verification methods.
Using SMS verification, lets you authenticate many orders that would otherwise require human oversight to verify. It can even let you recover orders which might otherwise be rejected by fraud scoring technology.
SMS verification can deter some common fraud tactics like account takeover and basic bot attacks. In theory, if the fraudster doesn’t have access to the device connected to a buyer’s account, they have no way to enter the authentication code and complete a fraudulent purchase.
Initially, merchants were concerned that requiring SMS verification for some purchases would introduce unnecessary friction and lead customers to abandon orders. However, contemporary customers are very familiar with SMS verification codes at this point. Many will see them in a positive light and appreciate that you’re taking extra steps to keep their accounts safe.
SMS verification codes work on all mobile devices. Plus, they’re relatively easy to incorporate into an existing checkout process. For consumers, the use of SMS as an authentication method only requires a few taps and is already well-recognized by the general public at large.
Well… yes and no.
It’s true that SMS verification provides a good layer of security for transactions. However, SMS codes may not stop attacks in all circumstances. Plus, as an authentication method, it has more than its share of vulnerabilities and weak points.
To prevent tactics like account takeover, for example, the valid user must have connected their phone number to their account before making a purchase. Otherwise, asking the buyer to verify a code during checkout wouldn’t prevent fraud; a fraudster could simply substitute their own phone number for that of the user.
That’s just one potential issue. In truth, there are several problems with SMS authentication. In fact, the National Institute of Standards and Technology (NIST) issued a statement back in 2016 discouraging merchants from using SMS authentication.
The NIST later softened their stance on the practice, suggesting it can be useful if combined with other verification factors. Still, it should be clearly stated that SMS authentication presents significant vulnerabilities as a standalone mechanism against fraud.
Now that we understand that SMS isn’t really as secure as it’s cracked up to be, let’s discuss a few notable drawbacks to reliance on the system as an authentication method.
SMS verification can be hampered by:
The buyer must also have their phone handy to receive the SMS code. Buyers who may not have a phone on-hand would be prevented from completing their purchases. You’ll need to develop a secondary method for buyers to authenticate purchases without their mobile devices. Otherwise, you end up rejecting some legitimate buyers.
There’s also the risk of overreliance on SMS authentication. While users don’t mind entering codes occasionally, merchants will start to run the risk of deterring buyers if it’s used too frequently. Plus, merchants must pay for each individual message: overusing SMS codes can cause costs to spike.
While SMS remains one of the most inexpensive customer validation services, prices vary across service providers. Fees could apply in some scenarios. Aside from this, if a merchant uses SMS 2FA services as their only anti-fraud method, they are not fully insulated against more sophisticated schemes like bust-out fraud. Therefore, if an attack does occur, merchants will assume liability for all of the associated damages.
SMS verification becomes useless if the device used to initiate the purchase was lost or stolen, and that device was not secured by a second security factor. A fraudster with an unsecured device may have access to a user’s banking app or social media accounts. If a fraudster is in possession of this treasure trove of information, they have access to anything that is synced to that device. They can easily receive and defeat SMS verification messages.
To carry out a social engineering attack, a fraudster merely needs to convince a victim to click a fraudulent link that will record a login or password. Or, they can pretend to be a legitimate organization by spoofing a trusted website or portal and requesting login. Regardless of the tactic used, once the fraudster has this information, they can use it to take control of that individual’s accounts. This includes assuming control over SMS messages.
New technologies present new opportunities... as well as new threats. Make sure you're prepared.
SMS text messaging interception attacks are also a serious concern. SMS verification is powerless to prevent fraudulent transactions resulting from these attacks.
SIM hacking can be either a high- or low-tech venture. It may involve the spoofing of cell phone tower signals and SS7 systems that enable data roaming and other features found in private messages. Or, it could be as simple as stealing a device and swapping out a compromised SIM card.
Some common tactics include:
This happens when a fraudster sends a malicious code disguised as something relevant to the phone carrier (usually in a URL or attachment). When clicked on, the code allows a fraudster to hack the carrier’s SIM card.
A fraudster poses as a legitimate mobile phone customer and requests a replacement SIM card; typically for a device upgrade or replacement. If the phone network buys the story, the fraudster could change the legitimate user’s account address and other details then have the new SIM sent directly to the fraudster. All of this, and they didn’t even need to steal the phone.
SIM cloning requires a hacker to gain physical access to a person’s phone and SIM card. The criminal creates a copy of the original, and then uses that information to spy on the person’s calls, text messages, and applications. Using information acquired through spying, they can take over their victim’s accounts and rob them blind.
Although it is true that SMS verification can help protect individuals and merchants from fraud, it can’t do it solo… not effectively. Merchants who rely on SMS 2FA verification as their only method of customer authentication are leaving themselves wide open for several forms of attack.
As we’re pointing out, the security risks associated with SMS 2FA technology are now widely known. Yet, many merchants and consumers continue to see the practice as a safe and relatively low-friction method for validating customers.
Why is this the case?
Well, one of the most common reasons is that SMS is a familiar, widespread technology. Consumers are so used to the little code seeker popping up on their phones that the practice is readily recognizable and nearly ubiquitous. Merchants are well-aware that they can annoy fewer customers — and lose fewer sales — if they stick to methods which customers know and understand.
Additionally, SMS authentication is extremely simple to deploy and use. It requires very little human oversight or interaction to function as it should. For instance, everyone from managers and employees to consumers and merchants has become accustomed to 2FA sign-ins.
Users want a quick, seamless authentication experience across all platforms. Many see SMS verification as a perfect solution without necessarily considering the security risks.
So, SMS verification may still have some utility, but it’s not a reliable, long-term solution. So then, what else can you deploy to verify buyers?
Non-SMS 2FA
Of these non-SMS verification factors, apps like Google Authenticator, Lastpass, and Authyand are among the most recognizable and popular. These apps generate randomized, encrypted codes directly on a user’s device, or generate a code on the device that must be further verified by the user’s cellphone or another device. In this way, the user’s information must pass through two failsafes to gain access to any one account.
U2F Hardware
U2F token hardware is also a big step up from SMS verification, which could come in handy for in-store merchants. These are relatively more secure than smartphones alone, and work by inserting the physical tokenization hardware (like a flash drive) into the user’s device. While it is still possible to hack a U2F token, it is considerably harder to do so than an SMS system. Two U2F token products of note are FIDO and YubiKeys.
SMS verification is not strong enough to be considered a valid fraud prevention method on its own. It certainly shouldn’t be your “go-to” authentication solution. That said, if used in combination with other fraud tools and buyer validation methods, SMS verification can add an extra layer of security to everyday transactions.
You simply have to understand the shortcomings and find the best way to incorporate this technology.
One option some merchants have already embraced involves using in-app push authentications through the merchant’s branded app, rather than SMS messages. These can be more secure and more cost-effective, as you don’t have to pay for each SMS message. Even if you don’t have your own app, though, SMS can still be a useful method of blocking fraud and validating buyers if used effectively.
Conventional SMS messages must be part of a layered approach alongside other methods of identifying fraudsters and genuine customers. Validation codes can then be deployed dynamically based on risk, as determined by these other fraud tools.
You should also order the verification flow to optimize conversions and keep costs manageable. For instance, identifying SMS providers that have better per-message rates is one option. You must also be aware of message limitations to avoid unanticipated costs. And again, you can also keep costs low by minimizing the number of customers you message, which you can accomplish by simply deploying a multilayer fraud detection strategy.
A good, well-rounded fraud management strategy should incorporate numerous tools to provide a detailed impression of each transaction. Deploying tools that work together and complement each other makes it easier to spot common fraud red flags without generating false positives. This should include (but is not limited to):
You should aim to verify fewer than 1% of total transactions through SMS verification. This is very achievable with a well-rounded arsenal of fraud detection tools in your corner.Have more questions about SMS verification or other fraud detection mechanisms? What about fraud that occurs after a transaction is complete? Get in touch with one of our industry experts and learn how you can put a stop to eCommerce fraud today.
SMS verification is a fraud prevention practice that allows merchants to send SMS (short message service) messages to a buyer’s device during the checkout process. The buyer will typically be asked to enter a 4- to 8-digit code sent via text as a way to verify the purchase.
Partially. However, there are several security concerns that could undermine SMS verification. It’s possible for fraudsters to use malware to intercept SMS messages and then spoof the consumer’s identity with a different SIM card.
Yes! Although any SMS messages or authentication prompts should be viewed only in-app, and never be forwarded to your phone or personal device.
Unfortunately, yes. SMS verification codes can be hacked or spoofed through social engineering attacks, and various forms of SIM hacking (jacking, cloning, or swapping SIM cards).
Yes. Merchants and consumers have access to several more contemporary authentication and password entry solutions. Examples include non-SMS 2FA apps, as well as U2F tokenization hardware.
SIM swapping happens when a fraudster poses as a legitimate mobile phone customer and requests a replacement SIM card; typically for a device upgrade or replacement. If the phone network buys the story, the fraudster could change the legitimate user’s account address and other details then have the new SIM sent directly to the fraudster. All of this, and they didn’t even need to steal the phone.
Want more information on SIP Trunking, Voice Verification Code? Click the link below to contact us.