Two-Factor Authentication via SMS

Two-factor authentication via SMS, also known as 2FA, is a cloud messaging security solution that confirms a user's identity and protects the system from phishing or hacker attacks.

How two-factor authentication via SMS works

A unique PIN (or PIN code) is generated and sent to the user's mobile phone. The user receives the PIN code and enters it in the application to confirm their identity. If the PIN sent to the user matches the one they enter, they are allowed to continue the process.

Steps in the two-factor authentication process via SMS

1. The user enters their phone number in the client's application (mobile or web).
2. The application sends a request for a PIN code, along with the user's phone number, to the SMS integration API;
3. The SMS integration API sends a number lookup request to the MNO (Mobile Network Operator);
4. The SMS integration API receives a "Number Lookup" response from the MNO;
5. The SMS integration API sends the number lookup response to the application;
6. If the number lookup result is valid, the SMS integration API generates the PIN code and sends the SMS;
7. The MNO delivers the SMS containing the PIN code;
8. The SMS integration API receives the delivery report for the message sent;
9. The user enters the PIN code they received in the application;
10. The application requests verification of the PIN code;
11. The SMS integration API verifies the PIN received and sends the response to the application;

Why is the MNO involved in the process?

Steps 3 and 4 are important for clients who want to check whether the user entered a valid phone number before sending the confirmation SMS. "Number Lookup" is used to check whether the phone number is valid. If the phone number is invalid (that is, it does not exist), no PIN code is generated and no SMS is sent. This helps avoid unnecessary costs. These steps are usually optional, depending on each project's needs.