Prove who they are with a text message

[CharlotteDowns]

What

This is one way to identify users. User research can help you understand what other methods you may wish to use to help your users access your service.

This pattern asks users to enter a code sent to them via text message (SMS) for authentication purposes.

Why

Government services are increasingly using a second form of authentication (2FA), in order to improve security. This often takes the form of asking for a code sent via text message, in order to demonstrate the user has something (their phone) as well as knows something (their password).

This has been adopted in slightly different forms by: HMRC, Home Office, DWP, GDS, and the Office for Product Safety and Standards (OPSS) in production services, and has been user tested to varying degrees.

Adopting this as a pattern within the GOV.UK Design System will help to improve cross-government consistency and make it faster for teams to add this feature to services.

The Design System has an existing pattern for #56 but not for text message security codes.

Related patterns:

• Delegate authority #18
• Identifying users (Confirm a phone number) #25
• Recover an account #84
• Save their progress #87
• Wrong type of Government Gateway account #165
• Passwordless login #181
• Signatures  #235

Anything else

The current proposal and prototype