ClickCease

A More Secure SMS OTP Alternative: Instant Link™

Yuka Yoneda
October 7, 2022

Data breaches. Account takeovers. SIM swap fraud.  With fraudsters growing more sophisticated each day, it’s no secret that two-factor authentication (2FA) or multi-factor authentication (MFA) is now a bare minimum requirement that companies must invest in to secure their customers’ accounts. However, the most common form of MFA/2FA, called SMS OTP (or SMS one-time password), has several known vulnerabilities. If you’re already familiar with SMS OTP and its pitfalls, feel free to skip ahead to the section entitled What is Instant Link™?

What’s Wrong with SMS OTP? 

The challenges associated with SMS OTP are well-documented and basically fall into two buckets:

  1. Fraud: SMS OTPs can be easily intercepted by bad actors and therefore cannot be relied upon for their intended purpose of keeping fraudsters out of online accounts. For example, let’s say a fraudster already has a password to one of your online accounts and is initiating an online transaction on that account that requires an SMS OTP to be sent. By intercepting that SMS OTP, they can easily get the numerical password that was meant to be sent to you, and key it in to gain access to your account. So the SMS OTP that was intended to keep you safe actually went to the fraudster, allowing them to access your account. 
  2. The Customer Experience: SMS OTPs cause friction in the customer experience. If you’ve ever tried to log into an account or reset your password using an SMS OTP, you know that the experience of fumbling between your computer and your phone or multiple apps on your phone and trying to memorize a numerical password so you can type it in is not exactly seamless. SMS OTPs can also be unreliable with many consumers reporting that they initiated an SMS OTP authentication but never actually received an SMS code. 

So it’s clear that there are several reasons why companies are already starting to move away from SMS OTP, but what are the alternatives? While we offer several next-generation SMS OTP alternative solutions at Prove, one of our most popular is Instant Link because it blends some of the familiarity of a possession-based check like SMS OTP with added fortifications against account takeover and a better customer experience.

What is Instant Link?

Instant Link is a second-factor authentication (a.k.a, a “proof of possession check”) service that allows companies to embed a secure clickable link in an SMS text. Essentially, Instant Link looks similar to an SMS OTP at first glance and works in a similar way, but instead of a numerical passcode that can be intercepted, a secure link is sent via SMS that can be clicked by your customer to authenticate them and perform a secure “cryptographic handshake” confirming that it’s really your customer on the other end of a transaction. When a user clicks an Instant Link, the NIST standard of two-factor authentication is met. Optionally, Instant Link can fortify the SMS OTP standard by performing a mobile carrier authentication on top of the clicking of the link. The added mobile carrier authentication, in addition to IP address confirmation, adds a NIST approved multi-factor authentication. 

Some of the main benefits of Instant Link that Prove customers have found valuable for their businesses include:

  • Instant Link is a more fortified form of SMS OTP that mitigates many of the vulnerabilities of SMS OTP interception. While an SMS OTP can be intercepted by fraudsters as described above, with an Instant Link, there is no code to intercept and in most cases, the authentication is only successful when clicked by the intended recipient. 
  • Instant Link is API-based and is easy to implement (for most standard configurations).
  • Instant Link offers a much easier experience for customers. All they need to do is click as opposed to SMS OTP where a passcode must be entered.
  • Many companies also like Instant Link’s ability to include additional context for the customer with a branded webpage that explains the purpose of the link.

Do you have questions about Instant Link and how it can help you meet your fraud prevention and customer experience goals? Get in touch with us to have all of your questions answered .

Keep reading

See all blogs
Prove’s Tim Brown Explains How to Reduce Fraud and Improve Onboarding with Identity Verification

Reporters from GreenSheet, a popular publication that highlights trends in the banking, financial services, and fintech markets, recently met with Prove’s Global Identity Officer, Tim Brown to learn how advanced identity verification solutions are driving faster and better digital customer onboarding.

Kaushal Ls
May 21, 2024
Prove CEO Rodger Desai Featured on Fintech Leaders Podcast

Prove CEO and co-founder Rodger Desai was recently the featured guest on the Fintech Leaders podcast with fintech leader and entrepreneur Miguel Armaza. The two discussed the identity verification market, innovations in onboarding and customer enablement, and explained how smartphone data provides the most effective way to verify customers.

Kelley Vallone
May 16, 2024
Marketplace Risk Proudly Names Prove as the Leader in Identity Authentication

Marketplace Risk, a leading authority in risk management for online platforms, has announced the recipients of its annual Solution Provider Excellence Program. This prestigious initiative spotlights industry leaders in risk, trust, and safety solutions, showcasing their expertise in addressing the challenges encountered by digital marketplaces, gig economy, and digital platforms. Among the winners is Prove.

May 15, 2024