Security notice SMS: new sign-ins, password changes and other sensitive account actions

The short answer: when something sensitive happens in one of your customers' accounts (a sign-in from a new device, a changed password, a new e-mail address or phone number, an unusual payment), an SMS straight afterwards lets them confirm it was them. Your system sends it through our API at that very moment, with no scheduling.

When to send one

What happened	Example SMS
New sign-in	Your account was signed in from a new device. Not you? Contact us: [PHONE].
Password changed	Your account password was changed today at [TIME]. If this was not you, call [PHONE] now.
Contact details changed	The e-mail address on your account was changed. If you did not do this, contact us: [PHONE].
Sensitive action	A withdrawal of [AMOUNT] was requested on your account. Not you? Call [PHONE].

What a security notice never contains

1	It never asks for passwords, PINs or codes. That is what fraudsters do, and customers need to know your company never does.

2	No links to "confirm your account". A link in a security SMS is exactly what scam messages copy. Give a phone number they already know.

3	No full details, such as a whole card or account number. Say what happened and when; that is enough.

Do not mix this up with verification codes. A one-time code confirms an action before it happens; a security notice reports it afterwards. For codes, see verification codes through our API.

Hooking it into your system

At the point in your code where the password changes or the sign-in is recorded, add a request to POST /v1/sms/messages with the customer's number and the text. Send the Idempotency-Key header with a value tied to the event (the sign-in id, for example): if the connection drops and the request is repeated, the customer does not get the notice twice. The first request, step by step, is in sending SMS through the API.

Use a Sender ID with your company name. Customers recognise the sender, and a genuine notice stands apart from an imitation. Say on your website which notices you send, and that you never ask for codes by SMS.

Want to alert customers the moment something changes in their account? See the API page.

See the API page

Categories

Categories