Questions for SMS OTP alternative vendors

Checklist items

1. How is your method classified under NIST SP 800-63B-4?
2. Is it phishing-resistant, and what binds the credential to our site or app?
3. How does account recovery work when the customer loses their phone?
4. What does the customer see when the method fails, and what do we fall back to?
5. Which countries, carriers, devices and operating systems are covered today?
6. What customer data leaves our systems, where does it go, and how long is it kept?
7. Which independent assessments or certifications apply?
8. What does it cost, and what drives the price up?

Ticks stay in your browser only and are not saved.

Print this checklist Clear ticks