Rethinking MFA: What Happens When the User Sends the Code

Traditional Multi-Factor Authentication (MFA) methods, such as SMS-based One-Time Passwords (OTPs), incur significant costs and may present deliverability challenges, especially in regions with unreliable SMS infrastructure. This proposal introduces the concept of Reverse MFA via WhatsApp. This method leverages the use of WhatsApp to enhance security, reduce costs, and improve user experience.

While this approach technically qualifies as Two-Factor Authentication (2FA), as it combines something the user has (their WhatsApp account) with something they know (a keyword), we refer to it as MFA for clarity and consistency.

The term “Reverse MFA” often appears online in the context of hacking techniques that bypass authentication, this approach reclaims the term for a legitimate use case: reversing the flow of MFA for better efficiency. Some low-cost airlines have reportedly tested this method to verify identity during mobile check-in, offering a frictionless and scalable experience.

Understanding Reverse MFA

Traditional MFA Flow:

1. User initiates authentication by providing their email or phone number
2. Server sends an OTP (One-Time Password) via email or SMS.
3. User enters the received OTP to complete authentication.

Reverse MFA Flow:

1. User initiates authentication.
2. System prompts the user to send a specific code or keyword to a verified WhatsApp Business number.
3. Server verifies the incoming message to authenticate the user.

The key distinction of Reverse MFA is that the authentication process is initiated by the user, shifting the communication from a server-to-user model to a user-to-server model.

Advantages of Reverse MFA via WhatsApp

• Cost Efficiency
  WhatsApp messages typically incur on minimal or no fees. Additionally, this approach facilitates scalability: the cost structure remains stable as user volume increases.

• Enhanced Deliverability and Reliability
  Especially valuable in regions where SMS infrastructure can be unreliable or inconsistent. Moreover, WhatsApp help reduce delays, providing prompt and reliable authentication experiences, thus improving overall user satisfaction.

• Improved Security
  Avoiding SMS reduces vulnerabilities associated with SIM swapping and SMS interception. Moreover, WhatsApp Business accounts with verified badges enhances trust and authenticity.

• User Experience and Engagement
  WhatsApp provide a familiar user interface that can facilitate the process. Engaging users in the authentication process can enhance their sense of security and control.

Challenges and Mitigation Strategies

Wide adoption always comes at the expense of more risks. In recent times, WhatsApp has become a place where many scams take place. For example, users have been targeted by phishing messages pretending to be from banks, fake job offers asking for personal data, or even scammers impersonating family members asking for urgent money transfers.

When implementing Reverse MFA through WhatsApp, the main challenge is building enough trust for the user to feel safe completing the authentication step. These are some things worth considering on an implementation of this authentication method.

2. User Compliance and Errors

• Challenge: Users may forget to send the required message or send incorrect codes.
• Mitigation:
  • Simplified Codes: Use easy-to-remember keywords or phrases instead of complex codes.
  • Automated Reminders: Implement in-app reminders prompting users to complete the authentication step.

3. Technical Integration

• Challenge: Integrating WhatsApp Business API with existing authentication systems may require development resources.
• Mitigation:
  • Phased Implementation: Start with a pilot program to assess feasibility and address technical challenges incrementally.
  • Third-Party Solutions: Leverage existing platforms that offer WhatsApp Business API integration to expedite development, such as such as Twilio, 360dialog, MessageBird, Vonage, and Gupshup.

Reverse MFA in action

1. User Prompt Interface:

Description: The app prompts the user to send a specific keyword to the verified Ipsos iSay WhatsApp Business account as part of the authentication flow. The backend starts checking in the background whether the keyword has been received.

2. WhatsApp Business Account Verification:

Description: Upon tapping the “Send message” button, WhatsApp opens with the keyword pre-filled. The user simply presses send to complete the action. The WhatsApp Business account is clearly marked as verified, providing visual reassurance to the user.

3. Confirmation Screen:

Description: Once the backend detects the expected keyword from the user, the confirmation screen is shown. It reassures the user that their identity was verified successfully and prompts them to continue with the next step in the sign-up flow.

Conclusion

Implementing Reverse MFA via WhatsApp presents a strategic opportunity to enhance security, reduce operational costs, and improve user experience. By leveraging a platform familiar to users and addressing potential challenges through thoughtful design and communication, organizations can modernize their authentication processes effectively.

Further reading

• Auth0 Docs, “Multi-Factor Authentication (MFA)”
• OWASP Foundation, “Multi-Factor Authentication Cheat Sheet”