Text message (SMS) verification for signups

Question

I have seen a disturbing trend where websites are starting to require verification sent to cellphones by text message (SMS). Gmail and Facebook are two of them. What I want to know are the following:

1. Is it a good idea to start requiring cellphones instead of emails now?
2. How do I do it on my own website?

Edit

Here are some of my new questions on the topic in response to the answers:

1. I see that most of you are saying that SMS registrations is ok. But what about the people who don't have cell phones? And why is it accepted to give out your cell phone information freely?
2. Do those big providers really pay per message to a gateway service? Is it not possible to set up a server with the correct SMS software, or at least buy a subscription directly instead of having a middleman?

Answer 1

It is a good idea if you want to limit the number of fake accounts. I see it used lots in local newspapers here in Norway. I guess it makes people think twice before posting useless crap on their discussion forums.

But do you really hate your users that much? Gmail and Facebook are big enough now that people will accept jumping a few hurdles to use the service, but you need something really interesting to make the user accept this inconvenience.

Answer 2

Answer to 1st question: One reason which I can think of that led Gmail and Facebook to follow this trend is the emergence of bogus accounts. Now-a-days, there are use-n-throw email availabe for free like www.10minutemail.com which gives u an email address for 10 minutes. So the use can take such an email address and start a new account in the site.

But in the case of 'sms'-registration, I dont know of any such use-n-throw service provider. So everyone needs to give his own number for registration. This leads to registration by legitimate users.

Answer to 2nd question: This depends on which language u are using. Moreover, you may need a SMS gateway to achieve this.

---

Since you dont care about the language, try to look for SMS gateway for sending sms through computer or your web server. Some of the cellphone network providers provide an email service to send sms to a phone. For example, you are sending an sms to +910123456789 of 'xyz' network provider, you just need send the sms in the body of an email with the to-address as [email protected]

'xyzmail' part of the mail address will change according to the network provider. Plus this option is not found to be reliabe.

Answer 3

Most SMS Gateway services have some kind of API. An HTTP interface seems to be the norm.

Just make sure you sign up for a service that allows receiving of messages because not all do. It's more work for them since they have to send some kind of data back to you.

Some services offer send receipts too which lets you see if the receiver got the SMS.

Some examples follows.

• Esendex API docs
• TxtLocal

In regard to question number one, I think Commander Keen's advice is sound.

Answer 4

The one main reason for using SMS as a way of authentication is that you link the account to a mobile phone, which effectively reduces the chance of fake user accounts by a very large margin.

To implement this feature, you will need to sign an agreement with a SMS Gateway that has coverage for the countries (and operators) that your customers are located in..

Most SMS Gateways can easily be integrated in your software, and will most often provide you with access to all the mobile operators that you require.

I would not recommend using an email to sms gateway if you can use an API, as these are most often less responsive than using a proper API to send messages, where you will get a live connection with the SMS gateway itself, not an email server in front of the gateway.

Examples of SMS Gateway providers:

PSWinCom - www.pswin.com (Note: I am employed in this company.)

Clickatell - www.clickatell.com

HSL - http://www.hslsms.com/

Answer 5

check out TeleSign.com

they offer phone verification solutions that you can implement into your website

phone verification is a way to reduce fraud and spam significantly

Answer 6

There's a trust issue here that goes both ways. If you're the provider of a service that can be spammed, you can trust that your users are people and that their email addresses are legitimate. This is probably irrational. Or you can force your users to trust that you'll deal with their cell number information safely. Many users will feel this is irrational.

And then there are people without cell phones (I happen to be one). Most discussions on the web aren't very important, but if you're trying to foster a discussion on anything important, limiting the discussion to people that have cell phones and know how to receive text messages will limit your discussion to the viewpoints of the rich and technologically savvy. If you're providing an important service like email, a texting requirement sets up a barrier to entry and saps the democratizing power of the web. It amounts to shunting the cost of your spam problem onto the disadvantaged. To me, that's unacceptable. Again, though, if your site is just inane pop culture or a marketing exercise, as most are, who cares, go right ahead.

Answer 7

The one main reason for using SMS as a way of authentication is that you link the account to a mobile phone, which effectively reduces the chance of fake user accounts by a very large margin.

To implement this feature, you will need to sign an agreement with a SMS Gateway that has coverage for the countries (and operators) that your customers are located in..

http://www.txtimpact.in (sms gateway and mobile marketing solutions provider)

Answer 8

A warning!! I had to register my Gmail account like this… and now every single email I get generates a SMS message to my phone. Not only is this annoying, SMS’s are NOT free! I don’t have unlimited SMSs, so this is costing me money!

So far, no one has been able to tell me how to stop this.

One page said to reply with STOP to the SMS, but that hasn’t worked.

If you know how to stop this, my email is kwalla25 at the relevant Google email address ending.

Answer 9

I have problem with this.. I made a new google account and it requires a verification code..And now when I activate my account, the google won't stop sending me the verification code on my cellphone..Is there a way to stop this? I need help.. :(

Answer 10

SMS is the reason I can't use App Engine (). My mom (who I hated very much) will not be to buying me a cell phone because I lost my iPod last time. (* I'm 15 years old) Enough about my life, I will get over it myself.

The first problem is that some people do not have cell phone. I can use Facebook almost completely without validating cell, but uses CAPTCHA to get through certain actions. Therefore, CAPTCHA is one of the good alternatives.

I personally think, cell phone stuff belongs to cell phones and should not be in the Web. What if every forum admins and newbie PHP developers in the world used SMS validation and someone hacked (cracked) into their database? Do you trust a small forum? Is anti-fraud measure required so desperately?

If your site is very large and popular, it may be good to get SMS validation.