SMS is one of the supported delivery channels for two-factor authentication codes and password reset verification. When enabled, users receive a short numeric code by text rather than (or alongside) email, which is generally faster and harder to phish.
Turning SMS 2FA On
SMS 2FA is configured at three levels:
- Globally in Site Settings → Security → Two-Factor Authentication — set “SMS” as an allowed second-factor method.
- Per security group — tick “Require 2FA” on the group to force every member to enrol.
- Per user — each user enrols by entering their mobile number and confirming the test code sent to it.
Tip: If users have multiple devices, prefer authenticator apps over SMS for highest-security roles. SMS is great for the long tail of users who do not want to install a separate app.
Password Reset by SMS
When SMS reset is enabled, the forgotten-password page asks for the user's email or username and then offers “Text me a reset code”. The flow is:
- The platform looks up the user's stored mobile number.
- It generates a 6-digit code, stores its hash with a 10-minute expiry, and texts the plaintext code to the user.
- The user enters the code on the reset page and is prompted for a new password.
Example Workflows
- Healthcare portal: Patient signs in to view test results. The system requires SMS 2FA because the data is sensitive.
- Field operations app: Engineers signing in on shared tablets must complete an SMS challenge so a borrowed device cannot stay signed in.
- School parent portal: Parents reset forgotten passwords by SMS rather than waiting for an email, useful from a phone with no email client configured.
Failure Handling
If the SMS gateway rejects the number (wrong country prefix, blocked carrier, missing consent) the user sees a clear error and the system falls back to email if email-2FA is also configured for the user. Every failed send is captured in the SMS log for diagnosis.