Launching multi-factor authentication

captainben

Hello everyone,

Today I come bearing some big news. Something which has been requested by you guys and our product teams have worked very hard on to deliver.

As you know, our members safety is extremely important to us and we try our very best day in day out to ensure our members are safe.

As part of that, we are now launching multi-factor authentication for members requesting a SIM swap or wanting to change the email address linked to their accounts.

This means that when a member wants to do a SIM swap or change their email address, they will receive a text message and an email with a verification code to their mobile number or registered email address. They will then have to pop the code in right before the process is completed.

SIM swap journey:

Changing an email address:

Because this is new to us and we want to make sure it is working as it should, we will be rolling it out gradually over the next few days starting with a small number of members and eventually reaching everyone. We will be closely monitoring its performance and the feedback we get from our members to ensure that everything is working smoothly. This is just the first step in us releasing multi-factor authentication and we plan to expand that to more journeys in the future.

To make sure everyone knows this is happening, we will be reaching out to all of our members via email and let them know. We will also use this opportunity to share more general advice with our members on how to keep their account and personal details secure and point them to this thread if they want to read more.

Many thanks to @magnushirst, @nimistry001 and the rest of the team that worked really hard to bring this to life for our members.

Thanks folks,

Ben

richybhoy36

captainben Hi that's brilliant news another step to protect our members from these scammers :-)

endorphin

@captainben hopefully this will prove effective. Can you confirm that the verification code will be sent by text and email in all cases - someone requesting a SIM swap because they have lost their SIM won't be able to receive a text!

roxy_r

Hi @endorphin , yes, the system is designed to send an SMS as well as an email for that specific reason. Because this is the first iteration of our implementation of multi-factor authentication, we would very much need your help in keeping an eye on it and making sure it behaves as it should.

If you spot that an email has not been sent, could you please let one of the Educators know? Just please make sure they are checking the email they registered with their account. 🙂

andy69

At last giffgaff are starting to take security seriously. I hope it won't be long before giffgaff customers are protected from payforit scams by implementing 2fa authentication for such charges: see https://labs.giffgaff.com/idea/16712363/require-2-factor-authentication-to-sign-up-for-payforit-texts?sort=new&filter=all

giffgaff20147

@captainben

Hello what a good idea hopefully it should stop some of the scams

well done

Mary

ma2013

This is great news for security, all the best sites have this 2-factor verification code system now. Nice one giffgaff! 🙂

endorphin

@roxy_r wrote:

If you spot that an email has not been sent, could you please let one of the Educators know? Just please make sure they are checking the email they registered with their account. 🙂

Will do!

bobrobinson

Great work @roxy_r Its nice to see giffgaff are working hard to keep these nasty little buggers

from scamming us.

So well done to all involved in putting this all together

All the best Bob. 🙂

alexmgg2

In the case of changing an email address, will the verification code be sent to the old address, the new address, or both? I can think of good reasons for each way of doing things.

harrrrrry

@captainben

I'm wondering how this will work in the fairly frequent case that a member needs a sim swap, but uses their phone as their email device and has not set up independent access to another device.

So:

the member cannot receive the code via text (because the phone is not working)

the member cannot receive the code via email (because their email can only be collected on the phone that is not working)

in some cases, the member cannot set up a new device to receive emails, because their email host has set up 2FA which requires receipt of a text that they cannot receive

What advice do we give in that case? "You should have thought of that before putting all your eggs in one basket" may be the correct answer, but isn't very helpful when given retrospectively (hence https://community.giffgaff.com/t5/tips-guides/make-sure-you-have-independent-access-to-your-email/m-p/23127402#m165166 but it needs to be done in advance).

Best I can think of is to report the sim as "lost or stolen" and get a special replacement by post, assuming that giffgaff has the correct address on record. But that's 3-5 working days which is rather a long time to be without emails, calls, texts, internet access (other than via wifi) and 2FA for the bank.

z201205

@harrrrrry

A second internet connection is also required: if there is a problem, then it needs reporting via the internet. If you are having issues with mobile internet with giffgaff, then you cannot report it without a second internet connection as giffgaff don't have a call centre.

lgl20

This is a good solution to put in place - anything that makes it more difficult for scammers

roxy_r

@alexmgg2 the code is sent to the curent(old) email address. Sending it to the new one or both would potentialy put it in the hands of the fraudster which is what we are trying to avoid.

@harrrrrry if the phone is not working, what would they use to request the swap?

As a general next step they can reach out to the agents, preform some security checks and explain the situation. The agents can then help further.

finlayj28

Very good news, this should reduce the fraudulent sim swaps and hijacking of accounts

alexmgg2

@roxy_r

Thanks for the clarification. This will be more awkward for the people who forget to keep their email addresses up to date, but there's always been a trade off between convenience and security.

I think that giffgaff has made a good move here.

roxy_r

Indeed @alexmgg2 . We want to make sure we keep our members as secure as possible but that means we will need a bit of help specifically when it comes to making sure your email address is the correct one.

This is the first step of implementing multi-factor authentication and we will learn and evolve based on the feedback we get from you which is why we would really appreciate you sharing your thoughts as well as situations you come across on the forum that you believe could be better.

bluemoonbaz

@roxy_r

This looks like a positive step forward to combat fraudsters and scammers.

claire1uk

This has been a long time coming and is great to see giffgaff implementing such an important security feature.

django21

This is a good thing thumbs up

traelkom

It was about time.

I did suggest this in the past.

🙂