Phone authentication

Overview

Phone authentication is a premium second-factor authentication method that secures a robust verification of identity by having the recipient authenticate with a code delivered to their phone as either a text message or a voice call (upon their request).

Availability:

Phone authentication is available for enterprise license plans only.

Phone authentication is a premium authentication method that has a per-use charge.

• Transactions must be purchased through your Adobe sales representative.
  
• Transactions are an account-level resource. All groups consume from the same global pool.

Configuration scope:

The feature can be enabled at the account and group levels.

How it's used

The authentication process initially presents the recipient with a notification that they must enter a verification code to access the agreement. This notification provides the following:

1. The last four digits of the recipient's phone number (as entered when the agreement was composed) so the recipient knows which device the code will be sent to.
2. The (linked) name of the originator is provided in case the recipient needs to contact them for any reason (e.g., To change the phone number). The link opens an email to the sender of the agreement.
   • This link can be modified to guide the recipient to an explicit address, like your support team.
     
3. An option for the recipient to have the code delivered via voice call or text message.

When the user is ready to receive the verification code, they select the Send Code button:

Once the Send Code button is selected:

• The page refreshes to allow the input of the access code.
• The indicated phone number receives an automated call or text with the five-digit verification code.
  
  • The code is valid for 10 minutes. After that, the recipient must return to the email and send a new code.
  • The recipient has a limited number of attempts to enter the correct code. The agreement is automatically canceled if the recipient fails enough times, and the sender is notified.

When the authentication is passed, the recipient can interact with the agreement.

If the recipient closes the agreement for any reason before completing their action, they must re-authenticate to continue.

Configuring the Phone authentication method when composing a new agreement

When Phone authentication is enabled, the sender can select Phone from the Authentication drop-down just to the right of the recipient's email address:

If a "bad" phone number is detected when composing the agreement, the process stops, and an error message is presented at the top of the page:

Consumption of premium authentication transactions

As a premium authentication method, Phone authentication transactions must be purchased and made available to the account before agreements can be sent with the method configured.

Phone authentication transactions are consumed on a per-recipient basis.

e.g., An agreement configured with three recipients authenticating by Phone consumes three authentication transactions.

Configuring an agreement with multiple recipients decreases one transaction for each recipient authenticating by Phone authentication from the total volume available to the account.

• Canceling a Draft agreement returns all Phone authentication transactions to the total volume available for the account.
• Canceling an In-progress transaction does not return the authentication transaction to the total volume available for the account.
• Changing an authentication method to Phone (from any other method) consumes one transaction.
  • If you change the same recipient back and forth between Phone authentication and other methods, you only consume one transaction total.
    
• Changing the authentication method from Phone to another method does not return the transaction.
• Each recipient authenticating with Phone authentication consumes only one transaction, no matter how often they attempt the process.

Track available volume

To monitor the volume of Phone authentications available to the account:

• Navigate to Account Settings > Send Settings > Identity Authentication Methods
• Select the Track Usage link:

Audit Report

The Audit Report clearly identifies that a phone number was used for identity verification. 

• Only the last four digits of the phone number are exposed.

If the agreement is canceled due to the recipient being unable to authenticate, the reason is explicitly stated:

Best Practices and Considerations

• If second-factor signature authentication isn't required for your internal signatures, consider the Acrobat Sign Authentication method instead of Phone authentication to reduce the friction of signing and save on the consumption of the premium authentication transactions.
• The phone number tied to the authentication attempt can only be changed for in-process agreements by editing the authentication type on the sender's manage page.
• Personalize your phone authentication messages to bolster recipient confidence in your text messages and to streamline customer contacts.
• Acrobat Sign text or voice messages are never unsolicited. They are always predicated on a signer who defines the contact type from the landing page of the Phone authentication challenge (by choosing their preferred option of Text or Voice) and then selecting the Send button to trigger the contact. The recipient's spam or malicious intent concerns can be mitigated mainly because the communication (voice or text) happens in near real-time.
  
• Acrobat Sign voice and text contacts never prompt the recipient to take action (e.g., visit a website or provide personal information.). Only a numeric code is communicated.  

Configuration

Phone authentication has two sets of controls, which are available to be configured at the account and group levels:

• Send Settings control the sender's access to the Phone method and configuration of the SMS options.
• Security Settings limit the recipient's attempts to enter the correct token.

Enable the authentication method under Send Settings

The option to use phone-based authentication can be enabled for senders by navigating to Send Settings > Identity Authentication Methods

• Phone authentication checkbox - When checked, Phone is an available option when agreements are composed.
• By default, use the following country code - Requires the admin to select a default country code for agreements sent through the group being configured.
• Personalize phone authentication message - Replace the embedded link to the agreement creator with some other literal value, like the email address of your support team.

Configure the Security Settings

Phone authentication requires the admin to configure a non-zero number of failed attempts allowed before the agreement is canceled. Five is the default.

This setting can be configured on the Security Settings page:

Automatic agreement cancellation when a recipient fails to authenticate

The agreement is automatically canceled if the limited number of Phone authentication attempts fails.

The agreement's originator is sent an email announcing the cancellation with a note identifying the recipient who failed to authenticate.

No other parties are notified.