Phone authentication

Overview

Phone authentication is a premium second-factor authentication method that secures a strong verification of identity by having the recipient authenticate with a code delivered to their phone (upon their request).

The authentication process initially presents the recipient with a notification that they must enter a verification code to access the agreement. This notification provides the following:

1. The last four digits of the recipient's phone number (as entered when the agreement was composed) so the recipient knows which device the code will be sent to.
2. The (linked) name of the originator is provided in case the recipient needs to contact them for any reason (e.g., To change the phone number). The link opens an email to the address of the user that sent the agreement.
   • This link can be modified to guide the recipient to an explicit address, like your support team.
     
3. An option for the recipient to have the code delivered via voice call or text message.

When the user is ready to receive the verification code, they click the Send Code button:

Once the Send Code button is clicked:

• The page refreshes to allow the input of the access code.
• The indicated phone number receives an automated call or text with the five-digit verification code.
  
  • The code is valid for ten minutes. After that, the recipient must return to the email and send a new code.
  • The recipient has a limited number of attempts to enter the correct code. If the recipient fails enough times, the agreement is automatically canceled, and the sender is notified.

When the authentication is passed, the recipient is granted access to view and interact with the agreement.

If the recipient closes out the agreement for any reason before completing their action, they will have to re-authenticate.

Configuring the Phone authentication method when composing a new agreement

When Phone authentication is enabled, the sender can select Phone from the Authentication drop-down just to the right of the recipient's email address:

If a "bad" phone number is detected when composing the agreement, the process stops and an error message is presented at the top of the page:

Consumption of premium authentication transactions

As a premium authentication method, Phone authentication transactions must be purchased and available to the account before agreements can be sent with the method configured.

Phone authentication transactions are consumed on a per-recipient basis.

e.g., An agreement configured with three recipients authenticating by Phone consumes three authentication transactions.

Configuring an agreement with multiple recipients decrements one transaction for each recipient authenticating by Phone authentication from the total volume available to the account.

• Canceling a Draft agreement returns all Phone authentication transactions back to the total volume available for the account.
• Canceling an In-progress transaction does not return the authentication transaction to the total volume available for the account.
• Changing an authentication method to Phone (from any other method) consumes one transaction.
  • If you change the same recipient back and forth between Phone authentication and other methods, you only consume one transaction total.
    
• Changing the authentication method from Phone to another method does not return the transaction.
• Each recipient authenticating with Phone authentication consumes only one transaction, no matter how many times they attempt the process.

Track available volume

To monitor the volume of Phone authentications available to the account:

• Navigate to Account Settings > Send Settings > Identity Authentication Methods
• Click the Track Usage link:

Audit Report

The audit report clearly identifies that a phone number was used for identity verification. 

• Only the last four digits of the phone number are exposed

If the agreement is canceled due to the recipient being unable to authenticate, the reason is explicitly stated:

Best Practices and Considerations

• If second-factor signature authentication isn't required for your internal signatures, consider the Acrobat Sign Authentication method instead of Phone authentication to reduce the friction of signing and save on the consumption of the premium authentication transactions.
• The phone number tied to the authentication attempt can only be changed for in-process agreements by editing the authentication type on the sender's manage page.
• Personalize your phone authentication messages to bolster recipient confidence in your text messages and to streamline customer contacts.
• Acrobat Sign text or voice messages are never unsolicited. They are always predicated on a signer who defines the contact type from the landing page of the Phone authentication challenge (by choosing their preferred option of Text or Voice) and then selecting the Send button to trigger the contact. The recipient's spam or malicious intent concerns can be largely mitigated because the communication (voice or text) happens in near real-time.
  
• Acrobat Sign voice and text contacts never prompt the recipient to take action (e.g., visit a website or provide personal information.). Only a numeric code is communicated.  

Configuration

Availability:

Phone authentication is available for enterprise license plans only.

Phone authentication is a premium authentication method that has a per-use charge.

• 50 free transactions are included for new accounts.
• Additional transactions must be purchased for the option to be further used.
• Consumption from all groups draws from the same global pool.

Configuration scope:

The feature can be enabled at the account and group levels.

Phone authentication has two sets of controls, which are available to be configured at the account and group levels:

• Send Settings, which control the sender's access to the Phone method, and configuration of, the SMS options.
• Security Settings, which limits the number of attempts the recipient has to enter the correct token.

Enable the authentication method under Send Settings

The option to use phone-based authentication can be enabled for senders by navigating to Send Settings > Identity Authentication Methods

• Phone authentication checkbox - When checked, Phone is an available option when agreements are composed.
• By default, use the following country code - Requires the admin to select a default country code for agreements sent through the group being configured.
• Personalize phone authentication message - Replace the embedded link back to the agreement creator with some other literal value, like the email address of your support team.

Configure the Security Settings

Phone authentication requires the admin to configure a non-zero number of failed attempts allowed before the agreement is canceled. Five is the default.

This setting can be configured on the Security Settings page:

Automatic agreement cancelation when a recipient fails to authenticate

If the limited number of Phone authentication attempts fails, the agreement is automatically canceled.

The agreement's originator is sent an email announcing the cancelation with a note identifying the recipient that failed to authenticate.

No other parties are notified.