Multi-factor verification for employers

Multi-Factor Verification (MFV) uses SMS to verify a user's identity during registration, providing an additional layer of data security.

When MFV is enabled, employers are taken to a verification step during registration to confirm they are the intended recipient of the registration email. The verification code is sent to the mobile number the administrator entered when creating the employer's account.

Phone numbers do not need to be in international format. Aptem accepts the same formats as standard.

When MFV is enabled, the Mobile Number field becomes mandatory when creating or editing a user, including when creating users via CSV upload or API.

The employer registration flow

When an employer is registered, they receive a registration email as usual. When they select the Activate Account link in the email, what happens next depends on whether MFV is enabled and whether a valid mobile number is on their account:

• If MFV is not enabled, they are taken to the Create Password screen as usual.
• If MFV is enabled but they do not have a mobile number on their account, or have an invalid number, they are taken to the MFV screen and shown a message asking them to contact their administrator to correct the number.
• If MFV is enabled and they have a valid mobile number, they are taken to the Enter Verification Code screen.

When the employer reaches this screen, a six-digit code is sent to their registered mobile number. SMS delivery is tracked, so the employer can see whether the message was successfully delivered.

The employer can use Resend Code to request a new code after 30 seconds. If fewer than 15 minutes have passed since the previous code was sent, the new code will be the same. If more than 15 minutes have passed, a new code is generated.

The employer enters the code and selects Verify and Register. If the code is incorrect, an error message is displayed. After five incorrect attempts, the employer must wait 60 seconds before trying again. If the code is correct, they are taken to the Create Password screen.

If MFV is not enabled, employers are taken directly to the Create Password screen when they select the Activate Account link in their registration email.