diff --git a/main/config/navigation/secure.json b/main/config/navigation/secure.json index a964af1824..33248c20ba 100644 --- a/main/config/navigation/secure.json +++ b/main/config/navigation/secure.json @@ -73,7 +73,8 @@ "docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-push-notifications-for-mfa", "docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-otp-notifications-for-mfa", "docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-email-notifications-for-mfa", - "docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa" + "docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa", + "docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms" ] }, "docs/secure/multi-factor-authentication/webauthn-as-mfa", diff --git a/main/docs/customize/phone-messages/configure-phone-messaging-providers.mdx b/main/docs/customize/phone-messages/configure-phone-messaging-providers.mdx index 3769027ee8..5664fdcd74 100644 --- a/main/docs/customize/phone-messages/configure-phone-messaging-providers.mdx +++ b/main/docs/customize/phone-messages/configure-phone-messaging-providers.mdx @@ -3,11 +3,4 @@ title: Configure Phone Messaging Providers sidebarTitle: Configure a Phone Messaging Provider description: Manage, monitor, and troubleshoot SMS and voice communications by setting up your own phone messaging provider. --- -import { ReleaseStageNotice } from "/snippets/ReleaseStageNotice.jsx" - - - Configure your own phone messaging provider to help you manage, monitor, and troubleshoot your SMS and voice communications. You can configure one phone provider for all SMS and voice communications per tenant. diff --git a/main/docs/fr-ca/customize/phone-messages/configure-phone-messaging-providers.mdx b/main/docs/fr-ca/customize/phone-messages/configure-phone-messaging-providers.mdx index 7be016b4e7..150292a160 100644 --- a/main/docs/fr-ca/customize/phone-messages/configure-phone-messaging-providers.mdx +++ b/main/docs/fr-ca/customize/phone-messages/configure-phone-messaging-providers.mdx @@ -4,8 +4,4 @@ sidebarTitle: Configurer un fournisseur de messagerie téléphonique description: Gérez, surveillez et résolvez les problèmes liés aux communications SMS et vocales en configurant votre propre fournisseur de messagerie téléphonique. --- -import { ReleaseStageNotice } from "/snippets/fr-ca/ReleaseStageNotice.jsx" - - - Configurez votre propre fournisseur de messagerie téléphonique afin de vous aider à gérer, surveiller et résoudre les problèmes liés à vos communications SMS et vocales. Vous pouvez configurer un fournisseur téléphonique pour l’ensemble des communications SMS et vocales par tenant. \ No newline at end of file diff --git a/main/docs/ja-jp/customize/phone-messages/configure-phone-messaging-providers.mdx b/main/docs/ja-jp/customize/phone-messages/configure-phone-messaging-providers.mdx index 42f7f9ae4c..1353fc6cb9 100644 --- a/main/docs/ja-jp/customize/phone-messages/configure-phone-messaging-providers.mdx +++ b/main/docs/ja-jp/customize/phone-messages/configure-phone-messaging-providers.mdx @@ -4,8 +4,4 @@ sidebarTitle: 電話メッセージプロバイダーを設定する description: 独自の電話メッセージプロバイダーを設定して、SMS と音声通信を管理、監視、トラブルシューティングします。 --- -import { ReleaseStageNotice } from "/snippets/ja-jp/ReleaseStageNotice.jsx" - - - SMS と音声通信の管理、監視、トラブルシューティングを行えるように、独自の電話メッセージプロバイダーを設定します。テナントごとに、すべての SMS と音声通信に対して設定できる電話プロバイダーは 1 つのみです。 \ No newline at end of file diff --git a/main/docs/secure/attack-protection/playbooks/mfa-playbook.mdx b/main/docs/secure/attack-protection/playbooks/mfa-playbook.mdx index 8c75724f78..44c13fcfd3 100644 --- a/main/docs/secure/attack-protection/playbooks/mfa-playbook.mdx +++ b/main/docs/secure/attack-protection/playbooks/mfa-playbook.mdx @@ -24,4 +24,5 @@ The following are example responses to attacks against MFA: * Migrate to stronger MFA options by replacing SMS/voice-based MFA with [OTP](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-otp-notifications-for-mfa) or [Webauthn](/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn/configure-webauthn-device-biometrics-for-mfa) to mitigate SMS pumping or toll fraud attacks. * Enhance SMS/Voice Provider Security by implementing fraud protection like Twilio's [Preventing Fraud in Verify](https://www.twilio.com/docs/verify/preventing-toll-fraud) when using SMS/voice MFA. +* Slow repeated SMS code requests for each user by enabling SMS Fraud Protection, which uses Exponential Backoff. To learn more, read [Exponential Backoff for SMS](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms). * Avoid MFA fatigue by enforcing push notification rate limits. diff --git a/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors.mdx b/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors.mdx index 5c6fedfa6c..93ddf64b19 100644 --- a/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors.mdx +++ b/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors.mdx @@ -21,6 +21,8 @@ If you don’t want your customers to have to download a separate application, A Send users a one-time code over SMS which the user is then prompted to enter before they can finish authenticating. To learn more, read [Configure SMS and Voice Notifications for MFA.](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) +To help protect against SMS toll fraud, you can enable SMS Fraud Protection, which increases the wait time between SMS code requests for each user. To learn more, read [Exponential Backoff for SMS](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms). + ### Voice notifications Deliver a one-time code to users through voice call which the user is then prompted to enter before they can finish authenticating. To learn more, read [Configure SMS and Voice Notifications for MFA.](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) @@ -83,6 +85,7 @@ Add contextual MFA which allows you to define arbitrary conditions that will tri * [Configure Push Notifications for MFA](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-push-notifications-for-mfa) * [Configure SMS and Voice Notifications for MFA](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) +* [Exponential Backoff for SMS](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms) * [Configure OTP Notifications for MFA](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-otp-notifications-for-mfa) * [Configure Email Notifications for MFA](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-email-notifications-for-mfa) * [Configure Cisco Duo Security for MFA](/docs/secure/multi-factor-authentication/configure-cisco-duo-for-mfa) diff --git a/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa.mdx b/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa.mdx index 47c6b50a0c..8dd6bf6d05 100644 --- a/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa.mdx +++ b/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa.mdx @@ -1,6 +1,7 @@ --- -description: Configure SMS and voice notifications as Auth0 MFA factors with Twilio, the built-in Auth0 provider, or a custom provider to deliver one-time codes. title: Configure SMS and Voice Notifications for MFA +description: Configure SMS and voice notifications as Auth0 MFA factors with Twilio, the built-in Auth0 provider, or a custom provider to deliver one-time codes. +validatedOn: 2026-10-16 --- import {AuthCodeBlock} from "/snippets/AuthCodeBlock.jsx"; @@ -43,7 +44,10 @@ After users are enrolled, the next time they authenticate they get the voice or * SMS: Verification code delivery by SMS * SMS and Voice: Verification code delivery by SMS or voice at the end user's discretion. * Voice: Verification code delivery by voice message. -5. Configure the code length and code lifetime: +5. Choose an SMS send policy: + * Default send: Immediately send verification codes. + * SMS Fraud Protection: Uses Exponential Backoff to increase wait times between requests per user. To learn more, read [Exponential Backoff for SMS](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms). +6. Configure the code length and code lifetime: * Code Length: Enter a value between 4 and 10 digits. The default is 6 digits. * Code Lifetime: Enter a value between 30 and 3600 seconds. The default is 300 seconds or 5 minutes. @@ -51,7 +55,7 @@ After users are enrolled, the next time they authenticate they get the voice or Customers are responsible for any diminishment in security posture resulting from a change to: (i) the Code Expiration Time or "Remember Me" Session Behavior lifespan to a time period longer than Okta's standard recommended setup; or (ii) the OTP Length to a shorter character length than Okta's standard recommended setup. -6. Configure your phone message provider, navigate to **[Branding > Phone Provider](https://manage.auth0.com/#/phone/templates/phone/provider)**: +7. Configure your phone message provider, navigate to **[Branding > Phone Provider](https://manage.auth0.com/#/phone/templates/phone/provider)**: 1. **Twilio**: Sends the messages using the [Twilio Programmable SMS API](https://www.twilio.com/sms) for SMS or [Twilio Programmable Voice API](https://www.twilio.com/voice) for voice. Use Twilio Life Credentials, not Test Credentials, which are only meant to send messages in a production environment. To learn more, read [Configure Twilio as a Phone Messaging Provider](/docs/customize/phone-messages/configure-phone-messaging-providers/configure-twilio-as-a-phone-messaging-provider). 2. **Custom**: Sends the messages by invoking an Action in the [Send Phone Message Flow](/docs/customize/actions/explore-triggers/mfa-notifications-trigger). * [Configure a Custom Phone Provider with Terraform](/docs/customize/phone-messages/configure-phone-messaging-providers/configure-a-custom-phone-provider/configure-a-custom-phone-provider-with-terraform) diff --git a/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms.mdx b/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms.mdx new file mode 100644 index 0000000000..673be88302 --- /dev/null +++ b/main/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/exponential-backoff-for-sms.mdx @@ -0,0 +1,82 @@ +--- +title: Exponential Backoff for SMS +description: Learn more about using SMS Fraud Protection feature Exponential Backoff to protect your application against SMS pumping. +validatedOn: 2026-10-16 +--- + + +You must have an Enterprise Plan to use SMS Fraud Protection with Exponential Backoff. Review [Auth0 Pricing](https://auth0.com/pricing) for more information. + + +Auth0's SMS Fraud Protection feature includes Exponential Backoff for [SMS phone factors](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa). SMS Fraud Protection helps protect your applications from SMS toll fraud (also called SMS pumping) and automated MFA abuse. When you enable it, your tenant stops using standard static rate limits for SMS verification requests and uses Exponential Backoff instead. Exponential Backoff increases the wait time between requests for each user. Legitimate users can still complete MFA enrollment, while scripted resends become slow and costly for attackers. + +## How it works + +When SMS Fraud Protection is enabled, Auth0 applies a delay to repeated SMS requests for each user identifier. + +| **Behavior** | **Description** | +|---|---| +| Immediate request buffer | Each user receives an initial allowance of immediate retry attempts to accommodate typos or delivery delays. | +| Progressive wait times | After the immediate retries, the required wait time increases with each additional request, from 1 minute to a maximum of 32 minutes. | +| Maximum delay | Wait times do not exceed 32 minutes. Permanent account lockouts are prevented while still maintaining abuse defense. | +| Timing variation | Auth0 adds a small, random variation (jitter) to each wait time so scripts can't predict when a request will succeed. | +| Automatic System Recovery | Delay states are dynamic and tied to recent request frequency. Wait times decrease when a user stops requesting codes. Extended inactivity resets the user's rate limit. | + +## Enable or disable SMS Fraud Protection + +Tenant administrators can enable or disable SMS Fraud Protection at any time. When you disable it, your tenant reverts to standard rate limiting. + + + + +1. Navigate to **[Auth0 Dashboard > Security > Multi-Factor Auth](https://manage.auth0.com/#/security/mfa)**. +2. Select **Phone**. +3. Choose an SMS send policy: + * **SMS Fraud Protection**: Uses Exponential Backoff. + * **Default send**: Uses standard rate limits. +4. Select **Save**. + + + + +Make a `PATCH` call to the `/api/v2/attack-protection/phone-provider-protection` endpoint. Your Management API access token must include the `update:attack_protection` scope. + +```bash lines +curl --request PATCH \ + --url 'https://YOUR_AUTH0_DOMAIN/api/v2/attack-protection/phone-provider-protection' \ + --header 'authorization: Bearer MANAGEMENT_API_ACCESS_TOKEN' \ + --header 'content-type: application/json' \ + --data '{ "type": "exponential" }' +``` + +| Value | Description | +|---|---| +| `type` | SMS send policy. Set to `exponential` to enable SMS Fraud Protection with Exponential Backoff, or `default` to revert to standard rate limits. | + +To check the current setting, make a `GET` call to the same endpoint. Your access token must include the `read:attack_protection` scope. + +```bash lines +curl --request GET \ + --url 'https://YOUR_AUTH0_DOMAIN/api/v2/attack-protection/phone-provider-protection' \ + --header 'authorization: Bearer MANAGEMENT_API_ACCESS_TOKEN' +``` + + + + +## Monitor and audit backoff events + +When a user's SMS request is delayed due to exponential backoff: + +* The MFA prompt informs the user a temporary wait period is required before requesting a new code. +* Auth0 generates a `limit_phone` event to your tenant logs with the throttled attempt and the remaining cooldown period for auditing. To learn more about `limit_phone`, review the [Tenant Log Catalog](/docs/tenant-logs/system-notification/limit-phone). + +To view these events: + +1. Navigate to [**Auth0 Dashboard > Monitoring > Logs**](https://manage.auth0.com/dashboard/#/logs). +2. Filter by `type: "limit_phone"`. + +## Learn more + +* [Configure SMS and Voice Notifications for MFA](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) +* [Configure Phone Messaging Providers](/docs/customize/phone-messages/configure-phone-messaging-providers)