• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

Add-on Phone Verification For Upgrades (or Registration)

tenants

Well-known member
#1
Would any be interested in a phone verification system for account upgrades (I may also extend this to registrations).. It will use an external site to make the calls (something like Twilio .. who I believe charge $0.04 per text)

It's useful if you have many people upgrading with fake credit cards / cancelling upgrades after they pay

On visiting the Upgrades area, if the user has not verified by phone they are presented with a form to enter their phone number. On entering their phone number, they are sent a text with a simple code, if they successfully verify the code, they then have access to the upgrades area.

I'm currently working on this add-on, and thinking of selling it at £25 each?
 

HWS

Well-known member
#2
I would buy such an addon if it works for registration also. Even would pay more.
Maybe you want to take a look at Clickatell. That is what we use for automated text messages.
 

Mouth

Well-known member
#4
It would be *AWESOME* to see this Add-on.
I would also like to request that other Custom User Fields be made mandatory for upgrades. Thus, for an account upgrade definition, tick the boxes of Custom fields that are required to be completed during upgrade.

* Bonus Points, or Stage 2? - Allow the user to purchase (via account upgrade processing) SMS credits, and every delivery of an SMS decrements their balance or SMS credits by 1. SMS's are sent for user defined triggers (via their account settings) provided they have credits available.
 

tenants

Well-known member
#7
I would buy such an addon if it works for registration also. Even would pay more.
Maybe you want to take a look at Clickatell. That is what we use for automated text messages.
I'm looking at this, I've made it so that it also works with Clickatell

It currently works with the Account Upgrades (since this is the area that forum owners are likely to have fraud issues)
Telephone Verification service provides a way to combat on-line fraud. This ensures that your customers provide you with a working, traceable telephone number. As a result, fraudsters are less likely to target your business.
The whole process is automated for the merchant and easy to complete for customers.

Screen Shots here:
http://www.surreyforum.co.uk/thread...tions-with-phone-verification.1734/#post-2545

<It's not released yet>

It could be used on registration to prevent spam too, but how would you imagine it to work with registration?

Keep in mind, if bot account attempts to randomly fill this with real phone numbers, the SMS will be sent and you will still be charged for it (and they could keep doing this, switching IP addresses / username / emails)

Inside the account upgrades, we wont have such a problem (since you can limit the total SMS's an account can use, and prevent duplicate phone numbers etc)

Would you see this as an addition to CAPTCHA on a registration page?
Would this be within an iFrame on the same registration page, so that users also have to authenticate their phone number before registering

One idea I had is that the registration page wouldn't be available until the phone authentication was complete, on authentication, this would make the registration page visible and send an expiring authentication key (this key would need to sent on to the registration page and verfied) .. but this wouldn't stop bots from attempting the phone authentication
 

HWS

Well-known member
#8
It should work like it works at Facebook. They usually know what they are doing. :D

General registration should be possible without verification via SMS. You are correct, it is not possible to secure that with SMS verification.

However the admin/moderator should be able to set certain accounts manually to "SMS verification necessary". Those members should be displayed a form to verify their account before they can continue to use the site.

I cannot see the screenshots at your site, because of missing permissions (even after login). :(
When will you release this addon? I'm in a testing mood. ;)
 

tenants

Well-known member
#9
ohh.. good point, I rely on those view permissions so that people can't download the plugin without paying <tut>

added screen shots here:

Account Upgrade Fraud Work Flow Screen Shots
phonev_1.png phonev_2.png phonev_3.png phonev_4.png

Forum Spam Work Flow Screen Shots

phonev_spam1.png phonev_spam2.png phonev_spam3.png phonev_spam4.png phonev_3.png
ACP Screen Shots
PhoneVerify_ACP_logs.png PhoneVerify_ACP_options2.png PhoneVerify_ACP_perms.png
 

tenants

Well-known member
#11
However the admin/moderator should be able to set certain accounts manually to "SMS verification necessary".
This would imply it would be permissions base (which I was planning on doing), so you can allow certain groups through with out needing to phone authenticate.. or manually let some users through, or just target certain users and force them to phone authenticate.

Those members should be displayed a form to verify their account before they can continue to use the site.
This wouldn't work as just an overlay (they're easy to get around), so what it sounds like you are suggesting to "block" certain users from everything on the site until they have phone authenticated (not just the upgrade area) ... and this page would potentially be seen straight after registration (which is safer to control)

When will you release this addon? I'm in a testing mood. ;)
Probably before the end of the week
 

HWS

Well-known member
#13
This would imply it would be permissions base (which I was planning on doing), so you can allow certain groups through with out needing to phone authenticate.. or manually let some users through, or just target certain users and force them to phone authenticate.



This wouldn't work as just an overlay (they're easy to get around), so what it sounds like you are suggesting to "block" certain users from everything on the site until they have phone authenticated (not just the upgrade area) ... and this page would potentially be seen straight after registration (which is safer to control)
Group based would be perfect. Users in the wrong group should be blocked until verified.
Please notify me when you release it, I would like to buy it as soon as it is available.

;)

I've set it to an insane amount until it's ready
This is what I've thought. ;)
 

tenants

Well-known member
#14
Okay, so I can scrap the registration idea... I can't see a safe way of doing it

But a post registration form is looking likely

"your account first needs to be authenticated by phone, before the forum options can be unlocked"
<< and this will have to override potentially every type of page
 

tenants

Well-known member
#15
I've now added a version (PhoneVerify 1.2.0) with an ACP option that forces a user to Phone Verify (site wide)

This means after registration, the user will be presented the phoneVerifiaction Page, no matter where they attempt to visit - note, this is optional.. you can still apply phone verify to the upgrade area only if this is more appropriate

This version is also permission based (options to "canByPassPhoneVerify" can be applied to groups that you trust)

I'll add it to the resources once I've played with it for a day... but if you want to test it, it's now been reduced to the sane price of £25:
http://www.surreyforum.co.uk/forums/xenforo-plugins/
 

tenants

Well-known member
#19
okay... fixed and testing it now version 1.2.1

I'll add it to the resources tomorrow if I don't find anything else

I think Twilio give you about $10 to test with
Clickatell only give you 10 sms's to test with