9Multi-factor Authentication Requirements

9 Multi-factor Authentication Requirements

(1) In a case where the high-risk customer interaction is initiated by the requesting person – a carriage service provider for the telecommunications service must use one of the following identity authentication processes: (a) at least two account information authenticators; or (b) at least two personal information authenticators; or (c) at least: (i) one account information authenticator; and (ii) one personal information authenticator; and must comply with subsection (3). (2) In a case where the high-risk customer interaction is initiated by the carriage service provider using the public number listed on the customer’s account as the contact number for the customer – the provider for the telecommunications service must use at least one personal information authenticator, and must comply with subsection (3). Note: Where a high-risk customer interaction is initiated by the carriage service provider using the public number listed on the customer’s account as the contact number for the customer, the carriage service provider will have met the requirement in paragraph (3)(b). (3) The carriage service provider for the telecommunications service must use at least one of the following identity authentication processes to confirm that the requesting person is the customer, or is the customer’s authorised representative, for that service:

(a) subject to subsection (4), confirming the requesting person has direct and immediate access to the telecommunications service; or

Examples:
(a) for a public mobile telecommunications service in a retail environment– personnel representing the carriage service provider call the mobile service number listed on the customer’s account while in store and verify that the call has been received by the customer’s mobile device used in association with that number while the customer is instore.
(b) in an online environment– personnel representing the carriage service provider receiving confirmation that the customer has received a unique verification code or secure hyperlink.

(b) subject to subsection (4), confirming the requesting person has direct and immediate access to the public number listed on the customer’s account as the contact number for the customer; or

Example: For a telecommunications service in a call centre environment, personnel representing the carriage service provider calling back the public number listed on the customer’s account to confirm that the requesting person has access to the service used in association with that public number.

(c) use of a unique verification code or secure hyperlink:

(i) which is sent to the customer, or the customer’s authorised representative as the case may be (the relevant person), by the carriage service provider:

(A) by SMS message to the mobile service number which is listed on the customer’s account as the contact number for the customer; or
(B) by email to an email address that has been validated by the relevant person; or
(C) by an in-app message to a carriage service provider’s mobile application that has been validated by the relevant person; or
(D) to some other device or account which has been validated by the relevant person; and

(ii) which includes in the message in which the unique verification code or secure hyperlink is sent, a clear statement informing the relevant person:

(A) that a high-risk customer interaction has been initiated in relation to the customer’s telecommunications service;
(B) that the code or secure hyperlink should not be shared with any other party except the carriage service provider if the relevant person has initiated the high-risk customer interaction; and
(C) what the relevant person can do if they did not initiate the high-risk customer interaction; and

(iii) after the receipt of which by the relevant person, the carriage service provider receives immediate confirmation from the relevant person that the relevant person has received the unique verification code or secure hyperlink; or

(d) use of one or more forms of biometric data; or

(e) using a category A document via the process described in Schedule 1; or

(f) use of a cryptographic key.

(4) When an identity authentication process used to comply with either paragraph (3)(a) or paragraph 3(b) includes the use of a unique verification code or secure hyperlink, the carriage service provider must also comply with paragraph (3)(c).