SMS-based authentication has become common. Services like Instagram and LINE do not let you create a phone number, and even when you can register, enabling two-factor authentication for security often requires SMS verification. The fact that those services assume you have a mobile phone within reach shows how widely phones and SMS have spread.
On the other hand, SMS authentication is a much higher hurdle when a shop or company uses a service—not an individual. Suppose a business uses a service that requires SMS verification and registers with the representative's phone number. Every time someone needs the code, they have to ask the representative to share the SMS they received. If you use a staff member's number instead, access breaks when that person leaves.
What about putting a dedicated smartphone at the shop for SMS authentication because relying on individuals is bad? In that case, whoever performs SMS authentication must always have that device nearby. So if someone tries to verify while traveling, they still have to ask someone near the device every time.
Someone asked me whether I could solve this when building an app, and I looked into it.
https://zenn.dev/kawabatas/articles/e996a7d59eeadf
Using a Twilio number for SMS verification is prohibited in some cases, and as another article explains, overseas numbers often cannot be used with domestic services at all.
https://www.xoxzo.com/ja/about/pricing/
Services that provide phone numbers for SMS verification charge an initial setup fee of ¥37,500 and ¥7,500 per month. That is a bit much just for authentication.
While I was researching, I learned that Android has "SMS forwarding apps"!!
https://play.google.com/store/apps/details?id=com.frzinapps.smsforward&hl=ja&gl=US&pli=1
Android has an API called a broadcast receiver, so an installed app can listen for incoming SMS. It is android.provider.Telephony.SMS_RECEIVED. I did not know that and was surprised.
The frzindev app above uses it as a forwarding app and can share SMS and notifications across multiple devices. It can forward to an email address! Yes!!
So the setup I am proposing to the shop that asked for advice looks like this.
- Prepare an inexpensive Android device that can install frzindev
- Sign up for au povo on that device (base fee ¥0!)
- Create a Gmail account for SMS authentication
- Install frzindev and configure forwarding to that Gmail account
That completes the setup. When you actually perform SMS authentication, it works like this.
- SMS arrives on that device
- frzindev forwards the SMS to Gmail
- Everyone can read the SMS in Gmail!!
If needed, you can also forward from Gmail to all staff. When someone leaves, remove them from the forwarding list and they lose access to SMS. If you want to treat SMS as SMS, set the forward destination to a phone number; managing all destinations in frzindev instead of via Gmail is fine too, I think.
If a restaurant or company is stuck sharing SMS authentication, I hope this helps. See you next time.