# Avoiding Duplicate Phone Verification for Signup and MFA **URL:** \ **Category:** Get Help\ **Tags:** mfa-sms, login-experience\ **Created:** [October 22, 2026, 10:56pm UTC](https://community.auth0.com/t/avoiding-duplicate-phone-verification-for-signup-and-mfa/204595 "2026-10-22T22:56:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Eugene.Kriuchkov](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eugene.kriuchkov/32/80994_2.png) [@Eugene.Kriuchkov](https://community.auth0.com/u/Eugene.Kriuchkov)\ **Post date:** [October 22, 2026, 10:56pm UTC](https://community.auth0.com/t/avoiding-duplicate-phone-verification-for-signup-and-mfa/204595/1 "2026-10-22T22:56:34Z")
We collect the user’s phone number during signup using the **Phone Number** attribute configured on the database connection, and require phone verification as part of the registration process. We would also like to use the same phone number for SMS MFA. However, Auth0 appears to require the user to enter and verify a phone number again during MFA enrollment. If the user intends to use the same phone number for both signup and MFA, this seems like unnecessary duplication. Is there a recommended way in Auth0 to reuse a phone number that has already been collected and verified during signup for MFA, without requiring the user to enter and verify it again? Additionally, is reusing the signup phone number for MFA considered a good security practice? While it would simplify the user experience, it may reduce separation between profile data and MFA data. MFA phone numbers are typically obfuscated in the UI, whereas the Phone Number attribute used during signup appears to be more directly accessible and visible. ---
**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\ **Post date:** [October 23, 2026, 10:34pm UTC](https://community.auth0.com/t/avoiding-duplicate-phone-verification-for-signup-and-mfa/204595/3 "2026-10-23T22:34:49Z")
Hi @Eugene.Kriuchkov Thank you for reaching out to us! I understand that you are interested in collecting your users’ phone numbers during signup and using it for SMS MFA without requiring your users to re-enter and verify the phone number. ### Official Recommendation To prevent the user from re-entering their phone number, you can bypass the standard interactive Auth0 MFA setup screen by automatically enrolling them via the **Auth0 Management API**. If a user verifies their phone number during your signup or progressive profiling flow, you can leverage a secure backend or a Post-Login Action to call the Management API’s Authentication Methods endpoint: 1. Make a `POST` request to [`/api/v2/users/{user_id}/authentication-methods`](https://auth0.com/docs/api/management/v2/users/post-authentication-methods). 2. Pass the payload containing the verified phone number (e.g., `{ "type": "phone", "phone_number": "", "preferred_authentication_method": "sms" }`). Once this authentication method is created, the user is considered enrolled. On their next login, Auth0 will challenge them with an SMS code sent to that number directly, skipping the enrollment UI . **Watch out for UX limitations:** If the user later loses access to that phone number or makes a typo during a custom signup flow that somehow bypasses verification, they cannot easily change the number on the standard MFA challenge screen . You will need to build a custom factor-reset flow. **Security Implications & Best Practices** While reusing the profile phone number simplifies the onboarding experience, it is generally **not recommended** from a strict security and separation-of-concerns perspective due to the following reasons: - **Loss of Obfuscation:** You correctly identified the primary security discrepancy. By default, Auth0 [intentionally obfuscates MFA phone numbers](https://support.auth0.com/center/s/article/How-to-see-the-complete-phone-numbers-for-MFA-SMS-enrollment) in the UI and Management API, displaying only the last 4 digits (e.g., `XXXXXXXX1234`). If you store the MFA number as a standard `Phone Number` profile attribute or in `user_metadata`, it becomes fully visible to any application or support agent with read access to the user’s profile. - **Separation of Concerns:** Profile data (used for communication, marketing, or CRM) should ideally remain distinct from authentication data. Tying them together means that any internal system authorized to sync profile data inadvertently gains access to the user’s security token destination. - **Account Takeover Risk:** If a bad actor manages to compromise the application or profile management UI and changes the standard profile phone number, they could potentially compromise the MFA factor as well if your automated logic blindly syncs the profile number to the MFA enrollment factor. We hope this helped you achieve the desired flow! Feel free to reach out to us for any other issues or requests, we will gladly look into it! Have a great one, Gerald ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [November 2, 2026, 10:35pm UTC](https://community.auth0.com/t/avoiding-duplicate-phone-verification-for-signup-and-mfa/204595/4 "2026-11-02T22:35:18Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.