How to Unmask the SMS MFA Factor Phone Number

[lihua.zhang]

Last Updated: Aug 9, 2024

Overview

This article explains how to unmask the phone number used as the MFA Factor.

The Management API Get the First Confirmed Multi-factor Authentication Enrollment returns the masked phone number.

Applies To

• Phone Number
• SMS
• Management API

Cause

By default, Auth0 obfuscates the user’s phone number used in SMS MFA.

Solution

The tenant setting below can be configured to disable the obfuscation of phone numbers used in SMS MFA.

• Send a PATCH request to the Management API’s Update tenant settings with the following request body:

  {
    "flags": {
      "disable_management_api_sms_obfuscation": true
    }
  }
  

  Before
  

  
  
  After