There is a scary new reality that mobile phone numbers are now being used against users. As the popularity of two-factor authentication has grown, hackers quickly learned how to compromise a mobile phone number to gain access to all kinds of personal information – resulting in about $2.3 billion in account takeover fraud in 2016. Since two-factor authentication is becoming obsolete, users must turn to other solutions to protect personal information.

Armin Ebrahimi, founder & CEO of ShoCard, sat down with Inside Counsel to discuss multifactor authentication and the protection that storage on the blockchain provides to users. ShoCard is a digital identity verification system that protects consumer privacy through its use of blockchain data layer, eliminates the need for usernames and passwords. Using multi-factor authentication in conjunction with storage on the blockchain, it protects users' identities on a level that is unable to be compromised.

“Phone numbers are widely used as a second factor. While initially, this has been a great second factor, inevitably, hackers who want to access user accounts are drawn to exploit it and are finding new ways to exploit phone numbers,” he explained. “Since authentication systems have made a big bet on the security of phone numbers as the second factor, it provides the greatest opportunity for hackers to get in.”

In fact, a hacker doesn't need a phone number as a second factor and it can be their only factor. Most prominent two-factor authentication (2FA) systems allow a user to go through “forgot-password” flow without entering a password and only using their phone number as their second factor to reset a new password, gaining access to an account. Therefore, phone numbers have become a single-factor authentication for hackers.

Today, there are two common ways of accessing user phones: Get access to view incoming clear text messages to read OTP (One Time Passwords) and hackers who have a user's personal information can call mobile carriers and claim to have lost their phone and get a new sim-card with the real-user's phone number.

So, what are some alternative solutions users should use to protect personal information?

Storing data on the blockchain is an effective way to protect personal information, per Ebrahimi. ShoCard has built technology that leverages the blockchain as an underlying piece of its architecture to provide identity management for users and enterprises. The ShoCard platform uses public/private key encryption and data hashing to safely store and exchange identity information. It's a form of multi-factor authentication with out-of-band communication and data matching, implementing private keys and hashes throughout the process. The blockchain allows ShoCard to create a secure, distributed trust system with the benefits of a federated identity system.

According to Ebrahimi, there are many key benefits to multifactor authentication. First, the fact that PII is not stored in any usable way either on ShoCard's servers or on the blockchain allows a user's personally identifiable information (PII) to be collected by the app, encrypted and stored locally on their device. Then, a one-way hashed, digital signature of those fields are created using the user's private-key and is stored on the blockchain. The original PII, when processed in this way, cannot be deduced or extracted in any way. The user's PII can then be validated and certified by a trusted entity like an identity verification provider, a government agency or corporate office.

Ebrahimi explained, “Using a method like the above process, these certifications are also stored on the blockchain using the verifier's private key. Once this data has been certified, the user can then interact with other parties and verify their identity or, if they choose, exchange personal data through a completely secure process. Similarly, enterprises can also provide validations of their own identity so that others can be assured of who they are interacting with.”