The Payment Card Industry Data Security Standard (PCI DSS) is the gold standard for information security for organizations that handle credit and debit card payments. Plivo is certified for PCI DSS compliance.

What is PCI DSS?

PCI DSS covers security requirements regarding storage and transmission of data, access control, and other factors, including:

• Use of firewalls and antivirus software
• Data encryption
• Passwords
• Multifactor authentication
• Specified roles and responsibilities for each requirement

PCI DSS comprises a set of requirements instituted and regulated by the PCI Security Standards Council (PCI SSC), a consortium of card brands including Visa, Mastercard, American Express, and Discover. All organizations that process, store, or transmit payment card data must comply with PCI DSS requirements or risk losing their ability to process these payments.

Plivo is PCI DSS certified

Plivo is certified for PCI DSS Level 1, which applies to organizations that process more than six million credit or debit card transactions annually. We undergo an internal audit once a year, conducted by an authorized PCI auditor, and submit to a PCI scan by an approved scanning vendor once a quarter.

Plivo doesn’t accept payments directly — a cloud-based payment platform handles all of our transactions. However, while using a third-party provider cuts down on our risk exposure and reduces the scope of detail necessary to validate compliance, we still need to be PCI DSS compliant.

PCI DSS compliance requires everyone’s attention

PCI DSS compliance is a shared responsibility, however. Plivo can guarantee things like encryption of data in transit and at rest and redaction of details in logs, and back those guarantees up with audit reports from independent third parties. But our customers are responsible for other aspects, such as securing their authentication credentials and using the Plivo console in a secure environment. In short, you have to use Plivo in a compliant manner and make sure your applications’ instructions to us comply with the statutes.

Become an enterprise customer

PCI DSS compliance is just one Plivo feature that will appeal to large organizations. We’ve rolled several other features into an enterprise package that has numerous benefits for large organizations. Tell us about your needs and we’ll have an expert get in touch with you.

We’ve never taken our blog readers on a tour of the console. Did we assume that since they could sign up for free they could give themselves a self-guided tour? That’s certainly an option, but we’ll take a moment here and now to be your tour guide. Please keep together.

We’ll start our tour with a look at the SMS features available on the console. We were inspired to call out this section by a comment from Sharita Passariello, who works for Plivo customer Fluent, and who said in a recent customer story, “I love the self-service console and ease of use. It’s critical for us to check the SMS logs and see the messages that were delivered and undelivered, and see why messages were undelivered.”

Passariello shared additional insights about the state of SMS API marketing in a recent webinar.

The SMS menu overview

To get to the SMS menu, visit the Plivo console and click on the third icon.

The console displays the Messaging Overview page.

Below some account information, the overview page shows a quick usage summary, a map (holy Mercator, look at the size of Greenland!) with a table showing usage by location, and a graphical and tabular breakout of messaging by source number type.

SMS and debug logs

That’s all very pretty and good information to pass along to upper management, but the console exposes lots more information. To see it, click on the Logs submenu to bring up the SMS/MMS log: a list of every messaging API URL call made, which you can filter a number of ways or export for analysis elsewhere.

When you click on a message entry on the log page, you can see details about the message.

We won’t make this long post longer by pointing out the information in each section of the page — the point is, you can see all the information you need about a given message, including status, content, and charges.

In addition to the SMS/MMS log, for API calls that include callback URLs, we expose details of our API responses in a debug log; it contains details for all callbacks that Plivo sends. If you click on MessageUUID of an entry in the debug log you can zoom in and see all the details about the message.

10DLC

Since Fluent’s Passariello also complimented us on our 10DLC console capabilities in the company’s customer story, let’s look at those next. From the 10DLC menu choice you can add the 10DLC brand you’ve registered for your business, or register one or more new ones. (Resellers, for instance, register multiple brands.) If you click on a brand, you can see all the campaigns registered for it, register new ones, and deactivate existing ones.

If you click on a campaign, you can see all of the phone numbers registered for it, and link and unlink numbers, as well as see the throughput allocation for the campaign.

XML and PHLO applications

From the SMS menu you can also look at the Plivo applications associated with your account. In Plivo parlance, an application is a set of answer, hangup, and message URLs that you use to control what happens to your incoming calls and messages. This console page shows the mappings.

Here’s an example of an interactive voice response (IVR) XML application; we can tell that by looking at the information about it in the Application Details section. The entries in the Voice section define URLs the application looks at in the event of an incoming call to that number or when the call is hung up. Upon receipt of an incoming call Plivo makes a synchronous HTTP request to your application using the URL specified in the Primary Answer URL field. The API expects an XML document in response. Plivo also sends a few parameters with the HTTP request that your application can act upon before responding.

Messaging works the same way. Plivo makes a synchronous HTTP request to your application using the URL specified in the Message URL field. Your web application should return an XML document that provides instructions to the Plivo API on how the event should be handled. You can read more about the process in our documentation.

In addition to XML applications, you can see information about PHLO applications. Plivo High-Level Objects is a visual design studio that lets you build workflows with little or no code. When you click on a PHLO in the list, you bring up the design page for that PHLO, so you can change the workflow and settings.

Sender IDs, MMS media upload, and Powerpack

Many countries — but not the US or Canada — support sender IDs, which are like caller IDs but for messaging. From this menu page you can see what sender IDs you’ve registered and register new ones.

If you’re planning on sending MMS messages with image, audio, or video attachments, you can specify your own URL or you can use the MMS Media Upload screen to upload the multimedia files to Plivo. then use the media ID associated with the file in the SMS API to include the attachment. Hosting it with us gives you lower latency and eliminates the need for you to manage attachments elsewhere.

Plivo also offers Powerpack, which lets companies manage messaging at scale. With the introduction of 10DLC, which offers higher throughput on long code numbers than was formerly available, Plivo no longer recommends using Powerpack for US customers, but it’s a great tool for other countries.

Settings

The final SMS menu choice lets you tailor certain settings. For example, under Alerts, you can choose whether to notified when

• the delivery rate for outbound messages drops significantly
• delivery failures for inbound messages rise significantly
• SMS volumes display unusual surges

Another screen lets you set geo permissions as a way to help curb SMS fraud. You can select a list of destination countries to which outbound messaging from your account is allowed. We’ll block (and not charge for) any messages sent to countries not in this list. You can also define a list of countries to which outbound SMS traffic is allowed at a subaccount level.

The third and final settings submenu lets you tailor a few miscellaneous settings.

All about the console

The console is the nerve center for administering the Plivo platform in action. This post touched on some highlights; to dig deeper, visit your own console and see what your data looks like. Also check out our other console tours of the Voice, Zentrunk, Number Lookup, and Phone Numbers menus. If you have any questions, you can find the answers in our documentation or on our support portal.

For retailers, nothing is better than brand loyalty. If you can create a positive image of your brand in people’s minds, not only are they likely to become repeat customers, they’ll also help you market your brand to their friends and acquaintances.

Text messaging, a.k.a. SMS (short message service), may be the best tool retailers have to build brand loyalty. With texting you can not only be in touch with people who might want to buy from you, you can also interact with them.

Why is SMS better than other communications channels? Virtually everyone has a cellphone, so virtually everyone can access SMS. Text messages have a 98% open rate, and 90% of texts are opened within three minutes. Those stats are much higher than comparable rates for email. And at less than a penny per message, SMS is less expensive than alternatives such as direct mail or newspaper advertising. Finally, since your messages arrive directly on people’s devices, you can personalize your messages for each customer.

Virtually anything you could send via email or direct mail works better with SMS. You can use SMS to:

• Attract new customers: Casual shoppers that find your website can sign up to receive coupons or notices of special sales.
• Encourage repeat business: By staying in touch with customers, you keep your brand at the top of their mind.
• Simplify customer purchases: If you have a repeat customer, you can text them a verification code for them to enter. Since you already have their payment and shipping information in your systems, all they have to do is enter the code and confirm their purchase.
• Send operational messages: You can use SMS not just for marketing but also for operational tasks such as order confirmations, status updates, in-stock/pickup notifications, and delivery notifications.
• Enhance security: By sending one-time passwords via SMS, you can make sure that customers’ account records are accessible only to the person whose phone number is associated with an account.

Using SMS for retail marketing

SMS is especially useful for retail marketing. In the last six months, Statistica reports 79% of smartphone users made a purchase on their mobile device, and that mobile commerce makes up 73% of the global share of ecommerce. Implementing retail SMS marketing is a great way to meet customers on a channel they already use.

The ultimate metric for retail marketing is increased sales. Learning about a product is a key step in selling it. You can use SMS to send a link to a web page where people can learn about a product.

A side benefit of that process is analytics. By customizing the link, you can see how many people used it and what kind of demographics they represented, which you can then use to refine your message for the next outreach message.

People that opt in to receiving marketing messages have a bias toward purchases. You can boost sales by sending them digital coupons that they can use online or in person (to increase store visits), or tell them about special sales for opted-in members. Even if they don’t buy today, staying in touch keeps your brand at the forefront of their attention, which can build brand loyalty — as long as you don’t cross the line into spam by a too-frequent cadence of outreach.

In addition, customers appreciate information they can use. You can use SMS to let customers know that their order was shipped, or new stock arrived, or tell them about special holiday store hours.

Stay compliant

SMS can benefit retail businesses, but you have to remember to stay compliant with national and carrier regulations, which differ from country to country. Most countries require businesses to obtain permission from consumers before sending them text messages. They may also limit the hours at which you can send messages, and require certain kinds of identification, such as a caller ID or sender ID.

Retailers can encourage consumer opt-ins by offering them special discounts. For example, you might ask consumers to sign up for SMS updates, and when they do, you text them a promo code that gives them 15% off an upcoming purchase. That’s a win for both the business and the customer.

Fortunately, you can get a head start on most of your compliance issues by using an SMS API from a cloud communications platform like Plivo. We operate in more than 190 countries and build in compliance with local compliance requirements. (It’s still up to you to make sure your customers opt in to receiving messages though.)

Think about the many ways your retail business can use SMS, then get a free Plivo trial account and start using text messaging to foster brand loyalty.

The last several months have seen massive regulatory change in the telecom industry around the world. Here are some of the highlights.

New sending rules in Singapore and Saudi Arabia

Sender ID is the name or number that is displayed as the sender of the SMS message to the receiver of the SMS message. Countries have different practices around sender ID use. In 2022 Iran, Singapore, and Morocco all began requiring preregistration for sender IDs.

Singapore launched a full SMS Sender ID Registry (SSIR) Regime under which only local business entities or foreign entities with a local physical presence can communicate via text messages.

As part of their efforts to reduce text messaging spam, the Kingdom of Saudi Arabia (KSA) now requires that international businesses that send SMS into the country do so via an aggregator that has a direct connection with appointed SMS hub providers. To comply with the requirements, providers like Plivo need to have a No Objection Certificate (NOC) on file for customers’ messaging traffic. A NOC is similar to a Letter of Authorization (LOA) used in other countries. KSA began enforcing the requirement on February 1. Plivo customers can download a NOC template [DOC], complete it, scan it, and return it via support ticket.

New content regulations in the UK, Iran, and Vietnam

The UK now requires that the content of URLs sent in SMS messages toward the UK be preapproved by a service provider. Businesses must share with their provider their company name and website address, their sender ID, and the contents of the messages they plan to send.

Iran now scrubs messages at an operator level for all messages that contain URLs.

Vietnam now requires content whitelisting at an operator level.

New short code requirements in NZ and BR

Meanwhile, regulators in New Zealand and Brazil are now encouraging messages to be sent via short codes; messages sent via other number types will experience poor deliverability. Plivo now offers short codes in both New Zealand and Brazil for a better messaging experience.

A single theme: combat fraud

All of these changes indicate that countries are tightening regulations to combat fraud. Telecom regulators in more countries are beginning to require pre registration and content whitelisting. At the same time, processes around the globe are becoming more streamlined to ensure faster and safer communications. Someday we may live in a world in which, when you receive a message from a Nigerian prince, it really is from African royalty.

The number of unwanted and illegal robocalls in the US continues to rise. According to YouMail, Americans were hit by more than 50 billion robocalls in 2021, with about 40% of those calls thought to be fraud-related. And as annoying as these calls are for people who receive them, they’re even more detrimental for businesses that are trying to reach people with pertinent information. Many of these robocalls use caller ID spoofing to make recipients think they might know the caller. Caller ID spoofing hurts legitimate businesses by making call recipients less likely to pick up any calls.

UC Today interviews Plivo’s Tony Graham to learn what’s shaking with STIR/SHAKEN.

Understanding STIR/SHAKEN Standards: Trusted Calling with Shake Stir

While historically, telephony was highly regulated, technical innovations such as computerized dialers and inexpensive IP-based calling on the public telephone network has turned robocalling into an everyday nuance. As a result, the US agency in charge of protecting consumers from communication scams, the Federal Communications Commission (FCC), directed carriers to implement robust call authentication by adopting STIR/SHAKEN standards targeting by June 30, 2021.

What is STIR/SHAKEN?

STIR/SHAKEN are acronyms for the Secure Telephone Identity Revisited (STIR) and Signature-based Handling of Asserted Information Using toKENs (SHAKEN) standards. They’re technical frameworks that measure trust in the displayed caller name and number by authenticating the calling number.

Together they work in a way similar to attesting to the identity of the caller with a digital certificate. In the STIR/SHAKEN framework, a secure telephony identity (STI) governance authority issues digital certificates to carriers, or others who own or are assigned dedicated telephone numbers. The private key associated with a digital certificate is then used to sign a VoIP call, thereby indicating that the calling party number is who they claim to be.

Levels of Attestation in STIR/SHAKEN: Shake Stir Caller Trust

Attestation provides the mechanism for carriers to communicate about a calling phone number’s legitimacy. A Secure Telephony Identity (STI) authentication service assigns an attestation level to a call that represents how confident a service provider is that the number’s owner is truly the one placing the call:

• Full attestation (A) — The service provider has authenticated its relationship with the customer making the call and the customer is authorized to use the calling number.
• Partial attestation (B) — The service provider has authenticated its relationship with the customer making the call, but cannot verify that the customer is authorized to use the calling number.
• Gateway attestation (C) — The service provider has authenticated that it has placed the call on its network, but has no relationship with the originator of the call (for example, a call received from an international gateway).

How STIR/SHAKEN Notifications Enhance Trusted Calling?

When someone receives an authenticated call, they may be notified with a verification keyword or symbol on the incoming call display. If a call cannot be verified (attestation C or no attestation), it may be blocked or the consumer may be warned on their caller ID screen of a potential scam call. The purpose of notifications is to allow people who receive calls to decide whether they want to answer, ignore, or block a number.

If you’re a business, these changes should help you feel more empowered and increase the chances of your calls being answered by recipients.

We have more details about STIR/SHAKEN in our documentation.

Implementing STIR/SHAKEN

Without Plivo:

Businesses that implement STIR/SHAKEN themselves (typically within a private cloud environment) are held accountable with near-instant traceback by regulatory groups and law enforcement if STIR/SHAKEN is abused, including faking attestation levels.

With Plivo:

If you’re a direct customer of Plivo’s, we can sign outgoing calls on your behalf and ensure calls get the right attestation so that call recipients feel confident in answering them. We can also validate the attestation levels on incoming calls received on the Plivo Voice API platform, providing customers with the necessary information so that they and their end users can decide whether to answer the calls or not.

To ensure the right level of attestation, Plivo customers should submit to us their business information and the phone numbers they own and use as caller IDs so they can be verified. We’ll determine the appropriate level of attestation depending on the results of the verification and thus the level of confidence Plivo has in the caller ID used on an outgoing call.

Plivo’s compliance operations team makes this process as seamless as possible for our customers. We believe that STIR/SHAKEN is crucial in preventing illegal or deceptive behavior like caller ID spoofing, and we’re excited to be part of the fight against unwanted robocalls.

If you work for a state or local government agency you probably think a lot about how to communicate with your community — and how they communicate with you — given that public servants should be as accessible as possible. You probably already offer a lot of ways to communicate with those you serve — via in-person office hours, telephone calls, email, and web forms. If that’s as far as you go, though, you may be missing out on a channel that many people prefer to use.

Public agencies can benefit from adding SMS to their communications toolbox. Virtually everyone has a cellphone, so virtually everyone can access SMS. Text messages have a 98% open rate, and 90% of texts are opened within three minutes.

Using SMS is less expensive than many alternatives — a big positive when it comes to spending tax monies responsibly. Instead of calling a 311 municipal services hotline, residents can text their issues to an equivalent number. Behind the scenes, an application reads incoming texts and responds automatically by providing informational resources or forwarding queries to the appropriate people and departments. Text messaging makes it easy for citizens to report burned-out streetlights and get information about permits and licenses at a very low cost to the municipality. It can improve communications and enhance customer service.

{{cta-style-1}}

SMS use cases for public communication

Almost every government agency can use SMS for community text marketing. It’s a great way to share news about special events, holidays, changes in hours of business, and other kinds of general news. Text messages don’t require agreeing upon a mutual time to communicate. People open them quickly. And digital messages are easy to include in the public record to satisfy transparency laws.

Agencies can send confirmation messages to citizens who submit forms or comment to the agency, to acknowledge receipt. When appropriate, software developers can build confirmations into the process of handling an incoming message, perhaps sending status updates at different milestones, such as when a task is assigned to a specific individual and when it’s completed.

Text messages can contain links to web pages, so governments can send members of the public to a web page that tells them the information they need, or to a web form where they can file a report. And SMS leaves a digital record of every message, which is important for oversight, transparency, and compliance.

With a single text message, government representatives can send notifications to thousands of people at one time, allowing citizens to access the information they need quickly from their mobile devices. What are some common scenarios in which SMS helps governmental agencies?

Emergency alerts

If a hurricane, tornado, blizzard, or even severe thunderstorms threaten the public, the powers that be should warn people to prepare. An agency can send bulk SMS messages to every opted-in citizen to tell them what’s happening, at what time issues are expected, and where and how they can get help.

Safety alerts

One texting example that many people are familiar with is the Amber Alert/ Silver Alert system: If a child or a senior with dementia goes missing, law enforcement can send an SMS message to everyone within a certain geographic area with information about the missing person and other useful details.

Service notifications

Text messages are an effective way for public works departments to tell residents about changes in parking regulations, temporary parking changes caused by street cleaning, snowplowing, or construction, and road closures and detours. They can alert neighborhoods about shutoffs to repair water lines.

Reminders

Governments work best when all citizens have an opportunity to participate. Sending SMS messages can help remind people of their responsibilities. Local governments can use text messages to remind adults to register to vote, and to tell them where their polling place is on Election Day.

Courts can send reminders for plaintiffs, defendants, and jurors about when they have to appear at hearings. A study from New York courts showed that text reminders reduce the failure-to-appear rate by up to 21%.

Business licensing authorities can nudge business owners about business registration renewal deadlines.

Motor vehicle departments can remind drivers that their cars need a state-mandated inspection. Most drivers would rather get a reminder and pay for an inspection than get pulled over and pay for a ticket — and have to pay for an inspection on top of it.

Surveys

Not all text messaging has to be reactive. Government bureaus can also use SMS to send out surveys to ask what people want from them or to gauge how effective a program is.

And more!

All of the use cases we’ve looked at so far rely on governments sending communications to residents, but when you have the ability to use SMS, you’ll find it a worthwhile tool for interagency communication as well.

Finding time for meetings between government officials is a chore. In-person meetings are tiresome to set up and not always a productive use of all participants’ time. Voice calls are almost as poor a communication channel — they take too much time and leave no easily searched record of any decisions made. Email is a better option — when people open it. Shared documents are another great alternative, but security and privacy regulations make using them problematic. SMS makes an excellent alternative — it’s widely available, quickly read, and easily preserved for transparency purposes.

Another thing SMS works well for is inbound communication from the public to government agencies and bureaus. Most agencies already offer multiple communication channels to allow the public to use whichever ones they’re most comfortable with. SMS is as timely as a visit to City Hall without the inconvenience of having to travel downtown. It’s as convenient as email as a way to send images, documents, and web links, which can be useful to help municipal workers understand issues more clearly. And it’s more convenient than voice calls to staff members for all of the reasons that individuals choose to text their friends rather than call them.

Finally, security best practices call for organizations to use two-factor authentication (2FA) before permitting authorized users to access their digital assets. For many organizations, 2FA involves the use of one-time passwords (OTP) delivered via SMS.

The right way to support SMS

Clearly SMS is a useful communications channel, but government agencies can’t let individual workers use their personal cell phones for official business. They need to set up an SMS communications platform that uses an SMS API to programmatically send and receive messages and route them appropriately.

Plivo helps governments and public sector agencies keep their constituents informed.

Many organizations add fault tolerance to their IaaS and PaaS platforms by using multiple providers. We’re seeing the same trend in SaaS software, and particularly with communications platforms as a service (CPaaS) — and for excellent reasons.

In a report based on the 451 Research Voice of the Enterprise (VOTE) survey, 451 Senior Analyst Raul Castanon says, “As mainstream enterprise adoption continues to grow, we expect CPaaS will mirror key trends driving the evolution of the larger IaaS/PaaS market.” Castanon and Plivo CEO Venky Balasubramanian covered the issues in a joint webinar.

Castanon also said, “Plivo can be considered among the pioneers for CPaaS and continues to innovate, with novel approaches such as multicloud CPaaS, which can be instrumental for enterprises looking to address challenges related to resiliency, scalability, global coverage, and regional regulation requirements.”

Three of the most important reasons for a multicloud approach include gaining 100% uptime, getting access to unique platform-specific features, and optimizing costs.

Resiliency

100% uptime is everybody’s goal, but every platform experiences outages, both unplanned and planned. When a cloud communications platform is unavailable, end users can fail to receive important information such as account alerts, delivery notifications, appointment reminders, and — worst of all — two-factor authentication messages. If someone doesn’t receive a text message with a one-time password for 2FA, they won’t be able to access the resources they need on their systems.

Using multiple cloud communications platforms keeps your team from having to depend on a single point of failure. Redundancy is a must for mission-critical systems and applications.

Plivo promises 99.99% uptime. In practice we generally do better than that — check our status page for proof. That enables us to deliver more than a billion transactions every month. If you have both a primary and a secondary CPaaS provider with those kinds of numbers, chances are you’ll never lose touch with your customers.

Platform-specific features

All CPaaS have different geographic coverage. While Plivo can deliver text messages and voice calls to more than 190 countries, some of our competitors have smaller lists; Bandwidth, for example, boasts that they have a presence in 60+ markets, while Telnyx claims 142. With multiple providers you can reach people around the globe, so if you’re in need of a Bandwidth alternative or a Telnyx alternative, we can help.

Similarly, voice quality and message deliverability vary on different platforms. If you find you’re having problems in those areas, as Plivo customer Fluent did with another CPaaS provider’s network, you can bring on a platform that can help you improve those numbers. Selecting a secondary platform allows you to send messages or calls through the provider that provides the best call quality or message deliverability, ultimately offering better service to your customers.

Cost optimization

Providers have different rates for services in different countries. With multiple providers you can plot out the best rates and optimize your costs.

But you can’t look at just the unit cost per message or per call when you consider optimization. What really matters is the total cost of ownership — or rather total cost of the service. That means considering, in addition to unit costs, items like support costs, platform costs, and people costs — the time spent using and managing the service.

With an API platform, people time includes developer time. Having an API that resembles that of a platform they’re familiar with makes adding the new platform easier and faster. Plivo’s API, for instance, are designed to be familiar to developers who’ve worked with Twilio. We also provide comprehensive documentation with code examples for seven common web development languages.

The proof is in the pudding

We joined Fluent’s Sharita Passariello in a webinar in which she talked about how taking a multicloud approach helped her organization boost revenue. Watch it and consider whether the same approach could help your business.

More than most businesses, financial services providers such as banks, accountants, and wealth management and planning consultancies need to protect their own and their clients’ digital assets and grant access only to individuals who have the credentials to view and update them.

Best practices for security today call for two-factor authentication (2FA), which protects accounts from unauthorized data access by requiring a second form of identification in addition to usernames and passwords. That second factor can take several forms:

• Something a user knows, such as a password
• Something they have, such as a smartphone or a hardware authentication token
• Something they are, such as a biometric characteristic — fingerprint, faceprint, voice

Since you’re already asking for something they know — a password — you should, in addition, ask for one of the other factors. Which one?

The best second factor is something that most users will find easy to use and that doesn’t cost them any money they haven’t already spent. Consider something they have: More than 97% of Americans own a cellphone. That means you can send a one-time password (OTP) to their device and require them to enter it on a web form to unlock access to their data.

Many organizations use SMS to send OTPs, since text messaging is most people’s preferred communications channel. You should be prepared, though, to also send OTPs via voice call to meet the needs of customers who either lack a cellphone but do have a landline or who simply prefer voice communication.

Only someone with the user’s device, or more accurately their phone number, can successfully complete authentication with a one-time password, providing a strong measure of additional security.

Other options for 2FA

Alternatives for 2FA all have issues that make them less well suited for 2FA. Hardware tokens such as the Yubikey, for instance, are exceptionally secure, but they’re relatively expensive (especially compared to the zero added cost of a mobile phone) and easy to misplace. Biometric verification is hard to fool (but not impossible) but it requires hardware (such as a camera or fingerprint reader) that may not be available, along with software to verify the biometric measurement.

Finally, there’s the option to use a software authentication app, such as Google Authenticator. These apps run on smartphones and generate a numeric token that users have to enter to gain access to resources. Software on the server side, which runs the same algorithm as the authenticator app, checks that the number entered matches the expected number for the account. Authenticator apps are fine but somewhat complex. Rather than tap around to find the right app and the right account within the app, most people find it easier to have a unique code delivered right to them via text or voice message — and when you’re supporting thousands or millions of customers, ease of use means fewer support calls and lower costs.

Plivo’s SMS API and Voice API are excellent options for integrating OTPs into your existing applications. We’ve written use case guides on how to implement 2FA with Plivo APIs, either via .NET, Node.js, Ruby, Python, or PHP or by using PHLO, Plivo’s drag-and-drop low-code/no-code tool. See for yourself how easy it is to integrate Plivo APIs into your financial services applications — sign up for a free trial account.

Few people are as nervous as travelers. Imagine leaving the comfort of your pathogen-free home to strike out, maybe on your own, to a destination you may never have visited before. Everything along the way is calculated to make you nervous.

Suppose you call a cab or a ride-hailing service to take you on the first leg of your trip. Will the driver be talkative? Will he play music you hate? Are you rude if you ask him to turn it down because you have butterflies in your stomach? How much should you tip?

Or maybe you catch a local bus or subway train. Will it be on time? Will you be able to make your connection? Will you have a seat to yourself, or will you have to stand or sit next to someone who smells or whose crappy music you can hear just fine from their earbuds?

If your travel involves flying, oh, the headaches. In the US, TSA lines can be nearly empty or keep you waiting for an hour. Did you bring an ID, and is it an acceptable one? What items do you have to remove from your carry-on to be X-rayed? Will the screening machine’s radiation increase your risk of cancer? After you make it through the gate and put your shoes back on, will your flight leave on time?

And what about food and drink? Does your airline provide them or is it strictly no-frills? Do you have to pay a flight attendant if you’re starving? Or should you eat at an expensive airport restaurant before you get on the plane?

Finally you arrive safely. Will your friend at your destination meet you on time? How will they find you? Or do you have to find your way to your hotel on your own? Does your hotel have a free airport shuttle? What time is check-in — will your room be ready?

The stress involved in travel is enough to make anyone wonder why we ever leave home.

Helpful businesses stay in touch

If you manage a travel or hospitality business, such as an airline, hotel, or homeshare, providing answers to travelers’ anxious questions — sometime before they ask them — goes a long way toward improving their experience and elevating their satisfaction with your brand.

Nothing is better than text messaging to provide some comforting virtual hand-holding. By adding texting to your reservation system, you can keep in touch with customers at every stage of their journey — not the customer journey, mind you, but actual trips.

Travel businesses can let customers know that their transit is on time, or that, for instance, a flight’s gate has changed. Hotels can provide helpful tips on things like where to park and when the in-house restaurant closes. Homesharers can text the code for a lockbox that contains the keys for their visitors’ home away from home. Restaurants can confirm reservations and remind patrons about table times when a dining date arrives.

Booking with a dog? Text your hotel in advance to ask about dog friendly rooms. “Hello! Go for it! We are 100% Dog Friendly.”

Ready to pick up your car from the valet? “Flash Valet has received your request for ticket 117792. We will notify you when your vehicle is ready.”

It’s easy to add texting capabilities to an existing application. Plivo, a communications platform as a service (CPaaS), provides an SMS API that developers can call to send and track text messages. Texts go out over Plivo’s Premium Communications Network, a global network for reliable text delivery. It’s easy to get started — we offer a free trial. And if you’re already familiar with using an SMS API from another vendor, you’ll find Plivo’s API to be familiar and easy to use.