What is Out of Band Authentication?
Out‑of‑band (OOB) authentication verifies an action on a separate channel – approve a payment in your mobile app while surfing on a laptop, or approve a recovery request over a phone call with challenge‑response. Divorcing channels from each other foils many web‑only attacks and increases the price of credential theft.
Do it right: tie devices to accounts, detect SIM changes, and defend the OOB channel itself against malware and social engineering. Give users immediate context in your prompts – amount, payee, location – so they can instantly see when someone is trying to trick them. When value goes up or the context seems off, require stronger evidence.
