Malicious actors sometimes request Short Message Service (SMS) codes for Multi-Factor Authentication (MFA) to be sent to specific phone numbers. Administrators can prevent Auth0 from sending these messages by configuring a custom Phone Message Action that checks the recipient against a hard-coded list of blocked numbers.

• Auth0
• Short Message Service (SMS) Multi-Factor Authentication (MFA)
• Phone Message Actions

How is a Phone Message Action configured to block specific phone numbers?

Set the MFA delivery mechanism to a custom configuration and implement a Phone Message Action to check the recipient number before sending the text to the SMS provider.

1. Set the MFA delivery mechanism in Auth0 to Custom.
2. Navigate to Actions > Triggers > MFA Notifications > Send-Phone-Message.
3. Add an if condition at the top of the script that checks the recipient number and returns prematurely before sending the text to the SMS provider.

Store the list of blocked phone numbers as a hard-coded array and use a regular expression to remove whitespace from the recipient variable before evaluating the condition.

exports.onExecuteSendPhoneMessage = async (event) => {
  const recipient = event.message_options.recipient;
  const BLOCKED_NUMBERS = [ "+1234567890" ];
  if (BLOCKED_NUMBERS.includes(recipient.replace(/\s/g, ""))) {
    return;
  }
  // ... rest of the code to send the SMS
}

NOTE: The event.message_options.recipient variable requires a method to remove any whitespace from the phone number string. The phone number string returned by the variable contains a space that is visible in Universal Login and the Actions Logs if the property is output to the console during the SMS MFA flow.

Review the following screenshots for visual guidance on the space that becomes apparent in the Universal Login and Actions Logs.

The example onExecuteSendPhoneMessage() above uses a regular expression to trim the space, but any method to remove the space suffices. Removing the space this way allows readable numbers to be stored in the BLOCKED_NUMBERS array and prevents human error when listing the phone numbers to block.

How is the Unified Phone Provider configured to block specific phone numbers?

If the tenant has the Unified Phone Provider active, Auth0 bypasses the legacy Send-Phone-Message trigger. Configure a Custom Phone Provider Action by navigating to Actions > Triggers > Custom Phone Provider and adhering to the following property rules.

• Do not use event.user.phone_number because the number is transaction-scoped and Auth0 has not yet saved it to the user record.
• Use event.notification.recipient instead because this property contains the destination E.164 phone number.

Configure the Custom Phone Provider Action to strip whitespace and check against the blocklist using the following code snippet.

exports.onExecuteCustomPhoneProvider = async (event, api) => {
  const recipient = event.notification.recipient ?? "";
  const BLOCKED_NUMBERS = [ "+1234567890" ];
  // Strip whitespace and check against the blocklist
  if (BLOCKED_NUMBERS.includes(recipient.replace(/\s/g, ""))) {
    throw new Error("Phone number is blocked from receiving SMS MFA.");
  }
  // ... rest of the custom code to dispatch the SMS via the provider
}

Related References

• MFA Notifications Triggers