Automatically send SMS code during MFA login

Hi everyone,

Thank you for your detailed feedback on the login experience! Because this thread touches on a few different aspects of the Multi-Factor Authentication (MFA) process, we want to provide some clarity on why the system is built this way and share a tip to make your login much faster!

For the security of your account, MFA cannot be disabled. Because your Constant Contact account holds sensitive, personally identifiable data (PII) for thousands of your customers and subscribers, mandatory MFA is an industry-wide security requirement designed to prevent unauthorized access and data breaches.

While automatically sending the text code the moment you enter your password seems like a great time-saver, it is actually a major security vulnerability known as SMS Toll Fraud. If malicious bots find a login page that auto-triggers text messages, they can programmatically spam the login thousands of times a minute. This not only spams your phone with unrequested codes but is also used by hackers to siphon money from SMS gateways. Requiring a human to actively click the "Send Text" button acts as a critical safeguard against these automated bot attacks.

Additionally, many users have multiple MFA methods set up (such as an email backup). The system waits for your click so you can choose where you want the code sent!

If you hate waiting for the text message to arrive, we highly recommend switching your MFA method from SMS to an Authenticator App (like Google Authenticator, Microsoft Authenticator, or Authy).

• When using an Authenticator app, your phone generates the 6-digit code constantly in the background.

• When you log into Constant Contact, you don't need to click "Send Text" or wait for a cellular signal—you just open the app on your phone, type in the code that is already sitting on your screen, and you're in!