MFA login for storefront users

In recent times, we have observed a significant increase in bot activity and fraudulent card incidents occurring through guest checkout forms. This has resulted in several P1 cases involving our customers, such as Arbill, CPE Supply, HST and Macomb.

Currently, our system does not perform user verification for individuals utilizing the guest checkout feature. Given that Multi-Factor Authentication (MFA) has proven to be a robust security measure in mitigating spam logins, we recommend exploring the possibility of implementing an MFA/OTP/token validation mechanism for guest users' email addresses.

By incorporating this feature, we can significantly reduce the access of spam email logins associated with the guest checkout feature. Users would be required to validate their identity through OTP (One-Time Password) authentication, thereby enhancing the guest user security aspect of our Ecommerce platform.