The Ministry of Digital Development is considering abandoning the restoration of access to an account on the "Gosuslugi" portal using SMS codes, as this method is often used by fraudsters. This was stated by the Minister of Digital Development Maksut Shadaev.
According to him, the use of codes from SMS today poses a serious threat to user security.
The position of the Ministry of Digital Development as a technical regulator is that any code that comes in an SMS is now evil. It is clear that this is the main transmitted factor that allows fraudsters to gain access to the account
As alternatives, the minister suggested several solutions. Among them are identity verification through a personal visit to the MFC, the use of biometrics, as well as banking applications as a second factor in confirming actions on the portal.
Shadaev recalled that it is already possible to confirm an account on "Gosuslugi" using a banking application, without visiting the MFC.
The creation of an OTP application was named as a key area - a program that will generate one-time passwords without the need to receive a code via SMS. Such tokens are generated in a hardware manner and provide a higher level of security. Access recovery through the MFC and other methods will remain voluntary.
The department later clarified that the Ministry of Digital Development has no plans to make biometrics mandatory when using "Gosuslugi"
Read more materials on the topic:
Ministry of Digital Development warns: fraudsters send SMS about logging into the Gosuslugi account
Fraudsters send fake SMS about "hacking" on "Gosuslugi": how to recognize deception