Out-of-band Authentication

Applies to. PCI DSS v4.0.1 does not use the term. It comes up as one way of supplying a second factor for the multi-factor authentication Requirement 8 requires for access into the CDE and for remote network access from outside the entity's network: a code or approval prompt delivered to a separately enrolled device is a possession factor, provided the channel is independent of the session being authenticated, so a code sent to the device the user is logging in from adds nothing. The standard's conditions on the MFA system still apply, so the mechanism must resist replay and grant access only when all factors have succeeded; in general practice a code sent by SMS inherits the weaknesses of the phone network.