The Equity Problem in Mandatory Two-Step Verification: A Socio-Technical Critique of Authentication…

Introduction

Two-step verification (2SV), also known as multi-factor authentication (MFA), is widely promoted as a security enhancement for digital accounts. It typically requires users to confirm their identity through a secondary channel such as SMS, email, or authentication applications.

While 2SV is effective in reducing unauthorized access, this Article argues that mandatory implementation without alternative pathways can create structural inequities that disproportionately burden low-income users and users with limited device or connectivity access.

⸻

I. Security as a Baseline Constraint, Not a Neutral Feature

At the systems level, authentication mechanisms are designed to reduce unauthorized access risk. However, they also introduce access friction costs, including:

• Requirement for secondary devices
• • Dependence on stable network connectivity
• • Access to consistent cellular service or smartphone functionality
• • Ability to maintain updated authentication applications

These requirements assume a baseline level of technological stability that is not universally distributed across user populations.

⸻

II. The Hidden Dependency Structure of 2SV

Although 2SV is often presented as a universal security improvement, it implicitly depends on several infrastructural conditions:

• Continuous access to a functioning mobile device
• • Reliable SMS or data connectivity
• • Financial capacity to maintain active service plans
• • Device redundancy in case of loss, theft, or damage

For users without stable access to these conditions, authentication becomes not merely a security step, but a potential barrier to account access itself.

⸻

III. Disparate Impact and Functional Exclusion

The core equity concern arises from the fact that authentication failures do not distribute evenly across populations.

Users with limited income are more likely to experience:

• Prepaid or interrupted mobile service
• • Single-device dependency without backup authentication channels
• • Limited access to recovery tools or support infrastructure

When authentication systems rely heavily on continuous device availability, they risk creating a condition where security mechanisms double as exclusion mechanisms.

This produces a structural asymmetry: those least able to absorb access disruptions are the most vulnerable to permanent or semi-permanent account lockout.

⸻

IV. Security vs. Accessibility: A False Binary

The dominant framing often treats security and accessibility as competing objectives. However, this is a design constraint, not an inevitability.

Alternative authentication architectures include:

• Multi-channel verification options (email, hardware keys, offline codes)
• • Graceful degradation authentication (lower security thresholds with increased monitoring rather than full denial of access)
• • Tiered authentication requirements based on risk level rather than uniform enforcement
• • Offline recovery mechanisms not dependent on real-time connectivity

These approaches demonstrate that high security and inclusive access are not mutually exclusive design goals.

⸻

V. Systemic Risk Transfer

Mandatory 2SV shifts certain risks away from platforms and toward users:

• Platforms reduce account takeover liability
• • Users absorb lockout risk due to device loss or connectivity failure
• • Recovery burdens are often time-consuming and opaque

In economic terms, this represents a risk transfer from institutional actors to end users, with disproportionate impact on users with lower financial resilience.

⸻

VI. The Authentication Access Paradox

A key structural issue emerges:

The stronger the authentication requirement, the higher the probability of legitimate users being denied access under real-world constraints.

This creates a paradox where systems designed to increase trust simultaneously increase the likelihood of false negative authentication outcomes (legitimate users being blocked).

From a systems perspective, this is not merely a technical tradeoff but a distributional problem in access reliability.

⸻

VII. Toward Inclusive Authentication Design

A more equitable authentication framework would incorporate:

1. Redundant Authentication Pathways

Multiple independent verification options that do not rely on a single device or carrier.

2. Offline Recovery Credentials

Secure, user-held recovery mechanisms not dependent on live network access.

3. Risk-Based Authentication Scaling

Higher security requirements only when behavioral or contextual risk signals are elevated.

4. Mandatory Access Continuity Standards

Platforms must guarantee account recovery pathways that do not require possession of a single compromised or lost device.

⸻

Conclusion

Two-step verification is a valuable security innovation, but its mandatory, uniform application can produce structural inequities when implemented without regard for access variability.

This Article argues that authentication systems should be evaluated not only on their ability to prevent unauthorized access, but also on their capacity to ensure consistent, equitable access for legitimate users across diverse economic and infrastructural conditions.

Security design, in this framing, is not solely about preventing intrusion — it is also about ensuring that protection mechanisms do not unintentionally become barriers to participation in essential digital systems.

⸻

Footnotes

1. NIST, Digital Identity Guidelines (SP 800–63B) (2020).
2. 2. Cormac Herley, "So Long, and No Thanks for the Externalities," IEEE Security & Privacy (2009).
3. 3. U.S. Federal Trade Commission, Consumer Data Security Guidance (2021).
4. 4. European Union Agency for Cybersecurity (ENISA), Authentication Methods and Best Practices (2022).
5. 5. Ross Anderson, Security Engineering (3d ed. 2020).