Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:3
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 3
Character Range: 76331–78513

3                                  If the out-of-band device sends an approval message over the secondary communication channel, rather than by the individual transferring a received secret to the primary communication channel, the device:   1.      must accept transfer of the secret from the primary channel, which secret must be sent to the entity's information technology system over the secondary channel to associate the approval with the authentication transaction; or
                                                                                                                                                                                                                                                  1.     must:
                                                                                                                                                                                                                                                      (i) present a secret received via the secondary channel from the entity's information technology system;
                                                                                                                                                                                                                                                           Example: The individual may perform the transfer manually or use a technology such as a barcode or QR code to affect the transfer.
                                                                                                                                                                                                                                                      (ii) prompt the individual to verify the consistency of that secret with the primary channel, before accepting a yes/no response from the individual; and
                                                                                                                                                                                                                                                      (iii) send that response to the entity's information technology system.