AARP ASKING FOR OUR PHONE NUMBER WHEN SIGNING IN

[r447879w]

WHY IS AARP ASKING FOR OUR PHONE NUMBER WHEN WE SIGN IN? I HAVE BEEN AN AARP MEMBER FOR MANY YEARS NOW AND NEVER ASKED TO GIVE MY PHONE NUMBER WHICH I DID NOT GIVE. 

[MidlandJack]

As a cyber security professional, I can assure you folks it will only be a matter of time before AARP announces "Oooops, sorry, our systems were hacked and all your personal information was stolen, including name, address, DOB, and guess what, your cell phone number".  C'mon AARP, you don't need our phone number.  Many sites authenticate to email.   But that's okay, we members with our lawyers will pounce on you when you get hacked.

[RayG589555]

I agree 1,000%. They don't need our phone number, and neither do any non-financial websites. As a former software consultant, I would've advised against this method from the gate. I would've jumped up during the meeting and said, "Wait. This is ludicrous! Whose bright idea was this? Off with your head." 😂

[LawrenceM351419]

Agree.  AARP MODERATORS, are you even reading this stuff?

Yes, two-factor authentication is a good idea.  Restricting 2FA to only text messages is REALLY CLUELESS; I may drop my membership if you go through with such an ignorant and user-hostile policy.

You have our emails, give us the option of receiving 2FA confirmation messages via that medium.  Most banking institutions I deal with (who are way higher-risk environments than AARP) provide that option, you need to pay attention to best practices.

[RayG589555]

I, too, am concerned about this world-wide attempt to get our personal cell phone numbers for authentication. I do NOT trust it, none of these companies help pay my phone bill, and they should not take liberties to text me or anything else. It's nobody's business what my phone number is, and I object strongly to this grab for people's personal information they are not paying for. I am a former software consultant, and I know what this is. STOP BEING SHEEP, AARP! Just because everybody and their mother is doing this, doesn't mean you have to as well.

[lloydkg]

I actually don't have a problem with this multi-factor authentification.  HOWEVER, I have tried entering my cell phone # countless times, and it says the number is "not eligible", even though it is the same number listed in my AARP account!  So I keep hitting "not now" but am afraid for when it starts requiring the authentification.  I am using Firefox, and I noticed that JodeeR from AARP said to use Chrome.  Is this the problem?  I don't have Chrome installed and would rather not install another browser on my Mac.  Please advise.

[lloydkg]

Thanks for your reply.  Okay, I had to educate myself as to what a VOIP phone was.  I get my cellphone service through Republic and evidently it is indeed considered a VOIP service.  I could alternately provide our landline #, but this is a FIOS "landline" and is thus also VOIP.  And I'm not always at home anyway, but would usually have my cell phone with me.  Honestly, I'm thinking that most people's phones nowadays are VOIP phones.  Will there be an alternate way (email would definitely work for me) to authenticate?

[AARPJanelleM]

@lloydkg You're welcome! I sent you a private message so that I can obtain the information to take the next step to get your account authenticated. If you are unsure how to access your private messages in our community, steps can be found here: https://community.aarp.org/t5/Technology/How-do-I-send-a-private-message/ta-p/2185159 I look forward to speaking with you further!

[AARPJanelleM]

@lloydkg Is your phone # associated with a VOIP phone? Oftentimes that error message will appear if you are attempting to use a VOIP phone to complete the authentication. This phone type is not supported and we suggest using a different phone number, if possible. 

[fischerdf]

@AARPJanelleM I've had this same problem with trying to use my VOIP number. I have no other alternative. It's very shortsighted and even prejudiced on the part of AARP. Why should I have to pay for a landline or cell phone when I can get VOIP for free? I've written to AARP and received no response. Is there any possibility of changing this? I won't be able to access my account once a phone number is mandatory.

[AARPJanelleM]

@fischerdf The account can still be authenticated when you have a VOIP phone, it's just a slightly different process. When you have a moment, please give us a call at 1-866-451-6305 to complete this step. 

[STLmember]

So, let me translate what you said:

Dear senior, you may be on a fixed income, and not able to buy a separate phone that will actually allow you to access the AARP website at all times, but that's not our problem. We are not adding an "obtain-access-code-via-email" option. So stop whining.

Got it, AARPJanelleM. 

[AARPJanelleM]

@STLmember Absolutely not. We are always here to help and there are steps that can be taken to manually authenticate the account if the user does not have access to a non-VOIP phone. I'm always here to help, let me know if there is anything I can do!

[fischerdf]

@AARPJanelleM Well, I called AARP customer service when this first happened and there was no way they could verify my account without a cell phone or landline; no email verification was available. So, what method of manual authentication are you referring to that would allow me to access the website once phone numbers are mandatory? And how do you 'manually verify' when the call center isn't always available?

[STLmember]

Great!  I don't have a phone available all the time, so provide seniors like me the ability to receive our multi-factor authentication code via our email address, which you have on file.  This is a common option for other organizations. It will solve the problems. 

OR:  Send me an acceptable cell phone, already set up with an ongoing cell plan, at AARP's expense, so I can supply a phone number to access the AARP site. Because I'm on a tight budget.

You're supposed to be advocating for seniors, not making it impossible for many of us to access information we are paying AARP to provide. Are seniors no longer your priority?

[fischerdf]

My feelings exactly. Banks use email authentication so why does AARP think it's not secure enough?

[takncarabizniz]

I just click the "not now" at the bottom

[RayG589555]

"Not now" will go away, and it will be an absolute requirement to use a phone to get in here. It happened with some other websites I frequent, and I ended up closing those accounts. Others that require it, I just don't sign up. Trust and believe, they're strong-arming their new toy into existence. ALL.OF.THEM!

This place is not a financial institution and there's not much damage one can do if they had my account. What? Order stuff I didn't sign up for? I don't believe this is the reason AARP is doing this. They're just following orders from above, and notice the AARP moderator in here isn't addressing our complaints. Interesting.

[STLmember]

But you realize that one day you will have no choice. This means you must not only provide your phone number, but you must always have your phone handy when accessing the AARP website. If you're accessing via cell phone, that may not be an issue for you. I use a PC. This means that I must always have my phone available in order to access the site. If I don't have access to my phone (which is sometimes the case), I won't be able to access the site. I don't think AARP has really thought this through.

[RayG589555]

It's happening all over the country, probably driven by Google or Microsoft, and is a violation of my privacy. It's even worse during the voting season when they list your phone number publicly and everybody has access to it.  Drives me crazy.  But, these websites should not be taking liberties with our phone numbers, just because they're using some high-level authentication method requiring it. Consumers have no rights anymore, and can't stop these things. Then I would want my money back and never to rejoin AARP again.  Nobody is thinking this through; they're just following the leader; whoever that is.

[AARPJodeeR]

@r447879w  AARP.org and AARP Rewards utilize multi-factor authentication to protect your online account and it went into effect in December/2019. The prompt appears when you first sign up for AARP Rewards, or attempt to make any changes to your aarp.org account. You can choose to bypass this feature at this time, but eventually you will be required to complete this verification. Please use Google Chrome to complete the verification process. You will be prompted to verify your identity by receiving a six digit code by text or automated phone call. You may use a landline OR a cell phone and this phone number is saved for future authentication requests. 
 

[km42814019]

this thread ends in 2020.  what is / are the current alternatives in 2023

if one only has a voip phone?  is calling 866-451-6305 really a fruitful exercise?

[AARPJanelleM]

@km42814019 Voice Over IP (VOIP) numbers are not supported. If a user does not have another phone number available, we ask that they please call 1-866-839-0463 for further assistance with getting the account authenticated. 

[fischerdf]

Calling customer service provides no assistance; they just say that they don't support VOIP. AARP posted an article encouraging members to get free VOIP numbers; what a hypocritical post! AARP needs to start accepting VOIP numbers or stop asking for phone verification.

[AARPJanelleM]

@fischerdf Calling customer service would result in an escalation being created in order to get the account authenticated. 

[km42814019]

Thx for your reply!  is one supposed to call every time one logs into aarp? how does a manual 2fa/mfa work exactly? does an aarp staff member send a text to the voip phone while one is calling aarp on that voip phone?

[AARPJanelleM]

@km42814019 You're welcome! No, one will not have to call every time to login. The voip authentication escalations are assigned to a designated team and I'm not familiar with the steps they take to handle the escalations.

[km42814019]

Thanks!

[AARPJanelleM]

@km42814019 You're welcome! 

[MidlandJack]

@AARPJodeeRyou forget that Facebook in 2018 required their users to provide phone numbers to perform 2FA...  and betrayed that trust by using the user's phone number to target them with ads.   After a year of this betrayal of trust, at the end of 2019 Facebook announced it would stop using the provided phone number for suggesting friends and targeting of ads.    So blame FB, we don't trust any organization that says "trust us, we will only use the phone number for verification"...    So between hackers and mistrust, we don't want to provide a number.   Please find another solution.