{
  "id": "BRD-226",
  "slug": "brd-226",
  "title": "The 2FA PIN must be completed inside the vet's window",
  "statement": "The business contact must complete the Authentication+ 2FA PIN within 30 days of the vet being submitted, or the vet must be re-submitted.",
  "rationale": "The window belongs to the vet rather than to the email, and it runs whether or not anyone saw the message — so a vet ordered before a quiet period expires quietly, and the fee goes with it. Public companies, whose contact is usually a senior person with a filtered mailbox, are the ones this catches.",
  "layer": "BRAND",
  "layerSlug": "brand",
  "object": "the Authentication+ 2FA state",
  "severity": "BLOCKING",
  "detectability": [
    "UNDETECTABLE_PRE_SUBMISSION"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "TCR",
    "Twilio"
  ],
  "codes": [
    {
      "provider": "TCR",
      "code": "565",
      "remediable": true
    },
    {
      "provider": "Twilio",
      "code": "21737",
      "remediable": true
    }
  ],
  "applicability": {
    "entityTypes": [
      "PUBLIC_PROFIT"
    ]
  },
  "applicabilityText": "Applies when the brand is a public company.",
  "universal": false,
  "remediation": "Tell the named contact the mail is coming, before it is sent, and get their confirmation that they have completed the PIN. Track the 30-day deadline from the order date rather than from the mail date. Done when the brand reports Authentication+ active.",
  "notes": "The window is 30 days for the vet and 7 for the emailed link inside it (BRD-227); both are live and neither is visible to us. What the user has to do is own the deadline themselves — brief the contact before ordering, and chase inside the first week rather than the fourth.",
  "catalogIds": [
    "OPS-306"
  ],
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Has the named contact confirmed to you, in words, that they completed the PIN?",
    "howToCheck": [
      "Brief the contact before the vet is ordered, not after the mail is sent.",
      "Track the 30-day deadline from the order date, not from the mail date, and chase inside the first week rather than the fourth.",
      "Done when the brand itself reports Authentication+ active."
    ],
    "failureLooksLike": "A vet ordered before a quiet period expires quietly, taking the fee with it. The contact is usually a senior person with a filtered mailbox who never saw the message."
  },
  "url": "https://ekas.io/rules/10dlc/brand/brd-226/",
  "markdown": "https://ekas.io/rules/10dlc/brand/brd-226.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}