|Issue||When a FI has chosen to have multiple authentication methods. (ie; Challenge questions, then OOB SMS method) The first challenge method will be attempted. (in the example case challenge questions) If there are no challenge questions available to ask, then it will attempt the OOB SMS method. |
It does NOT mean that it will attempt the second method if the first method is used and the user fails the challenge. In this example, if the user fails the challenge questions, the authentication will fail and the user will not be allowed to login in, the OOB SMS will never be used.