Once you've confirmed a recipient's mobile number (see confirming a recipient's mobile number), the rest of the process happens automatically — you don't need to do anything further.
What the recipient sees
- They get a notice, same as any first-time recipient, and register a passkey on their own device.
- Before anything unlocks, they're asked to confirm a one-time code sent by text message to the mobile number you vouched for.
- Once they've entered it correctly, the originally held attachment is delivered, and their account is fully verified from that point on.
Both steps — their passkey and the SMS code — have to succeed before the file unlocks. Neither one alone is enough: a stolen email session doesn't have their phone, and a stolen phone doesn't have their passkey.
After this first time
This whole process only happens once per recipient. Every attachment sent to them afterward — by you or anyone else in your organization — arrives and opens exactly like a normal delivery, with no SMS step to repeat. See what recipients see for what that looks like day to day, after this first-contact check is behind them.