Real-World Example
Jane receives an email from ABC Collections with a link to review her account. She opens the Consumer Portal, enters her last name, date of birth, and the final four digits of her Social Security number, and reaches My Accounts only after the portal recognizes and verifies her.
First-Time Access
The consumer’s EcoAddress is established from their last name, date of birth, and last four digits of their Social Security number. The consumer confirms those details and completes a one-time passcode check by an approved email or mobile channel before protected account information is shown.
If the master EcoAddress already has a verified contact, the portal sends the code there and opens the OTP screen. If the master profile has no contact but linked accounts contain an email or mobile number, the portal shows up to one full email and one full mobile option. The consumer can choose one of those contacts or enter a different email or mobile number. Only the channel that receives a successfully verified code becomes part of the master profile.
If the consumer previously confirmed profile creation but left before entering a contact, the next login resumes at email or mobile entry. A profile that already has linked account records but no usable contact continues to show a safe recovery message.
The verified EcoAddress determines which offers, notices, agreements, payments, and communications belong to the consumer. Similar contact details alone must never grant access to another consumer’s activity.
Visual Flow
The master profile is the trusted contact record. Email and mobile numbers imported with individual accounts can help the consumer choose where to receive a code, but they are not master contact information yet. A creditor-provided or manually entered contact becomes trusted only after the consumer successfully verifies the code sent to it.
How It Should Work
- It should identify the consumer by last name, date of birth, last four SSN digits, and the matching master profile.
- It should require confirmation of the consumer’s EcoAddress during first-time access.
- It should let a consumer with no master contact choose an email or mobile found on their linked accounts.
- It should let that consumer enter a different email or mobile when they do not want to use a creditor-provided option.
- It should resume manual contact entry when a confirmed placeholder profile has no linked accounts or master contact.
- It should save the selected contact to the master profile only after successful OTP verification.
- It should send the consumer through verification before showing account details when verification is required.
- It should redirect an authenticated consumer to My Accounts.
- It should keep the login flow simple for consumers arriving from creditor communications.
How It Should Not Work
- It should not expose account balances, creditor names, notices, or payments before the consumer is verified.
- It should not save an imported account contact as the master profile contact before OTP verification.
- It should not treat a profile with existing or deleted linked accounts as an empty placeholder.
- It should not log a consumer into another consumer profile with similar contact details.
- It should not bypass signed-link or verification rules for convenience.
Last modified on August 15, 2026
