I need to send a user a link via SMS that when clicked, and then when some demographic info is verified, will allow them to sign up for my service (which is a healthcare portal, so HIPAA/PCI/PII etc).
Once the link is clicked the code will appear on the web page in plain text.
I'm telling the busines that I want to encode the code in the link that will be in the text msg since it is technically sensitive. However, I am not sure that I really know why I am suggesting it, especially since the code will be output in plain text when the link is clicked. So I am having trouble making my case. If someone intercepts the link and clicks it, they have the code.
If the phone is stolen the user will be SOL so I can't worry about that. I suppose I am mostly protecting against the phone company or anyone else the code passes through on its way to the phone.
The code does expire after a certain amount of time.
Should I bother encoding it? Is the real problem showing the code on the page--if I don't do that, does encoding make sense?