ASVS V6.3.6 requires that email is not used as either a single factor or a multi factor authentication mechanism. It is a Level 3 requirement.
Email can still be used to communicate, to verify ownership at signup and to start recovery under proper controls, but at this level a code or link in an inbox must not count as a factor to sign in.
Level 3 is for applications that need a very high assurance of identity. At this level the weaknesses of email as a factor outweigh its convenience.
Why it matters
Mailboxes are protected by weaker controls than the accounts they guard, are forwarded, shared, synced to many devices and often accessible to anyone who owns the mailbox account. Magic links also sit in browser history and logs.
A mailbox may be protected by nothing more than a password, and many people leave their inbox open on a phone, a laptop and a work computer. Anyone who takes over the mailbox can take over every account that trusts it. Email is also routable through multiple servers, so messages can be read in transit or stored in plaintext by intermediaries.
Magic links add other issues: scanners that pre fetch URLs can consume them, and they linger in browser history and server logs.
How to implement it
Use factors with stronger guarantees: passkeys, FIDO keys or an authenticator app. If you offer passwordless sign in, base it on WebAuthn instead of an emailed link.
Sign in options at Level 3
- Passkey (WebAuthn) allowed
- Hardware key allowed
- TOTP app allowed as second factor
- Email code or link not allowed as a factor
Document where email is still used, such as notifications and initial address verification.
Offer passkeys as the main passwordless path, since they are bound to the legitimate site and resist phishing. Keep TOTP for those who cannot use passkeys. For recovery, use a process that does not rely on one email alone: backup codes stored by the user, a second registered authenticator, or a support process with identity proofing and a delay. Keep email for notices, which also satisfies V6.3.5 and V6.3.7.
How to test it
Review every login and step up path. Try to complete sign in using only a code sent to email. It must fail. Check recovery too: a link in email should not alone bypass MFA.
Common mistakes
-
Magic link login labeled as passwordless security.
-
Email OTP as a second factor.
-
Recovery that downgrades to email only.
-
Treating an email link as the second factor after the password.
-
Letting email recovery remove the registered security key silently.
Quick check
Is verifying an email at signup a violation?
No. It proves address ownership. It just cannot be the authentication factor.
