Both send a short code the user types back. They differ on cost, setup, delivery and what an attacker needs to steal one.
Side by side
| SMS OTP | Email OTP | |
|---|---|---|
| Cost each in India | About Rs 0.13 to Rs 0.25 | A few paise to send; Rs 0.025 on SignOps |
| Setup | DLT entity, header and template registration | A verified sending domain (SPF, DKIM, DMARC) |
| Proves | The user has the phone number | The user has the inbox |
| Delivery | Usually seconds; can fail on weak signal or DND issues | Usually seconds; can land in spam if the domain is not set up |
| SIM swap risk | Yes | No |
| Phishing risk | Yes, users read codes out to callers | Yes |
| Works without a phone | No | Yes, on any device with email |
When SMS is the right choice
- You need to prove a phone number, for example for a delivery or payments app, or for KYC.
- Your users may not use email much.
Even then, you usually need it once per user, at signup.
When email is the right choice
- Logins for web apps and SaaS, where users already sign up with email.
- You want to avoid DLT registration and template approval.
- Cost matters at volume: 1 lakh logins a month cost about Rs 17,000 by SMS at Rs 0.17 and about Rs 2,500 by email at Rs 0.025. The OTP cost calculator works it out for your own numbers.
Better than both for returning users
Codes of either kind can be phished. For users who already signed in on a phone:
- Push approval: the phone shows who is signing in and asks for a number match and Face ID. Nothing to read out.
- Passkeys: a fingerprint or screen lock, and nothing to phish at all.
A sensible flow: SMS or email once at signup, then passkeys or push approval for logins, with email codes as the fallback. See passkeys vs OTP and SMS OTP cost in India.
FAQ
Is email OTP more secure than SMS OTP?
It avoids SIM swap and SMS interception, but anyone with access to the inbox can read it, and both can be phished. Neither is as strong as a passkey or a signed push approval.
Which is cheaper in India, email or SMS OTP?
Email. An SMS OTP costs about Rs 0.13 to Rs 0.25 from Indian providers and needs DLT registration; an email code costs a few paise to send, and Rs 0.025 on SignOps.
Do I need DLT for email OTP?
No. DLT applies to commercial SMS in India. Email codes need a verified sending domain instead.
First published on signops.dev.
