What Is OTP SMS? How Mobile Verification Works

An OTP SMS is a text message carrying a one-time password: a short random code that works once and expires within minutes. Mobile verification uses that code to show that someone controls a phone number right now. It proves access to the number, not who the person is.

This guide follows one code from your server to a handset, works out how many digits and tries you can safely allow, and explains why OTPs fail before they reach the handset. It ends with a decision map for choosing a channel and a checklist for choosing an OTP SMS service.

Note: Key takeaways

An OTP SMS shows control of a number at one moment. It does not establish identity, so don't treat it as KYC.

Your server makes the security decisions when you run verification yourself. It generates the code, limits the tries, and judges the answer, while the network only carries the text.

An OTP can fail well before the handset. Missing sender registration, template drift, the wrong category, or an unlisted URL can each stop a message.

SMS is the reach option, not the strongest one. Keep it for coverage, and offer a passkey or authenticator app where the risk justifies the enrolment.

What does OTP mean in an SMS?

OTP stands for one-time password, also written as one-time passcode. TRAI's regulations define it as an automatically generated random number that authenticates a user's action for one transaction or session. In practice, the SMS reads something like this:

Your Acme login code is 123456. It expires in 10 minutes. Do not share it with anyone.

The word "password" misleads. You never choose this code or memorise it, and it has no value once used.

Not every OTP is made the same way

The name covers three different mechanisms, and many explainers blur them. HOTP and TOTP are the two standard algorithms, and a texted code usually works differently from both. NIST treats a texted code as an out-of-band secret rather than an OTP authenticator, and the distinction changes your threat model.

Type	Where the code comes from	Shared in advance	Travels over the network
SMS OTP	Your server draws a random value for this one request	Only the phone number	Yes, in the SMS
HOTP (RFC 4226)	Secret key plus a moving counter	A secret key	No
TOTP (RFC 6238)	Secret key plus the current time, with a default 30-second step	A secret key	No

So the 30-second countdown belongs to authenticator apps. An SMS code lives as long as your server allows.

What does mobile verification actually prove?

Mobile verification proves that whoever typed the code could read a message sent to that number within your time limit. That is useful, and it is narrower than people assume. It says nothing about the person's legal name, and a number can move to a new SIM or a new owner.

Match the check to the question you are really asking:

Your question	Is SMS OTP enough?	What to add
Is this a working number the user can reach?	Usually yes	Format it in E.164 first
Is this the same person who owns the account?	Only for lower-risk accounts	A password, passkey, or device check
Did the customer approve this payment?	One factor at most	A second factor, as RBI's rules require
Is this person who they claim to be?	No	A KYC process with identity evidence

If you're in India, there is also a government route for the first question. The 2025 telecom cyber security amendment created a Mobile Number Validation platform that checks an identifier against operator subscriber records. Entities may be directed to use it or may seek permission. MediaNama reports that the final rules left fees to DoT's portal. We could not confirm a public launch date, so treat it as something to watch.

How does one OTP travel from request to approval?

Eight steps cross three parties. The two highlighted steps are where you win or lose on security.

At step 2, generate and store carefully. Draw the code from a cryptographically secure random generator. Don't keep codes in plaintext. Store a keyed hash with the expiry and try count. Use a server-side secret as the key, because a plain hash of six digits falls to anyone who tries all million values.

At step 4, expect store and forward. The SMS specification describes a service centre that holds a message and forwards it, keeping it for a validity period. A phone that was switched off can therefore receive your code long after it stopped working. The person then sees a correct-looking code that fails.

At step 5, read the receipt for what it is. It tells you the message arrived, which helps with fallback decisions. It tells you nothing about who read it.

At step 7, burn the code. A code must work once only. NIST SP 800-63B-4 is written for US federal systems, yet it is the most useful public benchmark here:

Accept a secret only once during its validity period.
Treat the authentication as invalid unless it completes within 10 minutes.
Use at least six decimal digits from an approved random generator.
Rate-limit failures on the account, and allow no more than 100 consecutive failures.
Don't reset the failure count when you issue a new code.

That last rule is the one teams miss. If a resend wipes the counter, an attacker simply requests new codes and keeps guessing.

How many digits and tries should you allow?

Tata Communications describes codes of four to six digits as usual. The gap between those two lengths is larger than it looks, because attackers rarely target one account. They try a guess or two across many numbers.

The arithmetic is simple. Expected successes equal numbers attacked, multiplied by tries allowed, divided by the possible codes. At five tries across 100,000 numbers, a 4-digit code gives about 50 breached accounts and a 6-digit code gives about 0.5.

NIST's 100-failure ceiling is an upper bound for a whole account, not a target. For an SMS flow, three to five tries per code is a sensible starting point, as long as the running count survives a resend. Limits per number alone won't catch this pattern, so also limit by IP address, device, and session.

Why does OTP SMS fail before the handset?

Many countries add a registration layer that most explainers skip. In the US, application-to-person texts from local numbers go through A2P 10DLC registration, and operators elsewhere filter unregistered traffic. If you're in India, TRAI requires commercial SMS to be traceable to a registered sender and template, and operators check each message against that record. An OTP that is perfect in your code can still stop here.

The checks that stop a compliant-looking message

The template must match. Where templates are registered, operators reject text that doesn't match. Vobiz's India DLT guide explains that a template fixes the wording and marks variable positions with {#var#}. Build the message from the same string you registered, so the two can't drift apart.

The category must be right. Some registries classify OTPs by purpose. In India, TRAI's Third Amendment of 18 September 2026 moves app login, password reset, and two-factor OTPs from transactional to service messages, which changes the header suffix from -T to -S. Ask your registration provider whether your templates and headers need to change.

Links and callback numbers must be listed. Carriers often filter texts that carry links. In India, TRAI's August 2024 direction told operators to refuse traffic with URLs, APKs, OTT links, or callback numbers that are not whitelisted. The simplest OTP template has no link at all.

The wording must fit your business. Regulators have flagged misuse of words like "OTP" in templates unrelated to a sender's business. Keep your entity name, header, and template recognisably connected.

A new SIM may not receive SMS yet. Some operators pause SMS after a SIM swap. TelecomTalk reported in November 2022 that India's DoT told operators to stop SMS on a swapped or replaced SIM for 24 hours. Either way, a real customer who just replaced a SIM may need another channel, and that same moment deserves more suspicion.

What should happen when the code doesn't arrive?

Users tap resend quickly, and each tap costs money and adds risk. Decide in advance how you'll respond to each signal. The timer below is our suggested starting point, so tune it against your own delivery data.

Signal	What it means	What to do
Send returns 502 or 503	No message was created, or a temporary fault	Retry with the same idempotency key
Status failed	The network refused or lost it	Read the error, and offer another channel
No receipt after about 30 seconds	Slow or lost	Enable the resend button
The user taps resend	A new send, not a retry	Use a new key, and keep the failure count
A second send fails	This route isn't working for this person	Offer a voice call or WhatsApp

Resends raise one design choice. You can issue a new code and cancel the old one. This limits the number of valid values. The catch is that a delayed first message then fails when typed. You can instead resend the same code with its original expiry, which forgives out-of-order delivery. We'd rotate codes on login and payment flows, and tell the user that only the latest code works.

Keep the text short and in a predictable alphabet. Per the Vobiz SMS guide, one GSM-7 segment holds 160 characters, while any character outside that alphabet switches the whole text to UCS-2 at 70. Our sample above has 86 characters. A Hindi template of that length takes two segments, so it costs more and has more parts to reassemble.

You can also remove typing altogether:

Android: the SMS Retriever API reads the code automatically when the message contains your app hash.
Web forms: the one-time-code value of the autocomplete attribute tells browsers what the field expects.
Origin-bound codes: the WebOTP draft ends a message with your domain and code, so the browser can tie the code to your site. MDN marks the API as experimental and not widely available, so treat it as an enhancement.

How secure is OTP SMS?

It is secure enough for many jobs and not for all of them. The honest picture is that each attack targets a different step, so each needs a different control.

Attack	How it works	What reduces it
SIM swap	An attacker convinces the operator to move the number to a new SIM	Watch for number changes, and require a stronger factor for sensitive changes
Real-time phishing	A reverse-proxy site asks for the code and replays it on the real one	State the service and action in the text, and offer passkeys
Network interception	SMS is not encrypted, so someone inside a telecom network can read it	Avoid SMS for your most-targeted accounts
Guessing	Automated tries across many numbers	Six or more digits, and limits that survive a resend
SMS pumping	Fraudsters trigger codes to number ranges that earn them a revenue share	Rate limits, country allowlists, and spend alerts

The sign to monitor is a spike to adjacent numbers with no completed verifications. Compare codes sent against codes verified, by country and number range. Spending thresholds also help on costly routes.

What regulators actually say

These three positions are often flattened into "SMS OTP is banned" or "SMS OTP is fine". Neither is accurate.

RBI (India): its authentication directions, with compliance due by 1 April 2026, require two distinct factors for domestic digital payments unless exempted. They list SMS-based OTP among the possible factors and open the way to alternatives. Outside card-present payments, one factor must be unique to the transaction. If non-compliance causes a loss, the issuer compensates the customer in full.
NIST (US): SP 800-63B-4 restricts phone-network delivery rather than prohibiting it. An organisation that accepts phone-network delivery must assess the risk, offer an unrestricted alternative, tell users about the risks, and plan a migration.
CISA (US): its December 2024 guidance tells highly targeted individuals not to use SMS as a second factor. CISA says the guidance applies to all audiences, though it is aimed at that group.

You may read that India is phasing out SMS authentication entirely. The RBI text doesn't say that. It sets principles and lets issuers offer a choice of factors.

Which channel should you use for verification?

Start from what the moment needs, not from what is cheapest to send.

Channel	Works best when	Limits to plan around
SMS OTP	You need coverage with no app or data connection	The risks above, plus sender registration, such as 10DLC in the US or DLT in India
Voice OTP	SMS failed, or the person prefers to listen	Codes are heard rather than copied, and call rules apply
WhatsApp	Your users already live in the app	Needs an authentication template with preset text
RCS	Recipients have RCS enabled	Check reachability first, and set an SMS fallback
Authenticator app (TOTP)	Returning users who will enrol	Setup effort, and still phishable
Passkey or FIDO key	High-value accounts	Enrolment and recovery design

Local rules can add reasons to review app-based channels. India's DoT, for example, in its November 2025 directions, told major messaging apps to keep accounts continuously linked to the active SIM. The release describes this as already standard in banking and UPI systems. The original window was 90 days, and the minister's April 2026 reply to Parliament set the compliance date as 31 December 2026.

What should you look for in an OTP SMS service?

Compare providers on how they behave when a code is in trouble, not on the happy path. Ask these questions before you commit:

Sender registration: can you pass your registration IDs, such as India's DLT entity, header, and template IDs, on every message, and who enables your sender?
Delivery truth: do you get separate statuses for accepted, delivered, and failed, with an error reason?
Safe retries: can a retry reuse an idempotency key, so a timeout doesn't send and bill twice?
Signed webhooks (callbacks): can you verify that a receipt really came from the provider?
Cost visibility: can you see segments and price before sending a new template?
Fallback channels: can you reach the same person by voice, WhatsApp, or RCS through one account?
Your own measurements: test each route with real handsets on each operator you care about. Published delivery claims can't tell you about your traffic.
Who owns the logic: does the provider verify codes for you, or does your server? Each model works. Make sure you know where the limits and audit trail live.

How Vobiz handles OTP delivery

Vobiz is the delivery layer in this design, across several channels. Your server generates, stores, and checks the code, and Vobiz carries the message and reports what happened.

SMS. You send through the Vobiz Messaging API using Send a message. For Indian numbers, you pass your DLT entity, header, and template IDs, and your registered header is the sender. Indian traffic uses DLT sender IDs rather than long codes, and support enables your header on your account. Registration itself happens on a DLT portal.

Retries. An idempotency key returns the original message instead of sending again, whatever the first attempt's outcome. That is why a user-requested resend needs a new key. A message tag lets you filter this traffic later.

Delivery status. A sent status means the network accepted the message, and a delivered status means a delivery receipt came back. Webhooks (callbacks) fire on delivery and on failure and are signed, so your fallback logic doesn't need to poll.

Cost before sending. Cost preview returns the segment count and price for a text without sending it. For current rates, see the Vobiz pricing page.

Opt-outs. A number that replied STOP is on your opt-out list, and sends to it return 422. Handle this in your login flow, because that person may still need a code. Offer another channel, and confirm consent before you remove an entry.

Other channels. WhatsApp templates include an AUTHENTICATION category for codes. The OTP call example uses VobizXML to read a code aloud digit by digit, and the Vobiz DLT guide lists the 160 series for OTP calls in India.

Warning:
Every send texts or calls a real person and is billed. Run examples only with your own Auth ID and Auth Token, against numbers you have permission to contact, and after you confirm the destination.

Frequently asked questions

What does OTP mean in an SMS?

OTP stands for one-time password. In an SMS, it is a short numeric code that a service generates for one action and texts to your phone. You type it back to continue. It stops working after one use or when its time limit passes.

How long is an OTP valid?

The sender sets the limit, so it varies by service. Many use a few minutes. NIST's digital identity guidelines treat out-of-band authentication as invalid unless it completes within 10 minutes, which makes 10 minutes a sensible ceiling. Payment and account-recovery flows usually justify something shorter.

Why am I not receiving my OTP SMS?

As a user, check signal, a recent SIM replacement, and your spam filter, then request one new code. As a sender, check your sender registration, the template match, the message category, and any URL in the text. Your delivery report usually tells you which stage failed.

Is OTP SMS safe?

It adds real protection over a password alone, and it is weaker than a passkey. SMS is not encrypted, and a code can be phished or redirected through a SIM swap. Use it for reach, then offer stronger methods for accounts and actions worth attacking.

Is OTP SMS transactional or service?

It depends on purpose and country. In India, TRAI's September 2026 amendment moves OTPs for app login, password reset, and two-factor authentication into service messages, while OTPs tied to customer-initiated transactions remain transactional. Those changes start after Gazette publication, so confirm the current position with your DLT operator before changing headers.

What is the difference between OTP and two-factor authentication?

Two-factor authentication is the requirement: two separate kinds of proof. An OTP is one possible proof, showing you hold a device or number. An SMS OTP used alone is one factor. It becomes two-factor only when paired with something else, such as a password or fingerprint.