Skip to main content
November 3, 2026 · By Piyush Sahoo An OTP SMS is a text message carrying a one-time password: a short random code that works once and expires within minutes. Mobile verification uses that code to show that someone controls a phone number right now. It proves access to the number, not who the person is. This guide follows one code from your server to a handset, works out how many digits and tries you can safely allow, and explains why OTPs fail on Indian routes. It ends with a decision map for choosing a channel and a checklist for choosing an OTP SMS service.
Key takeaways
  • An OTP SMS shows control of a number at one moment. It does not establish identity, so don’t treat it as KYC.
  • Your server makes the security decisions when you run verification yourself. It generates the code, limits the tries, and judges the answer, while the network only carries the text.
  • In India, an OTP can fail well before the handset. Template drift, the wrong header category, or an unlisted URL can each stop a message.
  • TRAI has reclassified login OTPs. Its September 2026 amendment moves app login, password reset, and two-factor OTPs from transactional to service messages.
  • SMS is the reach option, not the strongest one. Keep it for coverage, and offer a passkey or authenticator app where the risk justifies the enrolment.

​
What does OTP mean in an SMS?

OTP stands for one-time password, also written as one-time passcode. TRAI’s regulations define it as an automatically generated random number that authenticates a user’s action for one transaction or session. In practice, the SMS reads something like this:
Your Acme login code is 123456. It expires in 10 minutes. Do not share it with anyone.
The word “password” misleads. You never choose this code or memorise it, and it has no value once used.

​
Not every OTP is made the same way

The name covers three different mechanisms, and many explainers blur them. HOTP and TOTP are the two standard algorithms, and a texted code usually works differently from both. NIST treats a texted code as an out-of-band secret rather than an OTP authenticator, and the distinction changes your threat model. So the 30-second countdown belongs to authenticator apps. An SMS code lives as long as your server allows.

​
What does mobile verification actually prove?

Mobile verification proves that whoever typed the code could read a message sent to that number within your time limit. That is useful, and it is narrower than people assume. It says nothing about the person’s legal name, and a number can move to a new SIM or a new owner. Match the check to the question you are really asking: For Indian businesses, there is also a government route for the first question. The 2025 telecom cyber security amendment created a Mobile Number Validation platform that checks an identifier against operator subscriber records. Entities may be directed to use it or may seek permission. MediaNama reports that the final rules left fees to DoT’s portal. We could not confirm a public launch date, so treat it as something to watch.

​
How does one OTP travel from request to approval?

Eight steps cross three parties. The two highlighted steps are where you win or lose on security. Sequence of one SMS OTP across the person, your server, and the provider and operators: request, code generation with a stored hash, templated send, delivery, delivery receipt, code entry, hash check, and approval. Sequence of one SMS OTP across the person, your server, and the provider and operators: request, code generation with a stored hash, templated send, delivery, delivery receipt, code entry, hash check, and approval. At step 2, generate and store carefully. Draw the code from a cryptographically secure random generator. Don’t keep codes in plaintext. Store a keyed hash with the expiry and try count. Use a server-side secret as the key, because a plain hash of six digits falls to anyone who tries all million values. At step 4, expect store and forward. The SMS specification describes a service centre that holds a message and forwards it, keeping it for a validity period. A phone that was switched off can therefore receive your code long after it stopped working. The person then sees a correct-looking code that fails. At step 5, read the receipt for what it is. It tells you the message arrived, which helps with fallback decisions. It tells you nothing about who read it. At step 7, burn the code. A code must work once only. NIST SP 800-63B-4 is written for US federal systems, yet it is the most useful public benchmark here:
  • Accept a secret only once during its validity period.
  • Treat the authentication as invalid unless it completes within 10 minutes.
  • Use at least six decimal digits from an approved random generator.
  • Rate-limit failures on the account, and allow no more than 100 consecutive failures.
  • Don’t reset the failure count when you issue a new code.
That last rule is the one teams miss. If a resend wipes the counter, an attacker simply requests new codes and keeps guessing.

​
How many digits and tries should you allow?

Codes of four to six digits are common. The gap between those two lengths is larger than it looks, because attackers rarely target one account. They try a guess or two across many numbers. Log-scale bar chart of expected successful blind guesses per 100,000 numbers. With 3, 5, 10 and 100 tries, 4-digit codes give 30, 50, 100 and 1,000 successes, and 6-digit codes give 0.3, 0.5, 1 and 10. Log-scale bar chart of expected successful blind guesses per 100,000 numbers. With 3, 5, 10 and 100 tries, 4-digit codes give 30, 50, 100 and 1,000 successes, and 6-digit codes give 0.3, 0.5, 1 and 10. The arithmetic is simple. Expected successes equal numbers attacked, multiplied by tries allowed, divided by the possible codes. At five tries across 100,000 numbers, a 4-digit code gives about 50 breached accounts and a 6-digit code gives about 0.5. NIST’s 100-failure ceiling is an upper bound for a whole account, not a target. For an SMS flow, three to five tries per code is a sensible starting point, as long as the running count survives a resend. Limits per number alone won’t catch this pattern, so also limit by IP address, device, and session.

​
Why does OTP SMS fail on Indian routes?

India adds a registration layer that most global explainers skip. TRAI requires commercial SMS to be traceable to a registered sender and template, and operators check each message against that record. An OTP that is perfect in your code can still stop here. Five stages an OTP SMS passes in India, from your app through the Vobiz Messaging API, the operator DLT check and the service centre to the handset, with what can stop the code at each stage and a delivery report returning to your server. Five stages an OTP SMS passes in India, from your app through the Vobiz Messaging API, the operator DLT check and the service centre to the handset, with what can stop the code at each stage and a delivery report returning to your server.

​
Which DLT category does an OTP belong to?

The answer has just changed. TRAI’s Third Amendment of 18 September 2026 says “OTPs for apps login” were inadvertently placed under transactional messages. It deletes those words from that definition and adds authentication OTPs to the service definition. The header suffixes let recipients see the category at a glance. The definitions covering these OTPs say they don’t need explicit consent. The amendment’s definition changes start 30 days after Gazette publication, and we could not confirm that date. TRAI dated the notification 18 September 2026, so they may already apply. Before you move anything, ask your DLT operator whether your login templates and headers need to change.

​
The checks that stop a compliant-looking message

The template must match. Vobiz’s India DLT guide explains that a template fixes the wording and marks variable positions with {#var#}. Operators reject text that doesn’t match a template under the header you used. Build the message from the same string you registered, so the two can’t drift apart. Links and callback numbers must be listed. TRAI’s August 2024 direction told operators to refuse traffic with URLs, APKs, OTT links, or callback numbers that are not whitelisted. It also set rejection for messages with an undefined telemarketer chain. The simplest OTP template has no link at all. The wording must fit your business. The same direction notes misuse of words like “OTP” in templates unrelated to a sender’s business. Keep your entity name, header, and template recognisably connected. A new SIM may not receive SMS yet. TelecomTalk reported in November 2022 that DoT told operators to stop SMS on a swapped or replaced SIM for 24 hours. We could not read the order itself, so confirm the current rule. Either way, a real customer who just replaced a SIM may need another channel, and that same moment deserves more suspicion.

​
What should happen when the code doesn’t arrive?

Users tap resend quickly, and each tap costs money and adds risk. Decide in advance how you’ll respond to each signal. The timer below is our suggested starting point, so tune it against your own delivery data. Resends raise one design choice. You can issue a new code and cancel the old one. This limits the number of valid values. The catch is that a delayed first message then fails when typed. You can instead resend the same code with its original expiry, which forgives out-of-order delivery. We’d rotate codes on login and payment flows, and tell the user that only the latest code works. Keep the text short and in a predictable alphabet. Per the Vobiz SMS guide, one GSM-7 segment holds 160 characters, while any character outside that alphabet switches the whole text to UCS-2 at 70. Our sample above has 86 characters. A Hindi template of that length takes two segments, so it costs more and has more parts to reassemble. You can also remove typing altogether:
  • Android: the SMS Retriever API reads the code automatically when the message contains your app hash.
  • Web forms: the one-time-code value of the autocomplete attribute tells browsers what the field expects.
  • Origin-bound codes: the WebOTP draft ends a message with your domain and code, so the browser can tie the code to your site. MDN marks the API as experimental and not widely available, so treat it as an enhancement.

​
How secure is OTP SMS?

It is secure enough for many jobs and not for all of them. The honest picture is that each attack targets a different step, so each needs a different control. The sign to monitor is a spike to adjacent numbers with no completed verifications. Compare codes sent against codes verified, by country and number range. Spending thresholds also help on costly routes.

​
What regulators actually say

These three positions are often flattened into “SMS OTP is banned” or “SMS OTP is fine”. Neither is accurate.
  • RBI (India): its authentication directions, with compliance due by 1 April 2026, require two distinct factors for domestic digital payments unless exempted. They list SMS-based OTP among the possible factors and open the way to alternatives. Outside card-present payments, one factor must be unique to the transaction. If non-compliance causes a loss, the issuer compensates the customer in full.
  • NIST (US): SP 800-63B-4 restricts phone-network delivery rather than prohibiting it. An organisation that accepts phone-network delivery must assess the risk, offer an unrestricted alternative, tell users about the risks, and plan a migration.
  • CISA (US): its December 2024 guidance tells highly targeted individuals not to use SMS as a second factor. CISA says the guidance applies to all audiences, though it is aimed at that group.
You may read that India is phasing out SMS authentication entirely. The RBI text doesn’t say that. It sets principles and lets issuers offer a choice of factors.

​
Which channel should you use for verification?

Start from what the moment needs, not from what is cheapest to send. Decision map with three questions. Proving a number works leads to SMS OTP with voice fallback. A person who can enrol a device leads to a passkey or authenticator app. A high-value action leads to SMS OTP plus an independent factor. Routine actions use SMS OTP with WhatsApp, RCS or voice as alternatives. Decision map with three questions. Proving a number works leads to SMS OTP with voice fallback. A person who can enrol a device leads to a passkey or authenticator app. A high-value action leads to SMS OTP plus an independent factor. Routine actions use SMS OTP with WhatsApp, RCS or voice as alternatives. India adds one more reason to review app-based channels. DoT’s November 2025 directions told major messaging apps to keep accounts continuously linked to the active SIM. The release describes this as already standard in banking and UPI systems. The original window was 90 days, and the minister’s April 2026 reply to Parliament set the compliance date as 31 December 2026.

​
What should you look for in an OTP SMS service?

Compare providers on how they behave when a code is in trouble, not on the happy path. Ask these questions before you commit:
  1. DLT handling: can you pass your entity, header, and template IDs on every message, and who enables your header?
  2. Delivery truth: do you get separate statuses for accepted, delivered, and failed, with an error reason?
  3. Safe retries: can a retry reuse an idempotency key, so a timeout doesn’t send and bill twice?
  4. Signed webhooks (callbacks): can you verify that a receipt really came from the provider?
  5. Cost visibility: can you see segments and price before sending a new template?
  6. Fallback channels: can you reach the same person by voice, WhatsApp, or RCS through one account?
  7. Your own measurements: test each route with real handsets on each operator you care about. Published delivery claims can’t tell you about your traffic.
  8. Who owns the logic: does the provider verify codes for you, or does your server? Each model works. Make sure you know where the limits and audit trail live.

​
How Vobiz handles OTP delivery

Vobiz is the delivery layer in this design, across several channels. Your server generates, stores, and checks the code, and Vobiz carries the message and reports what happened. SMS. You send through the Vobiz Messaging API using Send a message. For Indian numbers, you pass dltEntityId, dltHeaderId, and dltTemplateId, and your registered header is the from value. Indian traffic uses DLT sender IDs rather than long codes, and support enables your header on your account. Registration itself happens on a DLT portal. Retries. An idempotencyKey returns the original message instead of sending again, whatever the first attempt’s outcome. That is why a user-requested resend needs a new key. A tag such as otp lets you filter this traffic later. Delivery status. sent means the network accepted the message, and delivered means a delivery receipt came back. Webhooks (callbacks) fire message.delivered and message.failed, signed with X-Webhook-Signature, so your fallback logic doesn’t need to poll. Cost before sending. Cost preview returns the segment count and price for a text without sending it. For current rates, see the Vobiz pricing page. Opt-outs. A number that replied STOP is on your opt-out list, and sends to it return 422. Handle this in your login flow, because that person may still need a code. Offer another channel, and confirm consent before you remove an entry. Other channels. RCS has a reachability check and failoverToSms. WhatsApp templates include an AUTHENTICATION category for codes. The OTP call example uses VobizXML to read a code aloud digit by digit, and the Vobiz DLT guide lists the 160 series for OTP calls in India.
Every send texts or calls a real person and is billed. Run examples only with your own Auth ID and Auth Token, against numbers you have permission to contact, and after you confirm the destination.

​
Frequently asked questions

OTP stands for one-time password. In an SMS, it is a short numeric code that a service generates for one action and texts to your phone. You type it back to continue. It stops working after one use or when its time limit passes.
The sender sets the limit, so it varies by service. Many use a few minutes. NIST’s digital identity guidelines treat out-of-band authentication as invalid unless it completes within 10 minutes, which makes 10 minutes a sensible ceiling. Payment and account-recovery flows usually justify something shorter.
As a user, check signal, a recent SIM replacement, and your spam filter, then request one new code. As a sender in India, check the DLT template match, header category, and any URL in the text. Your delivery report usually tells you which stage failed.
It adds real protection over a password alone, and it is weaker than a passkey. SMS is not encrypted, and a code can be phished or redirected through a SIM swap. Use it for reach, then offer stronger methods for accounts and actions worth attacking.
It depends on purpose. TRAI’s September 2026 amendment moves OTPs for app login, password reset, and two-factor authentication into service messages, while OTPs tied to customer-initiated transactions remain transactional. Those changes start after Gazette publication, so confirm the current position with your DLT operator before changing headers.
Two-factor authentication is the requirement: two separate kinds of proof. An OTP is one possible proof, showing you hold a device or number. An SMS OTP used alone is one factor. It becomes two-factor only when paired with something else, such as a password or fingerprint.

​
Further reading on Vobiz

​
Sources

Indian regulators and government Standards and security guidance Platform documentation Industry and press

Send your first SMS with Vobiz

Get your credentials and send a test message to your own number.