One-time password (OTP)

A one-time password (OTP), also called a one-time passcode, is a short code that is valid for a single sign-in, confirmation or transaction and then expires. It is either sent to the user over a channel they control, such as SMS, WhatsApp, a voice call or e-mail, or generated on a device they hold, such as an authenticator app. Typing it back proves possession of that channel or device.

#How do OTPs work?

There are two families.

Delivered codes (out-of-band). The server creates a random code, stores it with an expiry, and sends it to the user's phone number or app. The user types it in, and the server compares. SMS, WhatsApp and voice OTPs all work this way. NIST's digital identity guidelines (SP 800-63B-4) require the authentication to be completed within 10 minutes, and codes of "at least six decimal digits (or equivalent)". They also say e-mail "SHALL NOT be used for out-of-band authentication".

Generated codes. The server and the user's device share a secret key. Both compute the same code from it: from a counter in HOTP (RFC 4226) or from the current time in TOTP (RFC 6238), which is what authenticator apps use. Nothing is sent, so there is no message fee and no delivery delay.

#What are the weaknesses?

• Phishing and social engineering. A code can be typed into a fake site or read out to a "support agent". No OTP is phishing-resistant, which is why passkeys are replacing them for sign-in.
• Phone-number takeover. NIST treats OTP over the phone network as a restricted authenticator, because a SIM swap or a fraudulent port moves the codes to an attacker.
• Cost abuse. Public "send me a code" forms are the main target of SMS pumping: bots request codes to numbers that earn the attacker a share of the fees.
• OTP bombing. Attackers flood a victim with codes to harass them or to hide a real alert. See OTP bombing protection.
• Delivery failures. SMS to landlines, unreachable numbers or filtered routes never arrives, and the user abandons sign-up.

#Why does it matter for deliverability and fraud?

OTP is often the first message a business sends to a new number, so it carries both the cost risk and the conversion risk. Choosing the channel per number matters: a code sent to a number with a WhatsApp account, where the user agreed to receive it there, avoids SMS termination fees and SMS pumping. See OTP delivery by channel and WhatsApp OTP vs SMS OTP cost.

#How do you protect an OTP flow?

1. Check the number before sending. Reject invalid numbers, and review premium-rate, fixed-line or VoIP numbers first. See OTP fraud prevention.
2. Allow only the countries you serve.
3. Rate-limit per number, IP address, device and session, and cap daily spend.
4. Make codes single-use, expire them quickly and limit guesses.
5. Offer stronger methods: authenticator apps, passkeys, or operator-based checks such as the Number Verification API where available.

#How does MobileValidate help?

MobileValidate doesn't send OTPs. It checks the number before you do: line type and carrier, and whether the number has an account on channels such as WhatsApp, so you can pick a channel and filter risky destinations. Unknown answers are free. The OTP and sign-up guard recipe shows the full flow in code.