Every few years someone announces that SMS is dead. Every year, banks, airlines, e-commerce platforms and healthcare systems send more one-time passwords over SMS than the year before. There's a reason for that. SMS reaches almost every phone on the planet, doesn't need an app, doesn't need internet, and — when it's routed properly — arrives in under two seconds. This is a plain-English guide to sending SMS OTPs well.
Why SMS still wins for authentication
SMS has one enormous advantage over every other channel: it works on anything with a SIM card. No smartphone required, no data plan required, no app install. For a global consumer product this is decisive — the moment you require an app-based authenticator you lose a slice of users at every step of onboarding.
The second advantage is habit. Users know what an SMS OTP looks like. They know where to find it. There is no learning curve. When a bank sends a six-digit code, nobody needs a tutorial.
The three ways SMS OTP goes wrong
The first failure mode is routing. If your provider is a reseller of a reseller, your message hops through several networks before it reaches the operator. Each hop adds latency, and some hops drop messages on the floor. Direct operator routes are non-negotiable for OTP traffic.
The second is sender ID. In many countries (India, Saudi Arabia, the UAE, Nigeria, and increasingly the rest of the world) you must register a sender ID and templates in advance. Skip this and your messages simply won't be delivered.
The third is fallback logic. When SMS fails — and it will, occasionally — do you retry on a different route? Do you fall back to WhatsApp or voice? Getting this right is the difference between a 99.9% and a 95% delivery rate.
What a good SMS OTP flow looks like
Keep the message short: '{code} is your OTP for {brand}. Do not share.' Include an expiry hint. Never include a link inside an OTP message — carriers increasingly flag those as phishing.
Set a sensible TTL on the code itself (five minutes is standard), rate-limit generation per user, and log delivery receipts so you can spot degradation before your users do.
SMS OTP is not glamorous. It is the plumbing that quietly holds up most of the internet's authentication. Do it well and nobody will notice. Do it poorly and it becomes the single biggest source of support tickets. We know which one we prefer.