Every sign-up, payment and password reset ends at the same screen: "Enter the code we sent you." If the code arrives late, the customer retries, gets a second code, enters the first one, fails, and gives up. OTP delivery is where conversion is silently lost.

1. Use the transactional route, always

OTPs must never share a route with promotional traffic. In India that means a transactional DLT header and an authentication template. Transactional routes are prioritised by operators and are exempt from DND and time-of-day restrictions. See Bulk SMS for how the routes are set up.

2. Keep the template short and standard

A good OTP message is instantly recognisable:

482913 is your Mantraxtel verification code. It expires in 5 minutes. Do not share it with anyone.

Put the code first (it is what the phone's autofill reads), state the expiry, add the warning. Avoid links in OTP messages — they train customers to tap links in security messages.

3. Add fallback channels

No single channel delivers 100% of the time. A layered flow:

1. SMS – sent immediately.
2. WhatsApp authentication template – if the customer opted in and SMS is not delivered within 20–30 seconds, or as a "Resend on WhatsApp" option.
3. Voice OTP – a call that reads the code out; essential for feature phones and for customers whose SMS inbox is full. See Voice.

Show the customer which channel is being used and offer the alternatives after the first timeout.

4. Set the right expiry and retry rules

• Expiry of 3–5 minutes balances security and delivery variance.
• Allow resend after 30 seconds, not immediately — instant resends cause duplicate codes and confusion.
• Cap attempts (for example, 5 codes per number per hour) to stop abuse.

5. Protect against fraud

• Rate-limit by number and by IP. OTP endpoints are a favourite target for SMS pumping fraud.
• Validate the number before sending (format, country, known invalid ranges).
• Alert on spikes — a sudden jump in OTP volume from one region is a signal, not growth.

6. Measure delivery, not just sends

Track delivered-within-10-seconds, delivered-within-60-seconds and failed, per operator. A drop on one operator is usually a routing issue that can be fixed the same day if you can see it.

The payoff

Businesses that add WhatsApp and voice fallback to SMS OTP typically see verification completion rise because the customers who were stuck now get through. Talk to an expert to review your current OTP flow.