What is an SMS code? How one-time passcodes (OTP) work

In this article: ► Why SMS verification codes matter ► The verification code that never arrives

Shopping online, browsing social media, managing accounts through e-banking, working in the cloud — all of it has become ordinary daily life. And at the same time, attackers are waiting for the chance to steal our personal information.

Most cloud services and mobile apps now ask users for a mobile number and send an SMS verification code as part of registration.

One reason is that a mobile number is an effective way to verify a user’s real identity. Equally, when a password reset request comes in, the provider can send an SMS code to the number already registered on the system, helping the genuine user change their security settings and preventing account takeover.

Some services need stricter verification and require an SMS code at every login for two-factor authentication. Codes of this kind usually have a very short validity of 30–60 seconds, so for the login to complete, the phone has to be with the user and the SMS has to reach them within 5–10 seconds.

Plenty of users will have experienced registering or logging in and waiting a long time for a code that never arrives, then pressing “get code” again after each failure and hoping the next one works. The frustration takes a heavy toll on the user experience.

Have you considered why the code fails to arrive? Poor network reception at the user’s end? A fault on the platform?

In reality, whether a verification code goes missing depends far more on whether the SMS provider chose a reliable, honest and stable route — and on how the provider’s back end operates.

Have you noticed that sometimes a bank SMS arrives with a long code as the sender name and no Sender ID? Those are non-forward SMS, specially configured at the request of the bank’s security system. It means that even if the user has diverted their phone to another number, this particular class of SMS cannot be forwarded, which protects the account. Using a long code as the sender name is generally more expensive and comes with a number of other conditions to satisfy.

We tend to recommend that business clients — retail brands in particular — send SMS using a Sender ID, for the best promotional effect and the best delivery success rate. See Why SMS goes missing for more.