# OTP & Number Verification - Canonical URL: https://www.broadnet.me/academy/otp-and-number-verification - Language: en - Last updated: 2026-07-18 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. Verification Intermediate How one-time passwords and number verification work — TOTP/HOTP, delivery channels and fallback, autofill conventions, and defending against AIT. 5 lessons 4 min read Standards-based · self-paced What you'll learn - What an OTP is and how HOTP and TOTP generate codes - Verification channels: SMS, voice, flash call, WhatsApp - Channel fallback and how to time-box a waterfall - Autofill conventions and message design that convert - Defending against SMS pumping / artificially inflated traffic Course outline 1. 01What an OTP is 2. 02How codes are generated: HOTP and TOTP 3. 03Delivery channels and fallback 4. 04Autofill, message design, and latency 5. 05Defending against AIT / SMS pumping 6. ★Key takeaways [All courses](https://www.broadnet.me/academy) Diagram The OTP journey, with channel fallback 1. User requests a code Sign-in, payment or sign-up 2. Your app calls the verify API One request per code 3. BroadNet delivers the code On the best available channel Fallback if undelivered SMS WhatsApp Voice 4. User enters the code Checked against the issued code 5. Verified Access granted Lesson 01 ## What an OTP is A one-time password (OTP) is a code valid for a single login or transaction. It is the second factor in two-factor authentication: something the user receives, proving control of a phone number or an authenticator, on top of a password they know. OTPs are the highest-stakes messages most businesses send. A late or missing code is a failed login, an abandoned signup, or a lost sale, so OTP traffic is treated as a distinct class with tight latency budgets and short validity windows. Number verification is the related task of proving a user actually controls a given phone number — the foundation of account security, fraud reduction, and clean contact data. Lesson 02 ## How codes are generated: HOTP and TOTP HOTP (RFC 4226) generates a code from a shared secret and a counter using HMAC. Each use increments the counter, so codes don't repeat. It underlies event-based tokens. TOTP (RFC 6238) replaces the counter with the current time divided into fixed steps (commonly 30 seconds), so both sides derive the same code from the same secret and clock. This is what authenticator apps use, and it works offline because no message needs to be delivered. For SMS-delivered OTPs, the code is usually a short random numeric value generated server-side, bound to the session or device, and expired after first use or a timeout. Six digits is the common default, balancing usability against guessing resistance. Lesson 03 ## Delivery channels and fallback SMS is the default OTP channel because of its universal reach, but it is not the only one. Voice OTP reads the code aloud and helps in markets with poor SMS deliverability or for accessibility. WhatsApp and RCS can deliver codes richly where the user is reachable there. Flash-call verification is a cost-efficient alternative: the platform places a call that the app detects and auto-dismisses, verifying the number from the calling number's last digits without the user answering. It removes the SMS cost and the manual code entry entirely. A channel waterfall combines these: try channel one, and if delivery isn't confirmed within a few seconds, escalate to the next. The waterfall must be time-boxed and must avoid sending the same code across two channels at once, which doubles cost and fraud exposure. Lesson 04 ## Autofill, message design, and latency Well-designed OTP messages convert better. Keep the body minimal, branded, and consistent so it passes content filters, and support platform autofill conventions — such as the origin-bound one-time-code format on the last line — so the code is entered automatically. Never place the code inside a clickable link that could be phished; keep it copy-or-type only. Localise the surrounding text while keeping the code and brand token stable so autofill and user recognition still work. Measure end-to-end latency to the handset (submit to DLR), not just submit-accept time, and set a short validity period so a delayed code expires rather than arriving stale. Trigger fallback on a missing DLR within your latency budget, not only on an explicit failure. Lesson 05 ## Defending against AIT / SMS pumping Artificially inflated traffic (AIT), also called SMS pumping, is fraud where attackers trigger genuine-looking OTP sends to numbers they control, inflating your bill with no real user behind them. It is the single highest-ROI area to defend for most senders. The core controls are rate limits — per phone number, per IP, per device fingerprint, per account — plus a cap on resends per session and added friction (a challenge or CAPTCHA) when velocity spikes from one source. Watch conversion per destination: pumped traffic shows a flood of requests with near-zero code entry, and a sudden surge to an unusual country range is the classic signature. Validating numbers with an HLR / number-intelligence lookup before sending rejects invalid and high-risk numbers up front. Key takeaways - OTPs are a distinct, latency-sensitive traffic class; HOTP is counter-based and TOTP (RFC 6238) is time-based. - Channels include SMS, voice, WhatsApp/RCS, and flash call; combine them in a time-boxed fallback waterfall. - Support autofill, keep codes out of links, use short validity, and measure end-to-end delivery latency. - AIT / SMS pumping is defended with rate limits, resend caps, conversion monitoring, and pre-send number checks. Keep going ### Related answers, products & tools - [What is an OTP?](https://www.broadnet.me/answers/what-is-otp) - [Flash call verification](https://www.broadnet.me/answers/what-is-flash-call-verification) - [What is SMS pumping (AIT)?](https://www.broadnet.me/answers/what-is-sms-pumping) - [What is HLR lookup?](https://www.broadnet.me/answers/what-is-hlr-lookup) - [OTP / Verify product](https://www.broadnet.me/products/otp) - [OTP cost estimator (free tool)](https://www.broadnet.me/tools/otp-cost-estimator) References - [RFC 6238 · TOTP](https://datatracker.ietf.org/doc/html/rfc6238) - [RFC 4226 · HOTP](https://datatracker.ietf.org/doc/html/rfc4226) Up next in the curriculum [Intermediate · Channels Omnichannel Messaging Orchestrating SMS, WhatsApp, RCS, voice, and email as one conversation — channel capabilities, the WhatsApp 24-hour window, and fallback design.](https://www.broadnet.me/academy/omnichannel-messaging) [Advanced · Operator Security SMS Firewall & Operator Security How mobile operators protect messaging revenue and subscribers: firewall deployment modes, threat detection, home-routing, and A2P monetization.](https://www.broadnet.me/academy/sms-firewall-and-operator-security) Put it into practice ## Build with what you just learned. Talk to a real engineer about your use case, or open the developer docs and send a message across the routes this course describes. [Talk to engineering](https://www.broadnet.me/contact) [Developer docs](https://www.broadnet.me/developers) Why learn from BroadNet - Since 2003 - Countries 200+ - Operator links 1,000+