Short answer
Reduce OTP SMS costs by sending fewer codes you do not need: stop bots before a code is sent, rate-limit by number, IP and device, allow-list only countries with real users, and set spend circuit breakers. Then offer WhatsApp authentication templates before SMS where users have WhatsApp. Measure cost per verified user, not price per message, because fraud and resends sit in that figure.
Which tactics save the most?
| Tactic | What it does |
|---|---|
| Bot defence | A message you never send is free; protect sign-up, login and reset endpoints |
| Rate limits | Cap codes per number, IP, device and session, with growing resend delays |
| Destination allow-list | Enable only countries with real users; challenge attack prefixes |
| Spend circuit breakers | Hourly and daily caps per country and endpoint, with automatic pause |
| WhatsApp first | Authentication templates for users who have WhatsApp, SMS as fallback |
How do you measure OTP cost?
Cost per verified user is total OTP spend in a period divided by users who completed verification. It is the only figure that includes fraud, retries and abandoned attempts.
Watch two ratios: sends per verified user (above 1.0 means resends, abandonment or fraud) and verification conversion (codes entered divided by codes sent). A fall in conversion in one country is the first sign of SMS pumping.
How does WhatsApp fit in?
- WhatsApp authentication templates have preset text with a code and an optional expiry of 1 to 90 minutes.
- Meta bills them per delivered message by recipient market; check Meta's current rate card.
- Order channels per user: WhatsApp for returning WhatsApp users, SMS for new users, then fall back after a short wait.
- OmniChannels.ai supports channel fallback; voice OTP pricing is on request.