Short answer
Voice OTP delivers a one-time password through an automated phone call: a text-to-speech engine reads the code aloud, usually twice, and the user types it into the app or website. Businesses use voice OTP mainly as a fallback when SMS or WhatsApp codes do not arrive, for landlines, and for users with visual impairments.
How a voice OTP call works
- The user asks for a code and chooses, or is offered, "Call me instead".
- Your application generates the code and stores a hash with an expiry and an attempt limit.
- The voice platform places an outbound call to the user's number.
- Text-to-speech reads the digits one by one, with pauses, and repeats them.
- The user enters the code and your application checks it, exactly as for SMS OTP.
When should you use voice OTP?
Voice OTP should not be the first channel for every login, because calls interrupt users and cost more to abuse.
- As a fallback after an SMS or WhatsApp code has not arrived within a set time.
- For landline and feature-phone numbers that cannot receive app messages.
- For accessibility, when users cannot read a screen easily.
- In markets where SMS filtering or delays affect delivery.
Arabic voice OTP and fraud controls
In the GCC, read the code in the user's language. Reading digits one by one avoids an Arabic or English engine reading the code as one large number. Test prompts with native speakers.
Voice OTP can be abused for international revenue share fraud, so apply rate limits per number, device and IP, and allow only countries you serve. NIST SP 800-63B treats OTPs over the phone network as a restricted authenticator.
OmniChannels.ai offers voice OTP with text-to-speech including Arabic; voice is provisioned with the account team.