OTP Messages on WhatsApp and SMS: Security, Delivery and Fraud

This guide is for product managers, engineers and security teams who send one-time passwords (OTPs) for sign-up, login, payments or account recovery. It covers how WhatsApp authentication templates work, how to deliver codes over SMS, how to design fallback, and how to stop OTP fraud such as SMS pumping without hurting real users.

What makes a good OTP message?

A good OTP message arrives in seconds, is easy to enter, cannot be reused, and is clearly from you. Everything else in this guide supports those four properties.

• Fast: delivered within seconds on the first attempt.
• Easy: autofill or copy where possible; no hunting through text.
• Safe: short-lived, single-use, at least six digits, with a "do not share" warning.
• Trusted: a verified business name on WhatsApp or a registered sender ID on SMS.

How do WhatsApp authentication templates work?

WhatsApp requires an authentication template for one-time passcodes. The text is preset by Meta, for example "123456 is your verification code", with an optional security recommendation ("For your security, do not share this code") and an optional expiry footer. According to Meta's documentation, authentication templates cannot include URLs, media or emojis, and parameters are limited to 15 characters.

You choose one of three delivery types:

Two further points from Meta's documentation are worth knowing:

• Linked device security is on by default for Cloud API: codes go only to the user's primary device and are masked on linked devices.
• iOS autofill: Meta states that from 15 June 2026, on iOS 26 and later, keyboard suggestions offer OTP autofill from the WhatsApp notification without integration.

If you send codes through a marketing or utility template, Meta can schedule that template for rejection, and that decision cannot be appealed. See our guide to WhatsApp template categories.

How should OTPs be sent over SMS?

SMS remains the universal channel: it works without data or an app. To make it reliable:

1. Use a registered transactional sender ID in markets that require registration, such as the UAE and Saudi Arabia, and keep marketing off it. See our sender ID registration guide.
2. Keep the message to one segment. Put the code first, name the brand, state expiry and add a warning: "123456 is your Najm code. Valid 5 minutes. Never share it." Arabic text uses Unicode, so fewer characters fit in a segment.
3. Support SMS autofill on Android (SMS Retriever API format) and iOS (one-time-code field) so users do not type the code.
4. Route through quality connections that return delivery reports, so fallback and monitoring have real signals.

NIST SP 800-63B classifies OTPs over the public phone network (SMS and voice) as a restricted authenticator because of SIM swap, number porting and interception risks, and recommends checking risk indicators such as SIM change before sending. For high-value actions, combine SMS OTP with other signals or offer stronger factors such as passkeys.

How do you design OTP delivery and fallback?

Send once on the best channel, wait briefly for a delivery confirmation, and fall back once. Uncontrolled retries are where cost and fraud explode.

1. Choose the primary channel per user: WhatsApp for users who verified via WhatsApp before or chose it; SMS otherwise.
2. Generate one code per verification session, valid for a short window and accepted once.
3. Wait for the delivered status for a short timeout, measured in seconds rather than minutes.
4. Fall back once to the other channel if not delivered, reusing the same code or invalidating the first.
5. Offer a user-initiated resend with a visible countdown, rather than automatic repeats.
6. Cap resends and attempts per phone number, device and session.
7. Log channel, status, latency and verification outcome for every send.

How do you prevent SMS pumping and OTP fraud?

SMS pumping, also called artificially inflated traffic (AIT), happens when bots request OTPs to number ranges where someone profits from terminating traffic. You pay for every message; no real user ever verifies. Prevention is layered.

Controls checklist

• Geo-permissions: only allow OTP destinations in countries where you have customers; require review to add new ones.
• Rate limits per phone number, IP address, device, session and number prefix.
• Bot protection (challenge or risk scoring) before the OTP request, not after.
• Conversion monitoring: alert when verification conversion for a country or prefix drops sharply.
• Number validation: reject malformed, sequential or obviously invalid numbers.
• Spend alerts and daily caps per destination.
• Exponential back-off on resends and no unlimited automatic retries.
• Prefer WhatsApp for users on it, since authentication templates are bound to a WhatsApp account rather than a premium SMS termination.
• Incident runbook: who can block a country or prefix, and how fast.

Also protect users: never ask for the code in a call or chat, state that in the message, and require re-authentication when a phone number or SIM changes.

Worked example: a Qatar delivery app

"Rafeeq Delivery" (synthetic) verifies new users and confirms high-value orders.

• Android users receive a WhatsApp authentication template with one-tap autofill; iOS and web users receive copy-code.
• Fallback: if WhatsApp delivery is not confirmed within a short timeout, the same code goes once by SMS from a registered transactional sender ID.
• Limits: three code requests per number per hour, a cap per device and IP, and OTP destinations limited to the GCC countries where the app operates.
• Monitoring: one night, OTP requests to a non-GCC prefix spike with near-zero verification. Geo-permissions block them automatically; the incident costs nothing because the country was never enabled.
• Outcome: the team tracks spend per successful verification and verification conversion per channel weekly, and adjusts the primary channel by market.

Common mistakes and limits

• Using marketing or utility templates for OTPs on WhatsApp.
• Long-lived or reusable codes, or codes that stay valid after a new one is issued.
• Unlimited resends, which invite pumping and frustrate users.
• No geo-restriction on sign-up OTPs.
• Mixing promotional text into OTP SMS, which can get the sender ID blocked.
• Treating OTP as the only factor for high-risk actions.
• Ignoring cost changes. Meta bills delivered authentication templates by recipient market; confirm current rates in Meta's rate card.

How OmniChannels.ai helps

OmniChannels.ai supports WhatsApp authentication templates with one-tap, zero-tap and copy-code OTP, alongside utility and marketing templates, with phone preview and approval tracking. SMS is delivered through BroadNet Technologies' operator connectivity, and voice OTP covers users who cannot receive text, so you can combine WhatsApp, SMS and voice for OTP with channel fallback configured per use case. Delivery reports, with summary and advanced views, filters and CSV export, help you monitor delivery by channel. OTP sending and delivery webhooks are documented in the public REST API.