OTP Best Practices: How to Reduce Costs, Improve Delivery, and Stop Fraud

Most OTP failures aren't caused by bad code. They're caused by poor implementation decisions: messages that cost twice as much as they should, delivery strategies that don't account for regional carrier behavior, and verification flows with no fraud protection until the bill arrives.

After delivering hundreds of millions of OTPs globally, Prelude has documented what actually moves the needle. This guide covers ten practices that reduce costs, improve conversion rates, and prevent the fraud patterns that quietly inflate verification spend.

For a full overview of how OTP systems work and when to use them, see our complete SMS OTP guide.

The Key Challenges OTP Systems Face

Before getting into solutions, it helps to name the problems clearly. Most OTP implementations run into the same four categories of failure:

Delivery failures. SMS not received due to network errors, carrier filtering, spam detection, or incorrect contact data. Each failed delivery is a user who can't complete verification.

Escalating costs. Carrier fees, provider margins, message segmentation, and global routing all contribute. Costs compound quickly at scale and are often invisible until the invoice arrives.

Fraud. SMS pumping and IRSF artificially inflate verification traffic, generating telecom fees the platform absorbs. Neither requires any technical sophistication to execute.

User experience breakdowns. Expired codes, long delays, and confusing message formats drive failed first attempts and costly retries.

These aren't independent problems. A poorly optimized message increases costs and reduces conversion. A weak delivery strategy increases retries, which increases fraud exposure. The practices below address all four simultaneously.

10 OTP Best Practices

1. Optimize your OTP message to reduce costs

When crafting OTP messages, every character counts, literally. A well-optimized message not only ensures clear communication but also helps control costs. Here’s how to keep it efficient:

Keep it short

SMS costs are calculated based on message length, with charges applied per 160-character segment. Exceeding this limit by even a single character can double your charges.

For example:

• "123456 is your OTP for MyApp". Fits in 1 segment, keeping costs low,

• "Your one-time password is 123456. Thank you for using our service". Spills into 2 segments, increasing costs.

While it might be tempting to add a catchy tagline or extra branding, remember that every additional character impacts your budget. Keep your messages concise and focused on delivering the essential information.

Avoid emojis and UCS-2 encoding

Emojis and non-standard characters might make your message stand out, but they come with a cost.

SMS encoding works in two formats:

• GSM-7: Supports most Latin-based characters and allows 160 characters per segment,

• UCS-2: Required for emojis and special characters but reduces the limit to 70 characters per segment, doubling costs for every additional 70 characters.

For example:

• "123456 is your OTP for MyApp" (GSM-7). Fits in 1 segment,

• "123456 is your OTP for MyApp 😊" (UCS-2). Requires 2 segments.

One less obvious gotcha: certain characters within the GSM-7 charset require escape sequences. These include {, }, [, ], ~, |, \, and ^, and each counts as two characters. A message that looks under 160 characters in your editor can still split into two segments if it contains these extended characters.

To minimize costs, avoid emojis and only use UCS-2 when absolutely necessary, such as in regions with non-Latin scripts.

How does Prelude help you save?

Prelude bills messages at carrier cost with zero markup, plus a €0.032 verification fee on the Pay As You Go plan, so the cost of each extra segment is the carrier’s rate and nothing more.

2. Structure your OTP message for instant readability

Delivery is only half the equation. A delivered OTP that a user can't find or misreads generates a retry. Retries cost money and create friction.

After hundreds of millions of OTP sends, Prelude has found that one format consistently outperforms alternatives:

"{{Code}} is your validation code for {{App Name}}"

Putting the code first makes it immediately visible in SMS notification previews. Users can read and enter the code without opening the message or switching apps. This alone reduces failed first attempts meaningfully.

The BeReal example. Prelude client BeReal uses a slight variation of this format: 

"7860 is your validation code for BeReal. Your friends for real." 

The tagline is short, brand-consistent, and doesn't push the code out of the notification preview. This message structure helped BeReal achieve a 90% global conversion rate for user verification.

Why does this work so well? 

1. Code visibility: placing the code at the start of the message ensures it’s instantly visible in SMS notifications. Users can access and input the code without having to search for it or exit your app,
   
   

2. Clarity and brevity: a short, straightforward message prevents confusion and minimizes the risk of errors. Users know exactly what to do as soon as they read the message,

   
   

3. Brand alignment: adding a tagline enhances the overall user experience by reinforcing your brand identity. However, it’s crucial to keep it short to avoid distracting from the main purpose: delivering the verification code.

3. Optimize your delivery strategy

Relying on a single SMS provider creates a single point of failure. Providers experience downtime, carriers filter specific sender profiles, and rates vary significantly by region and volume. Multi-routing addresses all three.

How multi-routing works 

Distributing traffic across multiple providers means that if one route fails, messages automatically reroute through another without delays for the user. Different providers also have different strengths by region: a provider with strong European carrier relationships may have inconsistent delivery in parts of Southeast Asia. Routing to the best-performing provider per destination improves both delivery rates and costs simultaneously.

In practice, this could mean that a company sending OTPs across Europe, LATAM, and Southeast Asia might use Provider A for European traffic where it has direct carrier agreements, and Provider B for APAC markets where its regional routing is stronger. Neither provider alone covers both regions at the same quality and cost.

Multi-routing isn't just a reliability measure. It's a cost optimization strategy. Prelude's routing layer does this automatically, selecting the best route per destination based on real-time delivery performance data.

For more on delivery rate factors, see our SMS delivery rate guide.

Why is this essential for your business?

An optimized delivery strategy is more than a technical choice. It’s a way to ensure that your users have a seamless experience, no matter where they are. Multi-routing reduces the risks associated with downtime or network issues while helping you stay within budget.

4. Use multiple channels

SMS is the default OTP channel, but it isn't always the most reliable or cost-effective one, depending on where your users are. Not all users have consistent cellular coverage, and not all regions have the same level of SMS reliability.

Online messaging channels including WhatsApp OTP, RCS, Telegram OTP or Viber offer meaningful advantages in specific contexts:

• Cost. Channel pricing varies by country, so compare costs per destination. In some markets WhatsApp or RCS costs less than SMS, and in others it costs more. Prelude publishes per-country rates for each channel, so you can check before choosing a fallback.

• Reach. In regions where cellular coverage is inconsistent, app-based channels often outperform SMS on delivery rate.

• User preference. In markets where WhatsApp is the main messaging app, such as Brazil and India, users are more likely to see and act on a WhatsApp code quickly.

The best implementation isn't choosing one channel over another. It's building automatic fallback logic: SMS as the primary channel, with WhatsApp or voice as the fallback when SMS delivery fails. Prelude routes across SMS, WhatsApp, RCS, Telegram, Viber, Zalo, email, and Silent Network Authentication from a single API call, with voice available once enabled and automatic fallback configured per destination.

Using multiple channels expands your reach, reduces costs, and ensures OTPs are delivered efficiently, even in challenging environments. By diversifying your delivery methods, you can provide a seamless experience for all users, regardless of their location or network conditions.

5. Prevent fraud before it hits your bill

Fraud prevention is not optional at scale. Two attack types drive most OTP fraud majority of OTP fraud losses: SMS pumping and IRSF.

SMS pumping involves bots flooding your OTP endpoints to trigger large volumes of outbound messages to premium routes the attacker influences. Every delivered message generates telecom termination fees; the attacker collects a share through revenue-sharing arrangements with carriers or aggregators. The attack looks like legitimate traffic until the bill arrives. In 2025, 11.83% of the authentication requests Prelude analyzed were fraudulent (Prelude 2025 SMS Pumping Fraud Report).

IRSF (International Revenue Share Fraud) works through a similar economic model. Attackers control or partner with operators on high-tariff number ranges and route OTP traffic toward them, collecting a share of the resulting termination fees. IRSF often involves no suspicious user behavior, making it particularly difficult to detect through standard monitoring.

What detection looks like. Both attacks share detectable signals: unusual traffic spikes from specific regions or prefixes, low verification completion rates despite high send volumes, short session durations, and bursts of traffic from automated infrastructure.

Effective prevention requires pre-send detection. Rate limiting and geographic filtering help but aren't sufficient on their own. Systems that evaluate fraud signals only after an OTP has been sent are already absorbing costs before the block occurs.

Prelude Verify scores every verification request with machine learning models, using signals like IP address, device ID, and platform, and blocks suspicious requests before a code is sent. For deeper scoring before signup or KYC, the Watch API analyzes dozens of signals such as number portability history, residential proxies, and disposable numbers.

For a full breakdown of fraud types and detection strategies, see The Complete Guide to OTP Fraud and SMS Pumping: What it is and How to Prevent it.

6. Choose the right OTP provider

Implementation quality matters, but it compounds or is undermined by the provider you're building on. A well-optimized message sent through a poorly routed provider still underperforms.

The criteria that matter most for OTP specifically are different from general SMS API selection:

• Pre-send fraud detection. Is fraud blocked before the message is sent, or reported after costs are incurred?

• Conversion analytics. Can you see cost-per-verified-user and OTP conversion rate by country and channel, not just delivery status?

• Multi-channel fallback. Does the platform automatically route to WhatsApp or voice when SMS fails, or does that require a second integration?

• No markup on carrier costs. Some providers add a margin on top of carrier rates that compounds significantly at scale.

• Dedicated verify API. Does the platform handle code generation, delivery, and validation in one endpoint, or does your team need to build that logic?

Prelude is built around these five criteria specifically: pre-send fraud detection, per-country conversion analytics, automatic multi-channel fallback, no carrier markup, and a single dedicated verify endpoint.

For a full comparison of OTP-specific providers evaluated on these criteria, see our best OTP providers guide.

If you're still deciding whether to build your own OTP system or use a provider, see our build vs. buy guide for OTP verification.

7. Set expiry windows and retry limits

OTP security depends heavily on how long a code remains valid and how many attempts a user gets. Both decisions involve a trade-off between security and conversion.

Expiry windows. 5 to 10 minutes is the standard range that balances usability with security. Shorter than 2 minutes creates too much friction. Users switching between apps, poor network conditions, or slow typing can all cause a legitimate code to expire before entry. Longer than 15 minutes extends the window of exposure if a code is intercepted.

For financial transactions or sensitive account actions, tighter windows (2 to 3 minutes) are appropriate. The expiry should always be communicated in the message or the UI so users know how long they have. A timed progress bar or countdown in the verification screen reduces failed attempts meaningfully.

Retry limits. Cap resend requests per phone number within a time window. Three resends within 10 minutes is a reasonable starting point. Beyond that, a cool-down period prevents both frustrated users hammering the button and bots probing the endpoint. Notify the user clearly when they've hit the limit and when they can try again.

Attempt limits. Limit how many times a user can attempt to enter a code before the session is invalidated. Three to five attempts per code is standard. Invalidate the code immediately after the limit is reached. Don't allow unlimited guesses against a live code.

In Prelude Verify, the verification window and the maximum number of attempts are configurable from the dashboard, and requests per phone number are rate limited automatically.

8. Validate phone numbers before sending

Sending an OTP to an invalid, undeliverable, or VoIP number wastes cost and signals nothing about whether the user is legitimate. Number validation before the send is one of the simplest cost and fraud controls available.

What to validate. At minimum: correct E.164 formatting, whether the number is a mobile number (not a landline or VoIP), and whether it is active on a live network. More advanced validation checks carrier data, SIM swap recency, and whether the number has been associated with fraud patterns.

Why VoIP numbers matter for fraud. VoIP numbers are disproportionately used in OTP pumping attacks because they're cheap to generate at scale and can be pointed at revenue-sharing routes. Blocking or flagging VoIP numbers at the validation stage removes a significant share of pumping traffic before it reaches your provider.

How to implement it. Most OTP providers and number intelligence APIs offer a lookup endpoint that returns number type, carrier, country, and activity status. The cost per lookup is typically a fraction of the cost of an undeliverable SMS send. Prelude’s Intel Lookup API returns a number’s carrier, line type, and portability status before you send.

9. Rate limit at the application layer

Provider-level fraud detection is essential, but it's a last line of defense. Rate limiting at the application layer before the request reaches your OTP provider reduces fraud exposure and protects against misconfiguration or provider-side gaps.

What to rate limit:

• Per phone number: limit OTP requests to a fixed number within a rolling time window (e.g. 5 requests per hour per number)

• Per IP address: flag or block IPs generating unusual request volumes

• Per user session: limit requests within a single authentication flow

• Per device fingerprint: for mobile apps, device-level rate limiting catches bots that rotate phone numbers

Progressive friction. For users who hit rate limits, introduce friction before blocking entirely: a CAPTCHA challenge, a delay, or a step-up authentication request. This preserves legitimate users who've hit a limit accidentally while making automated attacks more costly.

Monitoring. Log rate limit hits and review them regularly. A sudden spike in rate limit events from a specific country, carrier prefix, or IP range is often the first visible signal of an emerging fraud campaign.

Prelude Verify rate limits requests per phone number automatically and uses IP address and device signals in its fraud scoring.

10. Consider Silent Network Authentication for mobile apps

For mobile apps, Silent Network Authentication (SNA) offers a meaningfully better verification experience than code-based OTP. It also removes an entire category of fraud exposure in the process.

How it works: Rather than sending a code for the user to enter, SNA verifies the user's phone number silently by checking that the device making the request is connected to the same mobile network account as the phone number provided. The carrier confirms or denies the match in the background, with no user interaction required.

Why it matters: Removing the code-entry step eliminates the friction that causes the majority of first-attempt failures. There’s no code to intercept or phish, though SNA doesn’t protect against SIM swapping on its own.

When to use it: SNA works best as a primary channel for mobile apps where the user is on a mobile data connection. For users on Wi-Fi or in markets where carrier SNA support is limited, SMS or WhatsApp OTP as a fallback ensures full coverage. The practical implementation is to attempt SNA first and fall back to SMS if the carrier check can't be completed.

Prelude supports SNA routing alongside SMS, WhatsApp, RCS, Telegram, Viber, Zalo, email, and voice (once enabled) from a single API call. See our complete SMS OTP guide for more on channel selection by use case.

Ready to optimize your verification flow? Prelude's Verify API handles routing, fraud detection, and multi-channel fallback from a single integration. See how it works or get started for free.