OTP (One-Time Password)

The most-sent message in the world

If you have signed up for almost any service in the last decade, you have received an OTP. They are the short numeric codes that show up in your messages app to confirm a login, verify a phone number, or authorize a payment. OTPs are the workhorse of two-factor authentication and the single largest A2P messaging category by volume globally.

Why OTPs are everywhere

OTPs solve a real problem cheaply. They prove that whoever is trying to log in (or sign up, or transact) has physical possession of the phone associated with the account. That is meaningful security, even though it is not bulletproof, and the user experience is essentially zero friction.

The shift from SMS to RCS for OTP

Historically OTPs ran almost entirely over SMS. Two pressures are pushing the category toward RCS:

• Phishing and SIM-swap fraud: SMS OTPs from anonymous senders are easy to spoof or intercept. RCS OTPs from a verified brand ship with the brand's logo and verified checkmark, which makes phishing dramatically harder because the fake message will not carry the badge.
• Brand experience: an OTP is often the first or only message a customer receives from a brand in a given session. Showing up as "Acme Bank" with a logo, instead of as an unbranded number, leaves a markedly better impression.

The compliance side

OTP delivery in the U.S. typically requires either a 10DLC registered sender or a verified short code or toll-free number. Carriers monitor OTP traffic carefully because it is a high-fraud target. Most platforms have specific OTP-routing logic, fallback chains, and delivery SLAs because the cost of a missed OTP is a stuck customer who cannot log in.

Beyond the code

Modern OTP messages on RCS often include not just the code but a tap-to-fill action so the user does not even have to type. Some platforms layer additional context, like "We saw a login attempt from Chicago, was this you," with confirm and deny buttons. That blurs the line between OTP and broader account-security messaging.