What is an OTP text message?

What OTP means in a text

OTP stands for one-time passcode, also written one-time password. The same message is called a verification code, a security code, a 2FA code or an authentication code depending on the service; they are all the same thing, a secret generated by the service for one transaction and sent to a device you have already registered. Because the code is created fresh each time and dies after use or after a few minutes, knowing an old one is worthless, which is the whole point.

How an OTP text works

1. Something needs confirming. A login from a new device, a password reset, a payment above a threshold, a change of email address, or a new sign-up that has to prove its phone number is real.
2. The service generates a code and stores it, with an expiry, against the account.
3. The code is sent as an application-to-person text to the registered number, over RCS where the phone supports it and SMS where it does not.
4. The person types the code back into the app or website, or the phone offers to fill it automatically.
5. The service checks it: right code, within the time limit, not already used. Pass, and the action proceeds; after a handful of wrong attempts the code is voided and a new one has to be requested.

The code travels one way only. A business sends a passcode; it never asks for one back, so any message asking you to reply with a code, or to read one out over the phone, is fraud whatever name it shows.

Why the code comes from a short code or a number you do not know

US carriers only deliver business text traffic from registered sender types: a 10DLC local number, a verified toll-free number or a short code. High-volume OTP senders usually use a short code because of its throughput, so the code arrives from five or six digits with no name attached. That anonymity is the weakness: an SMS from 55-555 reading "Your bank code is 482913" looks identical whether the bank sent it or a fraudster did.

RCS fixes the sender side. In RCS Business Messaging every message comes from an RBM agent with a declared use case, and Google's agent model defines OTP as one of four: OTP, transactional, promotional and multi-use, where multi-use combines transactional and promotional but deliberately excludes OTP. An agent approved for one-time passcodes exists only to deliver them, which is why a bank often runs a separate OTP agent from its alerts and marketing agents.

Is SMS OTP secure?

Secure enough that it remains the most common second factor, and weak enough that the US standards body has said so in writing. NIST's Digital Identity Guidelines, SP 800-63B, classify out-of-band authentication over the public telephone network, meaning SMS and voice codes, as RESTRICTED, and tell verifiers to weigh risk signals such as a SIM change, a device swap or a recent number port before sending a code that way. The threats are SIM swapping, where an attacker takes over the victim's number, and phishing, where the victim is talked into typing a real code into a fake page or replying with it.

Three things reduce the risk without abandoning the channel:

• A verified sender. Over RCS the phone draws the brand name, logo and checkmark from the approved agent record; a fraudster cannot reproduce that identity, so a customer can tell the real code from an imitation. Can RCS be spoofed? explains why.
• A code bound to the site. The origin-bound one-time code format puts the website's domain on the last line of the message (@example.com #482913), so the browser or phone only auto-fills the code on that domain and a phishing page cannot harvest it.
• A way to say no. Over RCS the same message can carry an "it wasn't me" suggested reply, so a customer who did not request a code can flag the attempt in one tap; the fraud alerts use case shows the flow.

OTP over RCS versus SMS

Because the RCS message falls back to SMS on phones that cannot receive it, a business sends one OTP flow rather than two, and reach is unchanged. How does RCS fall back to SMS? covers the mechanics.

What a good OTP message looks like

A verification text should identify the sender, give the code, say how long it lasts and remind the reader never to share it. Sixty characters do the job:

Acme: your verification code is 482913. It expires in 10 minutes. Never share this code; Acme will never ask you for it.

@acme.example #482913

Keep the code on its own or at the end of a sentence so the phone's auto-fill can find it, and keep the domain line last. Do not include a link; a message that carries both a code and a link teaches customers to click links in security messages, which is exactly what phishing relies on.

Consent and compliance

A passcode is a transactional message the customer has asked for by entering their number, so it does not need marketing consent, but the number does have to be one the customer supplied for the purpose. Never send promotions from the OTP sender: on RCS that is a use-case violation that puts the agent at risk, and on SMS it turns a message customers trust into one they learn to ignore. How does RCS consent work? and the RCS security best practices cover the rest.