What is an OTP (one-time password)?
An OTP is a short single-use code — usually 4–8 digits by SMS — that proves possession of a phone or device. It is the world’s most common second authentication factor and its biggest SMS traffic class.
Definition
A one-time password (OTP) is a short code valid for a single login or transaction — typically 4–8 digits delivered by SMS, email, voice call, or generated locally by an authenticator app (TOTP, per RFC 6238). Possession of the code proves possession of the channel: enter the code sent to your phone and you have demonstrated control of that number. OTPs expire in minutes, cannot be replayed, and are the workhorse of phone verification at signup, two-factor login, and payment confirmation (3-D Secure).
SMS OTP dominates because every phone can receive it with zero setup — verification traffic is one of the largest categories of A2P SMS worldwide. Its weaknesses are equally well known: codes can be phished in real time, intercepted via SIM swap or SS7 attacks, and the sending side can be exploited for SMS pumping fraud, where bots trigger OTP sends to premium-rate ranges. Defences are layered: rate limits per number and IP, HLR checks that the destination exists before sending, monitoring for burst patterns, and stronger factors (TOTP, passkeys) for high-value accounts.
Why it matters
OTP flows sit exactly at the junction of security, cost, and UX: every fake or undeliverable send is money to fraudsters, every delayed one is a lost signup. Understanding the delivery chain behind the six digits is what keeps verification both cheap and trustworthy.