You sign up for a delivery app and it asks for your phone number. Seconds later a text arrives: Your code is 481920. It expires in 5 minutes. You type it in, and you are through.
That is SMS verification — an SMS OTP, or one-time passcode. It is the most widely deployed identity check online, and one of the weakest.
What a one-time passcode is
An OTP is a short numeric code, usually four to eight digits, valid once and only for a few minutes. It is not a password: you never choose it and never reuse it. Its only job is to answer one question — does the person at this form control the number they typed?
That is narrower than people assume: it does not prove who you are, only that someone can read messages sent to that number.
The flow, step by step
- You enter your number. The service normalises it to international format and checks it is plausible.
- The server generates a code. A short random number is stored server-side with your number, an expiry (typically 3–10 minutes) and an attempt counter. Careful systems store a hash of it, not the code.
- An SMS gateway delivers it. The service hands the message to a bulk SMS provider, which routes it through carrier networks to your handset — the hop causing most delays.
- You type it back. Modern phones often read the code from the notification and autofill it, so you may never see it.
- The server verifies. It checks the code, the expiry and the failed-attempt count, then invalidates the code so it cannot be replayed.
The attempt limit matters: six digits is a million combinations, plenty only if the server stops you after a few wrong guesses.
Why so many services use it
SMS is not popular because it is strongest. It clears four hurdles at once: it costs fractions of a cent per message; it needs no app install; it works on any phone, including devices with no internet; and it raises the cost of bulk fake signups, since phone numbers are much harder to obtain in bulk than email addresses.
That last point is the real motivation. Phone verification is a fraud filter first and a security control second — hence the growing hostility to virtual numbers.
Where SMS actually fails
- SIM swap. An attacker convinces your operator — via social engineering, a bribed employee or leaked data — to move your number to their SIM. Every code then goes to them, and nothing at the app level stops it.
- SS7 and network interception. The legacy signalling protocol linking global carriers assumed trusted operators; parties with network access can sometimes intercept or reroute messages.
- Phishing and real-time relay. A fake login page takes your credentials, forwards them to the real site instantly, triggers a genuine OTP, then asks you for it. The code is authentic — just used by someone else. Nothing binds it to the site you are on.
- Codes on the lock screen. Notification previews show the code to anyone holding your phone or standing behind you.
- Delivery failures. Carrier filters drop messages, roaming can break delivery, and losing your number can lock you out permanently.
Good enough — and when it is not
For a delivery account, a forum login or a shop that stores no card details, SMS is a fair trade-off: it stops credential stuffing and casual takeover, and a breach costs little.
Where a takeover would be genuinely damaging — your primary email, your bank, a crypto exchange, cloud infrastructure, your password manager, your domain registrar — SMS should not be your only second factor. Move to an authenticator app, a hardware key or a passkey; codes generated on your device cannot be intercepted or redirected by a SIM swap, because they never cross a network. Our explanation of what a TOTP code is covers the mechanism, an authenticator app versus SMS 2FA shows where each belongs, and the free 1mail 2FA code generator runs in your browser.
The privacy question nobody asks at signup
Your phone number is a durable identifier. Most people keep the same one for a decade or more, tied to a contract in their real name — an excellent key for linking activity across unconnected services, which is why data brokers value it. Every number you hand over also joins that company's breach surface: when the database leaks, your number leaks too, feeding spam calls and smishing.
A sensible position: give your real number to services that genuinely need to reach you, and be reluctant elsewhere. For sites you expect to use once, a temporary phone number for receiving SMS keeps your own out of another database, and a disposable inbox from 1mail handles the confirmation email the same way. But never use a public SMS number for an account holding money or personal data — those messages are visible to anyone.
FAQ
Why does my code sometimes arrive after it has expired?
SMS has no delivery guarantee. Messages queue at the gateway, at routing providers and at your carrier, and roaming adds hops. Request a fresh code rather than reusing an old message.
Is SMS two-factor authentication better than none?
Clearly yes. It blocks the most common attack of all: reuse of a password leaked in someone else's breach. The case against SMS is not that it is useless, but that people over-trust it and leave it guarding accounts deserving more.
Can I use a temporary number for any signup?
Technically often, sensibly no. Many platforms reject virtual number ranges, and if you later need account recovery you cannot receive the code. Use temporary numbers for throwaway signups only.
