Voice call OTP: the fallback when SMS does not arrive

Voice OTP delivers the verification code in an automated call. It is the natural complement to SMS: it rescues users whose message did not arrive and reaches those who only have a landline.

What voice OTP is

It is an automated call in which a voice reads the one-time code, usually twice and digit by digit. The user listens and types it into the app or website, just as with an SMS OTP.

It does not replace SMS: it complements it. Most users will keep receiving the code by message; the call is plan B.

When a call makes sense

• The SMS did not arrive after a reasonable time: full phone memory, device filters or a one-off operator delay. See why an SMS is not delivered.
• The number is a landline. An SMS to a landline never arrives; a call does. Validating the number against Mexico’s National Numbering Plan lets you pick the right channel from the first attempt.
• Accessibility: some people find it easier to hear the code than to read it on screen.

How to combine SMS and voice without annoying users

The flow that works best is staggered:

1. Send the code by SMS.
2. If the user has not entered it after 30 to 60 seconds, show the option “Get the code by phone call”.
3. Call only when the user asks, using the same code or a new one with the same validity.
4. Limit attempts per number and per session.

Calling automatically without the user asking creates distrust and unnecessary costs.

What NIST says about SMS and voice

NIST SP 800-63B-4 classifies out-of-band authentication over the public telephone network, which includes SMS and voice, as a “restricted” authenticator. It does not ban it, but it asks verifiers to offer alternatives and to consider risk signals before using it, such as a SIM change or recent number porting.

In practice, SMS and voice remain the most universal channels; what matters is matching the factor to the risk of each operation. We explain it in MFA: SMS OTP, authenticator app or push.

The risk to control: call pumping

An attacker can use your verification form to trigger thousands of calls or SMS to numbers that generate revenue for them. To prevent it:

• Restrict destinations to the countries where you operate.
• Apply limits per number, per IP and per device.
• Require a prior check (for example, a captcha) before offering the call.
• Monitor abnormal spikes in requests and stop sending automatically.

Sources

• NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, section 3.1.3.3 (out-of-band authentication using the PSTN). pages.nist.gov
• OWASP, Multifactor Authentication Cheat Sheet. owasp.org

Frequently asked questions