OTP verification is a service that sends a one-time password (OTP) to a phone number and checks the code that the person types back. If the code matches, the app knows that the person has that phone in hand at that moment. Indian apps use it to sign people in, to confirm a new phone number and to approve payments.
A one-time password is a short code, usually four or six digits, that works only once and only for a few minutes. Because the code goes to the phone, it proves possession: the person signing in has the SIM card that belongs to the number.
Take, for example, a shop owner in Mysuru who buys a new phone and installs her bank's app. She types her mobile number. The app asks the OTP service, through an API, to verify that number. An API is a fixed format in which one program asks another to do something. The service creates the code 482917. It stores the code with a time limit of five minutes and a limit of three wrong attempts. Then it sends the SMS through an A2P SMS aggregator to her operator. The SMS arrives within a few seconds, and she types the code. The service compares it with the stored code, finds a match and tells the app. That code can never be used again.
What happens when the SMS does not arrive? A good OTP service tries again by another route. It can send the code by WhatsApp, or place a voice call that reads the code aloud, through a messaging and voice API platform. The service also prevents misuse. For example, it limits how many codes one number may request in an hour. Otherwise, a fraudster could make the app send thousands of paid SMS messages to numbers that he controls.
An SMS OTP has a known weakness. If a fraudster persuades the operator to issue a new SIM card for your number, your OTPs go to him. In India, a replaced SIM cannot send or receive SMS for its first 24 hours, but after that, every OTP reaches him. This trick is called a SIM swap. So some apps first ask the operator, through network APIs, whether the SIM was swapped in the last few days. A fraudster may also simply phone you and ask for the code. Tools for spam call blocking help against that.
OTP verification is one kind of multi-factor authentication (MFA), a second proof in addition to a password. Companies use MFA for their own employees, often with a code from an app instead of an SMS. Consumer apps usually get OTP login as part of customer identity and access management (CIAM). When you pay online by card in India, your bank also asks for a second proof before it approves the payment. This is usually an OTP, but since April 2026 the rules of the Reserve Bank of India also let banks use other proofs, such as a fingerprint check in the bank's app. The bank's page for this opens during the checkout of the payment gateway.