In short
- SMS OTP: proves a mobile number; works on any phone, no app needed.
- Email OTP: proves an inbox; suited to verifying an email address.
- Push approval: needs your app on the device; suited to customers already signed in to it.
- Standards view: NIST SP 800-63B restricts SMS and excludes email for out-of-band authentication.
- Digital Connect sends SMS OTP, with fraud protection, country blocking, spending limits and a delivery receipt for each message.
SMS OTP, email OTP verification and push compared
| SMS OTP | Email OTP | Push approval in your app | |
|---|---|---|---|
| What it proves | The customer can receive messages at this mobile number | The customer can open this inbox | The customer holds the device where your app is signed in |
| What the customer needs | A mobile phone with a SIM | An email account they can open | Your app installed, signed in, notifications allowed |
| Needs your app? | No | No | Yes |
| Needs an internet connection? | No | Yes | Yes |
| Typical use | Sign-up and login for any customer, mobile number verification, payment confirmation | Verifying an email address, account recovery codes | Approving logins and actions for app users |
| Points to manage | SIM change and number porting; artificially inflated traffic on OTP screens | Inbox access; NIST excludes email for out-of-band authentication | Customers without the app, or with notifications off |
What NIST SP 800-63B says
NIST Special Publication 800-63B is a United States digital identity standard that many security teams use as a reference. On the channels above it says:
| Topic | What the standard says |
|---|---|
| SMS and voice | Use of the public telephone network for out-of-band verification is restricted. |
| Alternatives | Verifiers shall make alternative authenticator types available to all subscribers. |
| Risk signals | Verifiers should consider risk indicators such as device swap, SIM change and number porting before sending a code by SMS or voice. |
| Email shall not be used for out-of-band authentication. Codes that confirm an email address, or recovery codes, are not authentication and are outside this rule. |
Source: NIST SP 800-63B. Check which standard your sector regulator expects you to follow.
Which channel for which job
- Verifying a mobile number: SMS. It is the channel that proves the customer can receive messages at that number.
- Login for customers who may not have your app: SMS, with an alternative method offered for customers who want one.
- Verifying an email address: an email code or link.
- Approving actions inside your app: push, with SMS as the fallback when the app is not available.
- High-value actions such as payments or a change of mobile number: combine methods, and check risk signals before you send a code.
Making SMS OTP safer
On Digital Connect:
- Fraud protection, country blocking and spending limits on your account, which limit the cost of artificially inflated traffic.
- API access limited to whitelisted IP addresses or a VPN connection.
- A delivery receipt for each message, so failed deliveries can trigger your fallback.
- Message templates approved by your team and by Interkey before use.
In your own systems:
- Limit how often one number, device or session can request a code.
- Check risk signals, such as a recent SIM change or a new device, before high-value actions.
- Offer an alternative method, as NIST recommends.
See the OTP implementation checklist for expiry, retries and testing.
SMS OTP rules in Saudi Arabia
- Say why the code was sent. CST's regulations for SMS anti-spam (version 3, October 2022, Decision 493/1444) require a message containing a one-time password to state its purpose, not the code alone (clause 4.6.2).
- Send under a registered sender name. Interkey registers your sender name with the operators through CST's central bulk-SMS system during onboarding.
- Use an authorised provider. Interkey holds CST's permit to provide short message services (SMS).
For wording that meets these rules, see our OTP message templates.
Questions teams ask about OTP channels
Is SMS OTP still acceptable?
NIST SP 800-63B allows SMS for out-of-band verification as a restricted option: offer an alternative authenticator and consider risk signals such as SIM change and number porting. Check what your sector regulator expects.
Should we switch from SMS to email codes?
Not for authentication if you follow NIST SP 800-63B, which says email shall not be used for out-of-band authentication. Email codes remain suited to confirming an email address.
Does Interkey send email or push codes?
No. Digital Connect sends SMS. Your app or identity system decides which channel to use and calls Digital Connect over REST, SMPP or SOAP when it sends an SMS code.
Can SMS be the fallback for push?
Yes. Your app decides when to fall back, and sends the SMS code through the Digital Connect API.
How is OTP SMS priced?
By quote. OTP traffic is priced differently from marketing traffic.