OTP fallback means sending the verification code through a second channel, such as a voice call or WhatsApp, when the SMS does not arrive or the user asks for another code. A good setup tries the cheapest reliable channel first, waits a short time, then switches channel, which raises verification success and limits SMS fraud costs.
Why one channel is not enough
Even good SMS routes fail some of the time: a network blocks traffic, a sender ID is not registered on one operator, a phone is in poor coverage, or a firewall filters the message. Each failed OTP is a user who cannot sign up or log in. Fallback turns many of these failures into successful verifications. The basics of a reliable first attempt are in OTP SMS best practices.
The main channels compared
| Channel | Strengths | Weaknesses |
|---|---|---|
| SMS | Works on every mobile phone, no app needed, autofill support on Android and iOS | Price varies a lot by country, sender ID rules, target of SMS pumping |
| Voice call (text-to-speech) | Works on landlines and in poor data coverage, good for users who cannot read SMS | Users may not answer unknown numbers, needs CLI and voice routes per country |
| WhatsApp authentication message | Delivered over data, often cheaper than SMS in high-price countries, sender verified | User must have WhatsApp, template approval and Meta pricing apply |
| Other OTT or RCS | Rich and branded in supported markets | Coverage differs by country and device |
Designing the fallback flow
- Pick the primary channel per country. In countries where WhatsApp is widely used and SMS is expensive, WhatsApp first can make sense; elsewhere SMS first.
- Set a short wait. If the code has not been entered after 20 to 60 seconds, offer or trigger the next channel.
- Let the user choose. A "Call me instead" or "Send via WhatsApp" button works better than switching silently.
- Keep the same code across channels or invalidate the old one, so users are not confused by two different codes.
- Limit total attempts per number and per session across all channels.
Voice OTP in practice
A voice OTP call reads the code with text-to-speech, usually twice, in the user's language. It needs a voice route that delivers your caller ID, because many people do not answer calls from hidden or unknown numbers. See CLI vs non-CLI routes and local CLI routes. Voice OTP can also be abused by fraudsters who trigger calls to premium numbers, so apply the same rate limits as for SMS. See International Revenue Share Fraud.
WhatsApp authentication in practice
On WhatsApp, OTP messages are sent through the WhatsApp Business Platform using approved authentication templates, which can include a copy-code or one-tap autofill button. Templates and pricing are set by Meta and change over time, so check the current rules before you plan costs.
Fallback and fraud
Fallback does not fix SMS pumping; it can spread it to other channels. Protect the trigger, not just the channel: bot detection on the form, rate limits per number, IP and prefix, and alerts when codes are sent but not entered. Track conversion by channel and country: it shows where the primary channel is failing and where fallback is being abused.
Routes for each channel
A fallback setup needs good A2P SMS routes and, for voice OTP, VoIP termination with CLI. VoIPMatcher sources both from its carriers and manages them for you. Request an OTP SMS route or request a voice route for OTP calls.
Frequently asked questions
What is voice OTP?
Voice OTP is a one-time password delivered by an automated phone call instead of a text message. A text to speech system reads the code, usually twice, in the user's language. It works on landlines and in poor data coverage, and is common as a fallback when an SMS code does not arrive within a short wait.
Is WhatsApp OTP cheaper than SMS OTP?
Often, but not everywhere. WhatsApp authentication messages are delivered over data and can cost less than SMS in countries where operators charge high A2P rates. Meta sets the pricing and changes it over time, and the user must have WhatsApp installed. Compare the current price per message for each country before choosing a primary channel.
Should the fallback code be the same as the SMS code?
Either keep the same code across channels or invalidate the first one when the second is sent. What matters is that the user is never left with two valid codes and no idea which one to enter. Limit the total number of attempts per number and per session across all channels together.
How long should I wait before OTP fallback?
A common window is 20 to 60 seconds after the SMS was sent. If the code has not been entered by then, offer or trigger the next channel. Letting the user choose with a button such as Call me instead usually works better than switching silently, and it avoids unnecessary voice and WhatsApp costs.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.