SMS OTP vs WhatsApp, email and voice codes: which to use in 2026

Editorial team · updated 23 September 2026 · facts checked 23 September 2026

For one-time codes in the US, Brazil and Mexico, send SMS through a verification API with fraud protection on, offer WhatsApp where users have it, confirm email addresses by email, and keep voice as a gated fallback. SMS OTP (a code sent by text) reaches nearly everyone but costs more than WhatsApp in each market, and NIST calls it "restricted".

We checked every price and rule here on 23 September 2026: NIST SP 800-63B-4, CISA and OWASP guidance, Meta's authentication-template docs and rate files, and seven verification APIs' docs and pricing pages. No codes were sent; delivery and adoption claims are the vendors' own.

SMS vs WhatsApp vs email vs voice OTP: the comparison table

SMS has the widest reach and the worst fraud exposure; WhatsApp is the cheapest phone channel in all three markets but reaches only its users; email costs almost nothing but NIST rules it out as an authenticator; voice reaches landlines and draws toll fraud.

None of the four is phishing-resistant. Checked 23 September 2026; sources below.

Cost per code in the US, Brazil and Mexico

Two kinds of price sit here, not directly comparable. A raw channel price covers delivery only; your backend generates, expires and checks the code. A verification API does that for you, and most charge their verification fee only when the user enters the code correctly.

Meta: authentication rate effective 1 July 2026, first volume tier, from Twilio's and Telnyx's rate files; the 1 October 2026 cards leave these rates unchanged, per our WhatsApp pricing breakdown. SES: $0.16 per 1,000 emails. AWS Notify: $0.045 per message for the first 25,000 a month plus the SMS price ($0.00774 + $0.00421 carrier fee US, $0.03 Brazil, $0.10 Mexico). Twilio: $0.05 per successful verification plus $0.0083 per US SMS or $0.0034 per US WhatsApp template, as printed; Brazil and Mexico channel fees aren't printed; voice uses the outbound per-minute rates (to mobiles in Brazil and Mexico) on the Voice pages the Verify page links. Telnyx: "$0.03 per successful verification + SMS API pricing", though the same page's headline says "From $0.05" with delivery included; its rate sheet shows two SMS rates each for Brazil and Mexico. Plivo: no verification fee, channel rates from its Verify page, but Verify is sold through sales with a $1,000 monthly minimum, and countries that need sender pre-registration require the $10,000 tier. Vonage: €0.052 per successful verification (December 2025 capture; the live page sat behind a bot check) plus price-list SMS rates. Sinch doesn't publish Verification prices; Zenvia's 2FA API is quote-only.

Before verification fees, AWS's SMS price is about 3.5 times Meta's authentication fee in the US, 4.4 times in Brazil and 11.8 times in Mexico. Billing widens the gap: Meta charges only for delivered templates, while Twilio charges its SMS fee per SMS, Sinch bills every attempt and AWS Notify every message, so resends cost money. Plivo says failed and fraudulent attempts aren't charged.

At 1,000 codes a month, the scenario our OTP rankings price, that is $56.95 through Notify against $3.40 in Meta fees for US users, and $145 against $8.50 for Mexican ones.

How secure is each OTP channel?

NIST's current guideline, SP 800-63B-4 (final, July 2025, superseding the 800-63-3 edition), names one restricted authenticator: "the use of the PSTN for out-of-band authentication". That means SMS and voice.

• SMS and voice: use of the PSTN "is restricted". Accepting it means offering an unrestricted alternative, warning users, assessing the risk and keeping a migration plan. Verifiers "SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior)" before sending.
• Email: "Email SHALL NOT be used for out-of-band authentication", citing password-only access, interception at mail servers and DNS rerouting. Codes "sent to validate email addresses" and recovery codes are exempt.
• Messaging apps: a phone-bound device may receive the secret "via the PSTN (i.e., SMS or voice) or an encrypted instant messaging service". NIST names no app; WhatsApp's end-to-end-encrypted authentication messages fit the second route, which isn't restricted.
• All four: "Out-of-band authentication is not phishing-resistant." A fake site can relay a typed code.

NIST's verifier rules make a sound baseline for any channel: codes of at least six digits, valid 10 minutes at most, accepted once, and no more than 100 consecutive failed attempts per account, a count that a new code doesn't reset.

CISA ranks "text or email code" last among MFA methods: "the weakest protection", for use "only if stronger options aren't available". The OWASP cheat sheet says SMS and phone-call codes "should not be used" for applications holding personal data or carrying financial risk. Both point further: CISA puts security keys first, and OWASP recommends migrating to TOTP apps, push or WebAuthn/FIDO2.

SIM swap, recycled numbers and shared inboxes

For SMS and voice the weak point is the number: a SIM swap or port-out hands it to an attacker.

WhatsApp's weak point is ownership. Meta's best-practice page warns that WhatsApp "does not enforce ownership of the phone number past initial registration", so the previous owner of a recycled number may still hold the account. Meta's fix: send a first code while the user is logged in, store the identity hash Cloud API returns and include it in later sends, so delivery fails if the account behind the number changes. Authentication messages can't be forwarded and, on Cloud API, reach only the user's primary device.

Email's problem is circular: passwords are usually reset by email, so whoever owns the inbox owns both factors, as Twilio's channel guide notes. For voicemail, Twilio Verify asks the callee to press a random key before reading the code.

WhatsApp OTP: authentication templates, autofill and price

WhatsApp codes must go in an authentication template. Meta fixes the text ("<VERIFICATION_CODE> is your verification code"), with an optional "do not share" line and an expiry line of 1 to 90 minutes. URLs, media and emojis aren't allowed.

The button type decides how much typing is left (Meta):

• Copy code puts the code on the clipboard, on any device.
• One-tap autofill opens your app and hands it the code; Meta's "preferred solution". Android only; other devices get copy code.
• Zero-tap passes the code to your Android app without opening WhatsApp. Yet Meta's zero-tap page advises: "Do not make WhatsApp your default password/code delivery method."
• iOS: from 15 June 2026, on iOS 26 and later, keyboard suggestions offer the code from the push notification with no integration work.

Keep the template's time-to-live within the code's expiry; Meta's default is 10 minutes, adjustable from 30 seconds to 15 minutes (TTL docs).

Meta bills each delivered authentication template at the recipient country's rate: $0.0034 US, $0.0068 Brazil, $0.0085 Mexico. Higher "authentication-international" rates apply only to recipients in nine countries (Egypt, India, Indonesia, Malaysia, Nigeria, Pakistan, Saudi Arabia, South Africa and the UAE), per Meta. Unlike marketing templates, they are delivered to US numbers. Approval steps are in our WhatsApp Business API guide and Cloud API tutorial.

The only adoption figure we found is a vendor's: Twilio states that 20 to 40 % of its Authy users in Brazil, India, Indonesia and Germany picked WhatsApp. It gives none for the US.

Sender registration by channel and country

SMS registration is slow; verification APIs avoid most of it.

• United States. Your own 10-digit number needs A2P 10DLC registration, a toll-free one toll-free verification. Twilio's 10DLC page says that for verification texts only "you can use Twilio Verify rather than registering". AWS Notify uses AWS-managed numbers but caps new configurations at 200 messages a day until a tier-upgrade review.
• Brazil. Twilio's Brazil guidelines limit domestic long codes to person-to-person messaging; app traffic uses short codes, registered alphanumeric sender IDs or international numbers.
• Mexico. Twilio's Mexico guidelines say "current regulations only allow OTP (One-Time Password) traffic from long codes", best-effort, and recommend a +1 number, a registered alphanumeric sender or a short code.
• WhatsApp. A Business Account, a number and an approved authentication template. New portfolios can reach 250 unique users a day outside a customer-service window until business verification or quality history lifts the limit (Meta).
• Email. No carrier registration; you authenticate your domain with SPF, DKIM and DMARC (transactional email guide).

SMS pumping, toll fraud and rate limits

SMS pumping targets OTP forms. Twilio's fraud guide describes fraudsters using a phone-number field to trigger texts to number ranges one mobile operator controls, then taking a share of the revenue. Toll fraud is the voice version: calls to premium international numbers, billed to you per minute.

Controls from NIST and the providers:

1. Allow only the countries you serve.
2. Rate-limit per number, prefix, IP and device, with growing delays between resends.
3. Put a bot check before the "send code" button.
4. Hide "call me instead" until SMS has failed; Twilio's example waits for three time-delayed SMS attempts. Disable voice if you don't use it.
5. Look up the line type and send SMS only to mobile numbers.
6. Alert when conversion (codes approved ÷ sent) drops in a country.
7. Cap failed checks per account (NIST: 100 at most) without resetting on a new code.

Built-in protection varies (see the provider table below). Twilio's Fraud Guard is on by default but "protects only the SMS channel", with false positives below 1 % at the default level and below 2 % at Max. Sinch rejects rapid repeat requests to one number (error 42901) but leaves allow-or-deny decisions to your backend; Telnyx's guide puts rate limiting and anomaly detection on your server.

WhatsApp and email pay no carrier revenue share, so the pumping model doesn't pay there; Twilio states WhatsApp "isn't exposed to telecom-network fraud". Rate-limit them anyway: bots can burn your WhatsApp messaging limit or pile up email bounces.

Fallback order: how verification APIs switch channels

A fallback resends the code over a second channel when the first fails:

• Twilio Verify (channel selection): WhatsApp falls back to SMS if SMS is enabled; SMS is upgraded to RCS where RCS performs at least as well, and RCS falls back to SMS; Silent Network Auth falls back to SMS with channel=auto. A code stays valid 10 minutes and a new request in that window returns the same code, so either message works.
• Vonage Verify (workflow): you list channels in order, "the first channel in the list is used first", and the next runs if the code isn't entered within channel_timeout (up to 900 seconds). Silent authentication must come first.
• Meta: a zero-tap template that fails WhatsApp's eligibility checks shows a one-tap or copy-code button; one-tap falls back to copy code.

A workable order in all three markets: WhatsApp first if the user chose it and your Android app finds WhatsApp installed, SMS second, voice only after repeated SMS failures. Email first where the address is the account identifier. If delivery-status callbacks drive the switch, verify their signatures; each provider card shows the provider's scheme.

Verification APIs compared: channels, fraud controls and billing

All seven verification APIs in our dataset send SMS codes. Rows come from the provider cards, checked 23 September 2026.

Our OTP rankings score these features with published weights: fraud protection 18, managed codes 14, SMS 10, WhatsApp 10, rate limiting 10, analytics 10, silent network auth 8, localized templates 8, voice 6, email 6. Price is scored on 1,000 successful SMS verifications a month, with separate views for the US, Brazil and Mexico.

When to pick each channel

SMS OTP

Pick it as the default phone channel when you can't predict what users run, through a verification API or a registered sender. Cons: NIST's restricted label; SIM swap and porting; pumping fraud; in Mexico AWS's SMS price alone is 11.8 times Meta's WhatsApp fee. Not a fit if it would be the only second factor on an app with financial or health data (OWASP), or you can't set geo permissions and rate limits before launch. For autofill, end the text with @yourdomain.com #123456: Safari offers the code through autocomplete="one-time-code", Chrome on Android through the WebOTP API, both only on that domain (web.dev). Our SMS API tutorial for Node.js and Python has the sending code.

WhatsApp OTP

Pick it next to SMS for Brazilian and Mexican users who choose it. Cons: WhatsApp users only; one-tap and zero-tap are Android-only; recycled numbers need the identity-hash check; a Business Account and approved template come first. Not a fit if it would be your only channel; Meta's zero-tap guidance says not to make it the default.

Email OTP

Pick it to confirm an email address, or for code sign-in on low-risk apps. Cons: NIST forbids it as an out-of-band authenticator; the inbox usually controls password resets too; spam-folder delays. Not a fit if you need a second factor independent of the password.

Voice OTP

Pick it for landline users, people who can't read a text, and as the last fallback. Cons: restricted like SMS; toll fraud; Twilio's Fraud Guard doesn't cover it; per-minute billing ($0.0663 to Brazilian mobiles at Twilio, $0.0210 at Plivo). Not a fit if users could trigger it from the first sign-up screen.

Which OTP channel to use: a decision list

1. Can you offer passkeys? Do, and keep codes for enrollment and recovery; no OTP channel is phishing-resistant.
2. Is the code confirming an email address? Send it by email.
3. Users mostly in Brazil or Mexico, on Android? Offer WhatsApp with one-tap autofill first and SMS as the fallback.
4. Users mostly in the US? Send SMS through a verification API, which spares you 10DLC for codes, and add WhatsApp as an option.
5. Money or health data? Codes for enrollment only; authenticator app or passkey for sign-in.
6. Landline users? Add voice behind a delay, only for the countries you serve.
7. Whatever you pick, ship the fraud controls above before launch.

Related guides

• One-time password (OTP): meaning and how it works
• OTP and verification API rankings, with US, Brazil and Mexico views
• SMS API rankings
• Twilio alternatives: 15 SMS, OTP and WhatsApp APIs ranked against Twilio, Verify included
• WhatsApp API provider rankings
• How to send a text message with an API in Node.js and Python
• WhatsApp Business API guide
• WhatsApp Business API pricing in 2026
• Transactional email guide: SPF, DKIM, DMARC
• A2P 10DLC registration guide

About this guide

The PingMyUsers editorial team wrote this comparison for developers choosing how to send sign-up, login and payment-confirmation codes; Sensaria AG in Switzerland operates the directory. Providers do not pay for placement, and none reviewed this page. This is not legal or compliance advice; NIST writes for US federal systems, and we quote it as the most detailed public reference. To report an error, email contact@sensaria.ch with the page and the source that shows the correct fact.

Methodology

On 23 September 2026 we read each source listed on this page: NIST, CISA and OWASP guidance, Meta's template, pricing and time-to-live docs, and each provider's verification docs and pricing pages. Prices are list prices as printed, in the provider's currency, first volume tier; per-code totals add the documented fees and nothing else. We did not send codes or open accounts.

Section order follows 130 searches an AI search engine ran for 10 phrasings of this question. Scores follow our methodology.

Last updated

23 September 2026: first version, all facts checked that day. Next scheduled re-check: March 2027, or sooner if Meta's authentication rates, NIST SP 800-63B or a provider's verification pricing changes.

Frequently asked questions

Is SMS OTP still secure enough in 2026?

For most consumer sign-ins, yes, with fraud controls on. NIST SP 800-63B-4 calls SMS and voice "restricted": allowed if you offer an unrestricted alternative and check for SIM changes. CISA ranks text and email codes as the weakest MFA option.

Should I send OTP via SMS or WhatsApp?

In Brazil and Mexico, offer both. WhatsApp costs $0.0068 (Brazil) and $0.0085 (Mexico) per code in Meta fees, far below SMS, and autofills on Android. SMS reaches people without WhatsApp, and Meta's zero-tap guidance advises against making WhatsApp the default.

Is WhatsApp OTP cheaper than SMS OTP?

Yes, in all three markets. Meta charges $0.0034 per delivered authentication template to US numbers, against $0.0083 per SMS at Twilio or $0.01195 with carrier fee at AWS. Verification API fees, $0.05 per success at Twilio, apply to either.

Is email OTP allowed by NIST?

Not as an out-of-band authenticator: SP 800-63B-4 says email "SHALL NOT be used" for it. Codes that confirm an email address or recover an account are exempt.

What is voice OTP and when should I use it?

A call that reads the code aloud. Use it for landline users and as a last fallback after several SMS attempts; offered early, it invites toll fraud.

Do I need 10DLC registration to send OTP codes?

Not through a verification API's own numbers: Twilio says Verify users can skip A2P 10DLC, and AWS Notify uses AWS-managed numbers. Codes from your own 10-digit number need a 10DLC campaign.

What is SMS pumping and how do I stop it?

Fraudsters use your phone-number field to trigger texts to numbers whose revenue they share. Allow only your countries, rate-limit per number, prefix and IP, add a bot check and enable the provider's protection.

Can WhatsApp autofill OTP codes on iPhone?

Since 15 June 2026, on iOS 26 and later, the keyboard offers the code from WhatsApp's push notification, no integration needed. One-tap and zero-tap buttons are Android-only; iPhones show copy code.