Key takeaways
- Put the code first or near the start, name the sender and say how long the code is valid.
- Keep the message to a single segment and avoid links.
- Limit how often codes can be requested and how many wrong tries are allowed.
- Use the origin-bound format so browsers and phones can fill the code in safely.
What a good message contains
An example: “ExampleCo code: 482915. Valid for 10 minutes. Never share this code.” It is short, specific and fits in one message.
- The code, early in the text, in digits only
- Your brand or service name, so the person knows why it arrived
- The validity period, for example ten minutes
- A short line telling the person not to share the code with anyone
- No marketing, no extra links and no long explanations
Make it fill in by itself
Phones and browsers can offer to fill in a code from a text message. Browsers that support the Web OTP API look for a final line in the origin-bound format: an at sign, your domain, a space, a hash sign and the code. For example: @example.com #482915.
This also helps against phishing, because the code is offered only to the domain named in the message. Use it where your sign-in page supports it.
Limits that protect you and your users
- A short validity period and single use
- A cap on how many codes can be requested per number, per account and per device in a given time
- A cap on wrong attempts before the code is cancelled
- A pause before a new code can be requested, with a clear message on the screen
- Monitoring of requests per country and per number range, to catch abuse early
Speed matters more than for any other message
A code that arrives after the person has given up costs you a sign-up and a second message. Measure the time from request to delivery on your own traffic, by country and operator, and set a fallback: after a short wait, offer another way, such as a call or another channel.
How ZafeConnect fits
ZafeConnect carries one-time codes as A2P SMS over 190+ countries, with intelligent routing and fallback, delivery reports from the operators and local SenderID support. Reported delivery of over 98% is not a guarantee, so keep your own fallback and monitoring in place.