OTP and SMS verification

The visitor enters a phone number or email address, receives a short code, and enters it back before the submission is accepted. The submission is bound to a channel somebody has to be able to receive on.

That is a different kind of check from everything else on this site. A challenge asks whether the client is a real browser. A trap asks whether the client behaves like a person. OTP asks whether a specific, rentable, chargeable resource is under the submitter’s control right now — and that is a question automation cannot answer with software alone.

Fabricated contact details, which is most of what people mean when they say spam. The cost of one fake submission moves from approximately zero to the cost of acquiring and controlling a phone number, and three or four orders of magnitude is not a hurdle — it is a different business model.

This is not theoretical. It is the single documented reversal in our whole research corpus: a channel written off as irredeemable by half of r/PPC, rehabilitated by adding OTP.

And it is being asked for, repeatedly, by people who cannot get it from the tool they are already paying for:

Where the payoff justifies the expense, and essentially nowhere else. Numbers can be rented from SMS-receiving services, and organised fraud runs SIM farms — but both cost real money per number, and that changes who bothers.

Nobody operates a SIM farm to waste a B2B sales rep’s afternoon. If you are a bank, a marketplace with payouts, or anything where a verified account is itself worth something, assume OTP will be attacked and budget for velocity checks and carrier lookups. If you are running demo requests for mid-market software, this is not your threat model.

The honest limit is elsewhere, and it is the one thing this page will not let itself skip. OTP proves a person was there. It does not prove the person was a buyer.

Every one of those people could have passed an OTP check. A verified human tire-kicker is still a bad lead. That is a different problem, and OTP was never trying to solve it.

Then the costs, stated plainly, because they are real. It is the most friction on this site: asking for a phone number at all costs completion, and asking someone to go and fetch a code costs more. It costs money per send, on a bill that scales with the attack. It excludes people — travellers on roaming, shared handsets, anyone who reasonably declines to hand a phone number to a company they are still evaluating. And SMS delivery is unreliable in exactly the moments you need it.

Use it when a phone number is a reasonable ask for what you are offering — a quote, a site visit, a callback, a demo where someone was going to ring them anyway. On those forms the friction is honest, because the number was the point.

Do not use it to gate an ebook. You will pay per message for a list you devalued at the door.

Where the ask is not natural, the sequenced version works well: accept the submission, then verify before it is routed to sales or counted as a conversion. You keep the partial submission either way, and you stop feeding unverified conversions to the ad platform — see offline conversion import.