Email OTP or SMS OTP?
Email OTP and SMS OTP compared on price in India, DLT, delivery, SIM swap and phishing risk, with when to use each.
Both send a short code the user types back. They differ on cost, setup, delivery and what an attacker needs to steal one.
Side by side
| SMS OTP | Email OTP | |
|---|---|---|
| Cost each in India | About Rs 0.10 to Rs 0.45 | A few paise to send; Rs 0.03 on SignOps |
| Setup | DLT entity, header and template registration | A verified sending domain (SPF, DKIM, DMARC) |
| Proves | The user has the phone number | The user has the inbox |
| Delivery | Usually seconds; can fail on weak signal or DND issues | Usually seconds; can land in spam if the domain is not set up |
| SIM swap risk | Yes | No |
| Phishing risk | Yes, users read codes out to callers | Yes |
| Works without a phone | No | Yes, on any device with email |
When SMS is the right choice
- You need to prove a phone number, for example for a delivery or payments app, or for KYC.
- Your users may not use email much.
Even then, you usually need it once per user, at signup.
When email is the right choice
- Logins for web apps and SaaS, where users already sign up with email.
- You want to avoid DLT registration and template approval.
- Cost matters at volume: 1 lakh logins a month cost about Rs 15,000 by SMS at Rs 0.15 and about Rs 3,000 by email at Rs 0.03.
Better than both for returning users
Codes of either kind can be phished. For users who already signed in on a phone:
- Push approval: the phone shows who is signing in and asks for a number match and Face ID. Nothing to read out.
- Passkeys: a fingerprint or screen lock, and nothing to phish at all.
A sensible flow: SMS or email once at signup, then passkeys or push approval for logins, with email codes as the fallback. See passkeys vs OTP and SMS OTP cost in India.