One Time Passcode
One-time passcode delivery for possession verification — SMS, Email, or combined. Multiple delivery providers available.
Checker Category: Possession
Used In Steps: SMS Link
Used In Workflows: Identity Verification, Continuous Re-Authentication, and all MobileMatch-based workflows
Overview
OTP checkers deliver a one-time passcode to the user's phone or email and verify that the user entered the correct code or tapped the link. They confirm possession of the registered contact method — not identity. Pair with PII and risk checkers for full layered verification.
Five variants are available covering different delivery channels and infrastructure providers. The variant configured for your workflow is determined at deployment time.
End User Requirements
Access to the registered phone number (SMS/Voice) or email address. Ability to receive and enter the code or tap the link within the expiry window.
Role in Layered Verification
Possession confirmation only. OTP proves the user has access to the registered device or inbox at the moment of verification. Does not corroborate identity — pair with an Authoritative Database or Phone Registration checker for identity assurance.
Variants
Delivery: SMS
Infrastructure: ID Dataweb native
Sends a one-time passcode via SMS using ID Dataweb's own delivery infrastructure. User enters the 6-digit code to confirm possession of the registered mobile number.
Assertions
| Assertion | Key | Description |
|---|---|---|
| Phone OTP Possession Check | test.device | Confirms that the provided phone number has passed a one-time password (OTP) check, confirming possession. Passes if OTP verification succeeds; fails if it does not. |
Notes
Additional attributes and configuration options coming soon.
Delivery: SMS
Infrastructure: Amazon Web Services (AWS SNS)
Sends a one-time passcode via SMS using AWS Simple Notification Service. User enters the code to confirm phone possession.
Assertions
| Assertion | Key | Description |
|---|---|---|
| Phone OTP Possession Check | test.device | Confirms that the provided phone number has passed a one-time password (OTP) check, confirming possession. Passes if OTP verification succeeds; fails if it does not. |
| Verification Message Sent Check | test.messageSent | Confirms that the verification message (e.g., OTP) was successfully sent. Passes if the message is sent; fails if delivery fails. |
Notes
Additional attributes and configuration options coming soon.
Delivery: SMS
Infrastructure: Telesign
Sends a one-time passcode via SMS using Telesign's delivery network. Telesign provides broad international SMS coverage. User enters the code to confirm phone possession.
Assertions
| Assertion | Key | Description |
|---|---|---|
| Phone OTP Possession Check | test.device | Confirms that the provided phone number has passed a one-time password (OTP) check, confirming possession. Passes if OTP verification succeeds; fails if it does not. |
| Verification Message Sent Check | test.messageSent | Confirms that the verification message (e.g., OTP) was successfully sent. Passes if the message is sent; fails if delivery fails. |
Notes
Additional attributes and configuration options coming soon.
Delivery: SMS or Email (user's choice)
Infrastructure: ID Dataweb native
Presents the user with a choice of delivery method — SMS or email. Sends a one-time passcode to the selected channel. User enters the code to confirm possession of the chosen contact method.
Assertions
| Assertion | Key | Description |
|---|---|---|
| Email OTP Possession Check | link.email_user | Confirms that the provided email address has passed a one-time password (OTP) check, confirming possession. Passes if OTP verification succeeds; fails if it does not. |
| Phone OTP Possession Check | test.device | Confirms that the provided phone number has passed a one-time password (OTP) check, confirming possession. Passes if OTP verification succeeds; fails if it does not. |
Notes
Present the delivery method choice to the user in your UI before this checker runs.
Delivery: Email
Infrastructure: ID Dataweb native
Sends a one-time passcode to the user's registered email address. User enters the code to confirm inbox access.
Assertions
| Assertion | Key | Description |
|---|---|---|
| Email OTP Possession Check | link.email_user | Confirms that the provided email address has passed a one-time password (OTP) check, confirming possession. Passes if OTP verification succeeds; fails if it does not. |
Notes
Email OTP confirms inbox access only — it does not verify that the email address belongs to the claimed identity. Pair with Email Risk checker for signal on the address quality before sending the OTP.
Testing & Expected Results
Testing follows SMS Link step procedures. See SMS Link for test credentials and step-by-step instructions.
Related Resources
→ SMS Link | → Phone Registration + Risk | → Identity Verification | → Continuous Re-Authentication
Updated 2 months ago