WhatsApp OTP: what to get right before you move off SMS

An authentication message is the one thing you send that a customer is actively waiting for. Nobody waits for a promotion. Everybody waits for the code.

That makes it the cheapest trust a business can buy, and the easiest to squander. Send too many, word them carelessly, or leave the customer unsure whether it worked, and you have trained somebody to ignore the one message they most needed to read.

What is a WhatsApp authentication message?

It is a one-time passcode delivered on WhatsApp instead of by SMS, sent through an approved template. Meta treats authentication as its own billing category, separate from marketing and utility, and from 1 October 2026 separate from service messages too.

There are three kinds, and the difference matters more than most businesses realise:

• One-tap autofill. The customer taps a button and the code is passed straight back to your app. Fewest steps, fewest mistakes, and only available where your app can receive it.
• Copy code. The customer taps to copy and pastes it into your site or app. The common choice, and the one most businesses start with.
• Zero-tap. The code is delivered to your app without the customer doing anything at all. The best experience when it fits, and the one with the most conditions attached.

Does moving to WhatsApp get you out of DLT registration?

Not exactly. It changes who the gatekeeper is.

To send commercial SMS in India you register with DLT, which TRAI mandates. That means an Entity ID, a registered six-character header, and every message template registered in advance, with variable parts marked up. Template approval typically takes three to seven working days. If the entity, header or template is not in the registry, operators drop the message — usually silently, with no error returned to you, which is why these faults are so hard to diagnose.

WhatsApp does not run over the telecom operators, so that particular registry does not apply. But Meta approves every template too, with its own rules about category and wording. You are not escaping approval. You are swapping a telecom regulator for a platform, with different rules and a different failure mode — Meta tells you when a template is rejected, which is more than the SMS route usually manages.

What do Meta’s own numbers actually show?

Meta publishes a case study on using WhatsApp one-time passcodes across its own apps. The figures are:

• 20% increase in account recovery success on Instagram
• 11% increase in account recovery success on Facebook
• 9% increase in new account creation on Instagram

Worth reading those carefully before quoting them at anybody, because four things are easy to miss.

It is Meta measuring Meta. Internal data, published by the platform that sells the product, with no independent verification. That does not make it wrong. It does mean it is a starting point rather than evidence.

The window is about a month. The recovery figures cover 23 January to 21 February 2025, and the account creation figure 23 January to 19 February 2025. A month is long enough to see a change and short enough to catch a seasonal one.

No baseline is given. A 20% increase is a different proposition depending on what it is 20% of, and the published figures do not say.

Meta does not isolate WhatsApp as the cause. Its own page attributes the improvement to security, phone number verification, user experience, delivery rates, targeting and coverage, alongside the move to WhatsApp. So the honest reading is that WhatsApp OTP was part of a package that worked, not that it caused all of the lift on its own.

Taken with those caveats, it is still the largest published deployment anyone has put numbers against, and the direction is the one you would expect: a channel people already have open, with better delivery than SMS, improves the odds that a code arrives and gets used.

What goes wrong?

Five things, and we have watched most of them happen.

Too many codes. Every authentication message is charged, so over-sending costs real money — but the bigger cost is attention. A customer who receives four codes for one login stops treating the message as important, and the next genuine one is read as carelessly as the rest.

A promotional line inside an authentication template. The single commonest reason templates get rejected or reclassified. An offer, a tagline, even a cheerful closing line can push an authentication template into another category — where it is charged differently and judged by different rules. Authentication templates are deliberately plain. Keep them that way.

No confirmation that it worked. The customer enters the code and the conversation goes silent. They do not know whether they are in, so they request another code, and you pay for a second message to answer a question a single line would have settled.

A WhatsApp flow that does not match the rest of your support. If the code arrives from one number and your support conversation happens on another, or the tone and branding differ, the customer cannot tell whether either is really you. That is the exact circumstance a phishing attempt relies on.

Treating a returning customer as a stranger. Somebody who has verified with you eleven times gets the same cold sequence as somebody arriving for the first time. You already hold the history. Using it is the difference between a system that recognises people and one that merely processes them.

What does it cost?

Meta charges per delivered message, and authentication is priced as its own category at rates that vary by country. India has its own rate, as does every market you send into, and Meta publishes them and revises them periodically.

Two practical consequences. The first is that your cost is driven by how many codes you send rather than by how many customers you have, which is why the over-sending problem above is a budget problem as well as a trust problem. The second is that any comparison against your current SMS cost has to be done on your own volumes and your own markets, because a per-message rate that looks higher can still work out cheaper once failed deliveries and repeat sends are counted.

One thing that is not changing

WhatsApp is introducing optional usernames, and with them business-scoped user IDs — identifiers that arrive in place of a customer’s phone number. For most message types that is a significant change.

Authentication is the exception. One-tap, copy-code and zero-tap templates still require a phone number and cannot be sent to a business-scoped identifier at all; attempting it returns an error rather than a message. So of everything you send over WhatsApp, your OTP flow is the piece least disturbed by that change.

Questions we are asked

Can we send OTPs on WhatsApp without the Business API?

No. Authentication templates exist only on the WhatsApp Business Platform. The free WhatsApp Business app has no template mechanism and no programmatic way to send a code at the moment a login happens.

Should we drop SMS entirely?

Most businesses should not, at least not at first. Not every customer has WhatsApp, and a failed code is a lost login. The usual arrangement is WhatsApp first with SMS as the fallback, which also gives you a clean comparison of delivery rates on your own traffic.

How long does template approval take?

Meta usually reviews templates quickly, often within hours, though it can take longer. Authentication templates are among the more predictable to get approved precisely because they are so constrained — provided nothing promotional has crept into the wording.

Does a customer have to opt in to receive an OTP?

An authentication message is sent because the customer has just asked to log in or verify something, so the request itself is the context. That does not make the number yours for anything else — a code you sent does not entitle you to send a campaign to the same person later.

What happens if we get it wrong?

Blocks and reports affect your quality rating, your quality rating governs how many people you may message at all, and a number that falls far enough can be restricted. Recovering from that is considerably harder than avoiding it, which is why the wording and the frequency are worth getting right at the start.

Concord WABA runs WhatsApp OTP verification on your own number, with the template created and submitted for you, and message charges passed through at Meta’s rates with nothing added.

Last verified: 25 October 2026. Meta’s rates, message categories and template rules change, and the Indian position on WhatsApp usernames is still moving — check the current position before acting on any of this.