Short answer. Phone-number login is not a screen calling an SMS sender’s API; it is an authentication service that generates the code, stores it hashed, limits attempts, picks the channel, WhatsApp first, SMS as fallback, voice call on the third attempt, logs every send and, above all, sends nothing to a known device: the phone’s biometrics or a passkey replace the code from the second login on. The checks before sending, limits per number, per IP address and per device, served number ranges, decide the cost: without them, bots request codes by the thousand and the SMS bill follows. Eight weeks to build the module, one of them a pilot on real customers to measure actual delivery per carrier.
This guide is for the founder settled in France whose app will be opened by customers in Algeria and by the diaspora with French numbers, the manager whose customers forget their password every two weeks, the company whose SMS bill doubled while sign-ups stood still, and anyone who reads “OTP login” in a quote without knowing what lies behind it. It does not cover online payment, described in the technical guide on CIB and Edahabia integration, nor the conversational agent, described in the guide on the AI agent on WhatsApp; it covers the front door, the one every customer crosses before anything else.
What the figures say
The SMS code has become a tolerated authenticator, no longer a recommended one. Revision 4 of the US NIST digital identity guidelines, SP 800-63B, published in 2025, classes the use of the telephone network to receive a code, SMS or call, as “restricted”: the verifier must offer at least one other, non-restricted authenticator, should remind the user of this limitation, and should consider risk signals such as device change, SIM change or number porting. The same text sets benchmarks we apply: a code of at least six digits, an out-of-band authentication invalid unless completed within ten minutes, a ceiling of one hundred failed attempts as an upper bound, agencies being free to impose less, and the reminder that a code typed by hand is not phishing-resistant. These are rules written for US federal systems; for an Algerian app they read as the floor below which you do not go.
Fraud is quantified by those who suffer it. Twilio, one of the world’s largest senders of verification SMS, writes in September 2026 that its protection against SMS pumping, bots requesting codes towards paid number ranges, saved its customers $62.7 million in fraudulent costs between June 2022 and October 2024 and blocked more than 569 million attempts; these are a vendor’s figures on its own customers, to be read as an order of magnitude. On alternatives, the FIDO Alliance published on 7 May 2026 its report on the state of passkeys: a Sapio Research survey in April 2026 of 11,000 adults in ten countries, Algeria not among them, where 90 % know about passkeys and 75 % have enabled one on at least one account, and the alliance’s estimate of about five billion passkeys in use. The countries surveyed do not look like Algeria; the direction transposes: the phone becomes the authenticator, and the code becomes the fallback.
The Algerian ground sets its own rules. WhatsApp bills its authentication messages per delivered message since 1 July 2025, and Algeria sits in the “Rest of Africa” pricing region, forty markets, whose rate is read on Meta’s rate card; approved authentication templates allow one-gesture autofill on Android and, since iOS 26, on iPhone, with an expiry notice adjustable from one to ninety minutes. On the SMS side, no carrier publishes a business rate card in dinars: international resellers’ sheets show, towards Algeria, an SMS twenty to thirty times more expensive than a WhatsApp authentication message; these are resale prices in euros, not the rates of Mobilis, Djezzy or Ooredoo, which are negotiated by contract. And a regulatory signal to keep in mind: according to the press, the Ministry of Post and Telecommunications sent Meta a formal notice on 10 August 2026 so that every WhatsApp account used in Algeria stays linked to a valid Algerian mobile number, in the name of account traceability; the phone number will remain, in Algeria, the reference identity.
The life of a phone-number login, in six moments
Authentication is not described by its channels but by what happens to a customer who types their number, until they open the app the next day without typing anything.
The number entered is normalised to international format and recognised: Algerian mobile, foreign diaspora number, or neither, in which case it is refused before a single message leaves. The checks before sending are the moment that decides the bill: no more than three codes per number per hour, no more than ten per IP address, a device identifier that counts too, a list of served number ranges, and an invisible challenge for browsers that behave like bots; a code sent without these checks is a code anyone can make leave. The send picks the channel: WhatsApp first when the number is reachable there, because the message arrives tracked, fills in one gesture and costs a fraction of SMS; SMS otherwise; voice call on the third attempt only. The code has six digits, lives five minutes, and is stored only hashed, like a password: a database leak reveals no valid code.
Entry and verification accept three attempts, compare in constant time so the response duration reveals nothing, and invalidate the code as soon as it has served; on the fourth attempt a new code is needed, and the number slows down. The session is twofold: a short token for API calls, refreshed by a long token bound to the device, revocable from the account, and new proof requested after thirty days or before a sensitive action, by the same principle the guide on the offline app applies to data: what the phone keeps must stay valid without network. The known device is the moment that divides cost by four: on the second launch, fingerprint or face unlock the session, a passkey is offered, and the code returns only on a phone never seen on this account.
Phone authentication, in five layers
Behind the six moments, five layers, and the middle one is the only one really built.
Channels are interchangeable connectors: the WhatsApp authentication template through Meta’s platform, SMS through a direct carrier contract or an aggregator, the voice call, email for accounts without an Algerian number; each has its price, its delivery rate and its rules, which change every year, and none is the only one. The authentication service is the real deliverable: it generates and hashes codes, applies limits, picks the channel and falls back when the first does not deliver, logs every send with its channel, cost and result; it is the only component that knows a code exists. Sessions and devices hold tokens, refresh, the list of known devices and remote sign-out; this layer is what keeps a customer from receiving a code at every launch.
The app has one screen, “your number”, autofill when the phone offers it, and a “send another way” link always visible; it does not know by which channel the code left, and that is intended: changing SMS provider does not touch the app, by the same reasoning the guide on integrating existing software applies to connectors. Supervision is a screen read every week: codes sent per channel and per carrier, arrival delay, verified share, cost per login, and an alert when sends rise while verifications do not, which is the signature of SMS pumping. An authentication without that screen is a bill discovered at month end.
«A screen calling an SMS sender’s API is a form; the authentication is the service that generates, hashes, limits, picks the channel and remembers the device.»
A worked example
An example on usage assumptions, with mechanics that are not assumptions: a consumer app, six thousand active customers, one month.
20,000 logins a month: six thousand customers opening the app a little more than three times a month on average, the most active every day. Without known devices, that is twenty thousand codes; with them, 5,000 codes actually sent, because biometrics and the passkey take three quarters of the logins, and only new customers, new phones and expired sessions receive a code. 70 / 30 between WhatsApp and SMS is our assumption on the share of numbers reachable on WhatsApp; it is measured in the pilot, and it decides the cost far more than the unit price.
The twenty-to-thirty-fold price gap between an SMS and a WhatsApp authentication message to Algeria comes from international resellers’ public sheets and is not an Algerian rate: a direct carrier contract changes the figure, not the direction. What the example shows without depending on prices: with the same twenty thousand logins, the app without an authentication service pays twenty thousand SMS, and the one with it pays one thousand five hundred SMS and three thousand five hundred WhatsApp messages, a cost divided by an order of magnitude, and an attack surface for bots reduced as much. The assumptions to check at home: how many logins, how many devices per customer, what share of numbers on WhatsApp, and what rate your SMS contract gives you; the week-six pilot answers the first three.
Six ways to prove who is logging in
Six channels, and none is enough alone; the project’s first week is spent writing which serves what.
The SMS code works on any phone, without app or data, and it is the reflex everyone knows; it is paid per send, its delivery varies by carrier and hour, NIST classes it restricted, and it is the bots’ target. It remains indispensable in Algeria as a fallback, not as the first channel. The WhatsApp code fills in one gesture on Android and, since iOS 26, on iPhone, arrives tracked and costs a fraction of SMS; it needs a WhatsApp Business account, an authentication template approved by Meta, and covers only numbers present on WhatsApp, which in Algeria is the vast majority of smartphones. The voice call reads the code aloud when nothing else arrives; it is the costliest per attempt and is kept for the third try.
The email link costs nothing and serves business accounts and the diaspora without an Algerian number; inboxes are poorly checked on mobile, and no demanding system accepts it as sole proof. The password costs nothing to send and everyone knows it; it is forgotten, reused and phished, and its recovery calls for a code or a link anyway, which rarely makes it a saving. The passkey, the phone’s biometrics bound to the account, sends nothing, cannot be copied and resists phishing; it assumes a recent phone and a first enrolment, and is offered after the first successful login rather than imposed at sign-up. The set-up that holds in 2027: WhatsApp first, SMS as fallback, voice on the third attempt, email for accounts without an Algerian number, passkey offered as soon as the device allows. For a diaspora French number, the WhatsApp message is billed at France’s rate and the international SMS costs even more; email and the passkey take a larger share, as in the guide on the flat managed from France.
Six abuses the service must stop
Six abuses we see on the apps we take over, and what the authentication service does against each.
SMS pumping costs money: bots request codes by the thousand towards number ranges that intermediaries get paid for, often at night, often towards countries where the app has no customer; served ranges, limits per IP and per device, the invisible challenge and the “sends up, verifications flat” alert stop it in minutes rather than weeks. Brute force tries the combinations of a six-digit code; three attempts then a new code, five-minute validity and progressive blocking bring the success probability down to one in three hundred thousand per code. SIM swap and porting hand the customer’s number to a third party; the service watches device or SIM change signals before sensitive actions, and asks for a second proof to change number or empty a balance.
Code phishing is the most frequent: a fake adviser calls and asks for “the code you just received”; the message says “never share this code”, the code is bound to the requested action and not to general access, and manual entry is never treated as strong proof, exactly what NIST writes. Replay and shared devices are ordinary in families where one phone serves several people; code invalidated after verification, list of known devices and remote sign-out from the account. The recycled number is the Algerian case people forget: a former customer changes number, the carrier reassigns it, and the stranger who receives it logs into the account; expiry of inactive sessions, second proof before sensitive data and detection of a never-seen device on an old account. The first two cost money, the other four cost customers, and none is handled in the screen.
«The first two abuses cost money, the other four cost customers, and none is handled in the screen.»
Seen elsewhere: NIST, Meta, FIDO, and what transposes
Three public texts say the essentials. NIST writes what each authenticator is worth: the code received by phone is restricted, something else must be offered beside it, six digits at least, ten minutes at most, a ceiling on attempts, and manual entry is not phishing-resistant; what transposes to any Algerian app is the architecture these rules impose, the code as a fallback and not the sole proof, and the alternative, biometrics or passkey, available as soon as the device allows. Meta writes how to deliver a code by WhatsApp: an approved authentication template, one-gesture fill, the displayed expiry, billing per delivered message and a pricing region for Algeria; what transposes is the reflex of reading the rate card and the rules before promising a cost, as the guide on the WhatsApp agent does for conversations.
The FIDO Alliance says where the market is going: five billion passkeys in use, three quarters of respondents in ten countries who have enabled one, and platforms, Android, iOS, browsers, that offer them natively; what does not transpose is the pace, because Algeria is not in the survey and the phone fleet there is older, which is why the passkey is offered rather than imposed. What the three texts do not say and only the pilot does: actual SMS delivery per carrier and per hour in Algeria, the share of numbers reachable on WhatsApp among your customers, and the arrival delay of the code on a busy network one Ramadan evening.
The rules of an authentication that lasts
Six rules, written in the first week and reread at every incident. Nothing leaves without checks: limits per number, per IP and per device, served ranges, invisible challenge; this is the rule that protects the bill. The code is hashed, short and single-use: six digits, five minutes, three attempts, invalidated after use, never stored in clear, never written to a log. The channel is the service’s decision, not the screen’s: WhatsApp first, SMS as fallback, voice on the third attempt, and the app does not know which one served. The known device replaces the code: biometrics or passkey from the second login on, device list and remote sign-out in the account. Accounts, templates and contracts are in the company’s name, the WhatsApp Business account, the carrier contract, the API keys, never the vendor’s, as the guide on the app stuck with a vanished developer recalls. Cost per login is an indicator read every week, not a line discovered on the invoice.
A seventh rule concerns the specification: “OTP login” is not a requirement, it is a sentence; the requirement reads “the code leaves by WhatsApp when the number is reachable there and by SMS otherwise, it has six digits, lives five minutes and accepts three attempts; a known device receives no code for thirty days; sends are limited to three per number per hour; a screen gives every week the codes sent per channel, the verified share and the cost per login”, and it is checked at acceptance by automated abuse tests, as the guide on the specification recommends. A quote that prices “OTP” without saying by which channel, with which limits and without known devices has priced a form.
Six apps, what gets chosen
Six apps we often build, and for each the authentication set-up chosen in the first week.
- The marketplace or consumer app. Phone number, WhatsApp first, SMS as fallback, passkey offered after the first order; no password at all.
- The B2B ordering portal described in the dedicated guide. The shop manager’s number, known device on the shop’s tablet, second proof to change the number or exceed the credit.
- The field app for pre-sellers or drivers. Company device enrolled once, local PIN that works without network, SMS code only to re-enrol a new phone.
- The owner or patient space opened from France. French number or email, WhatsApp at France’s rate, passkey offered from the first login; international SMS as last resort.
- The clinic or practice app for patients. Phone number and SMS or WhatsApp for first access, secure link to view a result, second proof before the full record.
- A founder’s SaaS sold to companies. Email and passkey for accounts, WhatsApp or SMS code as an option for users who ask, sign-in with the company’s Google or Microsoft account when it has one.
The 2027 calendar
The calendar is that of an eight-week authentication module, one week of it a pilot on real customers, built alongside the rest of the app.
Week 0 to 1 writes the rules: who logs in, with which type of number, from which country, which channels in which order, which limits, which session duration, which actions require a second proof. Week 1 to 2 requests what takes time: the company’s WhatsApp Business account and its authentication template submitted for Meta’s approval, the SMS contract with the carrier or aggregator in the company’s name, the sender name; these delays always exceed coding time. Weeks 2 to 4 build the authentication service: generation, hashing, limits, channel fallback, log, and the automated abuse tests that replay pumping, brute force and replay at every release. Week 4 to 5 builds the screen and autofill on Android and iOS, with the visible “send another way” and error messages that say what to do.
Week 5 to 6 installs sessions, known devices, remote sign-out, biometrics and the passkey offer. Week 6 to 7 is the pilot: five hundred real customers, delivery measured per channel and per carrier, arrival delay, verified share and cost per login; it is the only week that tells the truth about carriers. Week 7 to 8 installs weekly supervision, fraud alerts, switches all customers and decides the acceptable SMS share. What a year of this module then costs, messages included, enters the budget described by the guide on keeping an app alive, and paying Meta in foreign currency follows the guide on paying for cloud from Algeria.
What makes an authentication fail
The authentications we take over almost always fail for one of these reasons.
- The screen calls the SMS sender directly. No limits, no log, no fallback: bots find the address within a week.
- The code is stored in clear or written to logs. A database leak reveals valid codes; hashing costs one line.
- A code at every launch. Without known devices, the customer receives twenty codes a month and the company pays for all of them.
- SMS as the only channel. One evening of a saturated carrier, nobody logs in, and support takes the calls.
- No supervision of cost per login. Pumping is discovered on the invoice, three weeks later.
- The WhatsApp Business account in the vendor’s name. Changing vendor means getting templates approved again and losing the number.
- The passkey imposed at sign-up. Old phones cannot do it and customers leave; it is offered after the first successful login.
Frequently asked questions
The questions we receive from managers, founders settled in France and teams taking over an app.
- Is a password still needed if there is a phone code?
- No, for a consumer app: the phone number, the code at the first login on a device, then biometrics or the passkey are enough, and the password only adds something to forget. A SaaS sold to companies keeps email and passkey, with the code as an option.
- WhatsApp or SMS to send the code?
- Both, in that order: WhatsApp when the number is reachable there, because the message arrives tracked, fills in one gesture and costs a fraction of SMS; SMS otherwise; voice call on the third attempt. The choice belongs to the authentication service, not the screen, and the pilot measures each channel’s real share.
- How much does a code cost?
- It depends on the channel and the contract: WhatsApp bills per delivered message according to the “Rest of Africa” region of its rate card, and SMS is negotiated with the carrier or aggregator, with no public rate card in dinars. International resellers’ sheets show an SMS twenty to thirty times more expensive than a WhatsApp authentication message to Algeria; the strongest lever is not the unit price but the number of codes, divided by four by known devices.
- How do we stop bots from draining the SMS budget?
- With the checks before sending: three codes per number per hour, ten per IP address, a device identifier, served number ranges, an invisible challenge for suspicious browsers, and an alert when sends rise while verifications do not. A service applying these rules stops pumping in minutes.
- What about diaspora customers with a French number?
- The number is recognised as foreign; WhatsApp is billed at France’s rate and international SMS costs even more, so email and the passkey take a larger share, and SMS stays the last resort. The account stays the same whatever the number’s country.
- How long to build the authentication?
- Eight weeks for the module, one of them a pilot on five hundred real customers; the WhatsApp Business account, template approval and the SMS contract are requested from the first week because they take longer than the code. The module is built alongside the rest of the app.