User Onboarding Phone Verification

Why Phone Verification Matters

Phone verification has become a cornerstone of user onboarding. Unlike email, which can be created instantly and anonymously, phone numbers have real-world ties to carrier contracts, physical SIM cards, and identity verification. This makes phone verification effective for:

• Fraud prevention — Fraudsters face costs acquiring new numbers
• Bot mitigation — Phone verification stops automated account creation
• Account recovery — Verified phones enable secure password resets
• User authentication — SMS OTP as a second factor
• Communication channel — Verified number enables notifications and support

The Cost of Poor Verification

Ineffective phone verification leads to:

• Account farming — Fraudsters create multiple accounts for abuse
• Fake registrations — Bots inflate user counts with worthless accounts
• OTP fraud — Attackers abuse your SMS sending for their own purposes
• Support burden — Users locked out due to unverified or changed numbers
• SMS costs — Wasted OTP sends to invalid or fraudulent numbers

Pre-Verification Intelligence

Check phone intelligence BEFORE sending OTP to save costs and block fraud:

Line Type Validation

def pre_verification_check(phone_number):
    """
    Validate phone before sending OTP.
    Returns verification method and any warnings.
    """
    intel = veriroute_lookup(phone_number, lrn=True)

    result = {
        'phone': phone_number,
        'can_verify': True,
        'method': 'sms',
        'warnings': [],
        'risk_score': 0
    }

    line_type = intel.get('line_type', 'unknown')

    # Landlines can't receive SMS
    if line_type == 'landline':
        result['method'] = 'voice'
        result['warnings'].append('Landline detected - using voice verification')

    # VoIP numbers are higher risk
    elif line_type == 'voip':
        result['risk_score'] += 30
        result['warnings'].append('VoIP number - additional verification recommended')

    # Virtual/burner numbers are very high risk
    elif line_type in ['virtual', 'non-fixed_voip']:
        result['risk_score'] += 60
        result['can_verify'] = False
        result['reason'] = 'virtual_number_blocked'

    # Check for valid carrier (number is real)
    if not intel.get('carrier'):
        result['can_verify'] = False
        result['reason'] = 'invalid_number'

    return result

Carrier and Risk Assessment

Different carriers have different fraud profiles:

OTP Delivery Methods

SMS OTP

SMS remains the most common verification method:

• Pros — Universal reach, familiar UX, no app required
• Cons — Cost per message, delivery delays, SIM swap vulnerability
• Delivery rate — 95-98% for valid mobile numbers

# SMS OTP implementation
import random
import string

def send_sms_otp(phone_number, session_id):
    # Generate 6-digit code
    otp_code = ''.join(random.choices(string.digits, k=6))

    # Store OTP with expiration
    store_otp(session_id, otp_code, expires_in=300)  # 5 minutes

    # Send via SMS provider
    message = f"Your verification code is: {otp_code}. Expires in 5 minutes."
    sms_result = sms_provider.send(
        to=phone_number,
        message=message,
        sender_id='YourApp'
    )

    return {
        'sent': sms_result.success,
        'session_id': session_id,
        'expires_in': 300,
        'attempts_remaining': 3
    }

Voice OTP

Voice verification handles landlines and provides accessibility:

• Use cases — Landlines, accessibility needs, SMS-blocked regions
• Pros — Works with any phone type, clear delivery confirmation
• Cons — Higher cost, slower UX, requires user attention

# Voice OTP as fallback
def send_voice_otp(phone_number, session_id):
    otp_code = ''.join(random.choices(string.digits, k=6))
    store_otp(session_id, otp_code, expires_in=600)  # 10 minutes for voice

    # Format code for speech (pauses between digits)
    spoken_code = '. '.join(otp_code)

    voice_result = voice_provider.call(
        to=phone_number,
        script=f"""
            Hello. Your verification code is: {spoken_code}.
            Again, your code is: {spoken_code}.
            This code expires in 10 minutes.
        """,
        voice='en-US-female'
    )

    return {
        'sent': voice_result.success,
        'method': 'voice',
        'session_id': session_id,
        'expires_in': 600
    }

WhatsApp/RCS Verification

Rich messaging offers better delivery and engagement:

• WhatsApp — 2B+ users, verified sender, higher open rates
• RCS — Native rich messaging, carrier-supported
• Benefits — Read receipts, branded messages, lower cost than SMS in some regions

Silent Network Authentication

Modern alternative using carrier network:

• How it works — Verifies SIM directly with carrier via data connection
• Pros — Instant, frictionless, no OTP to intercept
• Cons — Requires mobile data, limited carrier support

Verification Flow Design

Progressive Verification

Defer verification until value exchange requires it:

class ProgressiveVerification:
    """
    Verify phone only when needed based on user actions.
    """
    VERIFICATION_TRIGGERS = {
        'registration': 'optional',      # Allow exploration first
        'first_purchase': 'required',    # Verify before payment
        'messaging': 'required',         # Verify before contacting others
        'cash_withdrawal': 'required',   # High-risk action
        'settings_change': 'if_unverified'  # Verify if not already done
    }

    def should_verify(self, user, action):
        trigger = self.VERIFICATION_TRIGGERS.get(action, 'required')

        if trigger == 'optional':
            return False

        if trigger == 'if_unverified':
            return not user.phone_verified

        return True  # 'required'

    def get_verification_prompt(self, user, action):
        return {
            'action': action,
            'message': self._get_message(action),
            'phone': user.phone,
            'skip_allowed': self.VERIFICATION_TRIGGERS.get(action) == 'optional'
        }

    def _get_message(self, action):
        messages = {
            'first_purchase': 'Verify your phone to complete this purchase.',
            'messaging': 'Verify your phone to send messages.',
            'cash_withdrawal': 'For your security, please verify your phone.',
        }
        return messages.get(action, 'Please verify your phone number.')

Optimal Verification UX

Design verification for maximum completion:

• Pre-fill number — Auto-detect from device if possible
• Format clearly — Show (555) 123-4567, not 5551234567
• Auto-advance — Move to code entry immediately after sending
• Auto-submit — Submit when 6 digits entered (no button needed)
• Show countdown — Display time until code expires
• Resend option — Clear "Resend code" after reasonable delay
• Alternative method — Offer voice call if SMS fails

// Frontend auto-submit on complete code entry
const OTPInput = ({ onComplete }) => {
  const [code, setCode] = useState('');

  const handleChange = (value) => {
    const digits = value.replace(/\D/g, '').slice(0, 6);
    setCode(digits);

    // Auto-submit when 6 digits entered
    if (digits.length === 6) {
      onComplete(digits);
    }
  };

  return (
    <input
      type="tel"
      inputMode="numeric"
      pattern="[0-9]*"
      maxLength={6}
      value={code}
      onChange={(e) => handleChange(e.target.value)}
      autoComplete="one-time-code"  // iOS/Android autofill
      placeholder="000000"
    />
  );
};

Verification Abuse Prevention

Rate Limiting

Prevent OTP bombing and cost abuse:

class VerificationRateLimiter:
    """
    Multi-tier rate limiting for OTP sends.
    """
    LIMITS = {
        'per_phone': {'count': 5, 'window': 3600},      # 5 per hour
        'per_ip': {'count': 10, 'window': 3600},        # 10 per hour
        'per_phone_daily': {'count': 10, 'window': 86400},  # 10 per day
        'per_ip_daily': {'count': 50, 'window': 86400}     # 50 per day
    }

    def check_limits(self, phone, ip):
        violations = []

        for limit_name, config in self.LIMITS.items():
            key = self._make_key(limit_name, phone, ip)
            current = self._get_count(key)

            if current >= config['count']:
                violations.append({
                    'limit': limit_name,
                    'current': current,
                    'max': config['count'],
                    'reset_in': self._get_ttl(key)
                })

        if violations:
            return {
                'allowed': False,
                'violations': violations,
                'retry_after': min(v['reset_in'] for v in violations)
            }

        return {'allowed': True}

    def record_send(self, phone, ip):
        """Record an OTP send against all applicable limits."""
        for limit_name, config in self.LIMITS.items():
            key = self._make_key(limit_name, phone, ip)
            self._increment(key, config['window'])

Phone Intelligence Gating

Block high-risk numbers before OTP send:

def gate_verification_request(phone, ip, user_agent):
    """
    Check if verification request should proceed.
    Returns decision with reasoning.
    """
    # Get phone intelligence
    intel = veriroute_lookup(phone, lrn=True, spam=True)

    # Build risk assessment
    risk_factors = []
    risk_score = 0

    # Line type risk
    if intel.get('line_type') == 'virtual':
        risk_score += 50
        risk_factors.append('virtual_number')
    elif intel.get('line_type') == 'voip':
        risk_score += 25
        risk_factors.append('voip_number')

    # Invalid/disconnected number
    if not intel.get('carrier'):
        return {
            'allowed': False,
            'reason': 'invalid_number',
            'message': 'Please enter a valid phone number.'
        }

    # Spam reputation
    if intel.get('spam_score', 0) > 50:
        risk_score += 30
        risk_factors.append('spam_reported')

    # Recently ported (possible fraud)
    if intel.get('recently_ported'):
        risk_score += 20
        risk_factors.append('recently_ported')

    # Decision
    if risk_score >= 60:
        return {
            'allowed': False,
            'reason': 'high_risk',
            'risk_factors': risk_factors,
            'alternative': 'Please use a mobile phone number from a major carrier.'
        }

    if risk_score >= 30:
        return {
            'allowed': True,
            'enhanced_verification': True,
            'risk_factors': risk_factors
        }

    return {'allowed': True, 'risk_score': risk_score}

OTP Farming Prevention

Detect and block OTP farming attacks:

• Velocity detection — Same phone, many IPs = farming
• Pattern analysis — Sequential numbers, known ranges
• Behavioral signals — Time on page, mouse movement
• Device fingerprinting — Many requests, same device

Measuring Verification Success

Key Metrics

Analytics Implementation

class VerificationAnalytics:
    def track_verification_flow(self, session_id, event, metadata=None):
        """Track verification funnel events."""
        events = {
            'phone_entered': 'Step 1: Phone entry',
            'pre_check_passed': 'Step 2: Validation passed',
            'otp_sent': 'Step 3: OTP sent',
            'otp_delivered': 'Step 4: Delivery confirmed',
            'code_entered': 'Step 5: User entered code',
            'verification_success': 'Step 6: Verified',
            'verification_failed': 'Failed: Wrong code',
            'verification_expired': 'Failed: Code expired',
            'resend_requested': 'Resend requested',
            'fallback_to_voice': 'Switched to voice'
        }

        self.log_event(
            session_id=session_id,
            event_type=event,
            event_name=events.get(event, event),
            metadata=metadata,
            timestamp=datetime.utcnow()
        )

    def get_funnel_report(self, date_range):
        """Generate conversion funnel report."""
        return {
            'total_started': self.count_event('phone_entered', date_range),
            'pre_check_passed': self.count_event('pre_check_passed', date_range),
            'otp_sent': self.count_event('otp_sent', date_range),
            'verified': self.count_event('verification_success', date_range),
            'conversion_rate': self.calculate_conversion(date_range),
            'avg_time_to_verify': self.avg_time_to_complete(date_range),
            'resend_rate': self.calculate_resend_rate(date_range)
        }

Implementation Checklist

Troubleshooting Common Issues

Low Delivery Rates

• Check sender ID — Some carriers block unknown sender IDs
• Review message content — Spam filters may block certain phrases
• Validate numbers first — Don't send to disconnected numbers
• Multiple provider fallback — Try alternate routes on failure

High Abandonment

• Reduce friction — Verify later in the funnel if possible
• Speed up delivery — Users abandon after 30+ seconds
• Clear instructions — Tell users where to expect the code
• Offer alternatives — Voice call option, different number

Fraud Still Getting Through

• Tighten phone intelligence — Block or flag more line types
• Add behavioral checks — Device fingerprint, velocity analysis
• Require additional verification — ID check for high-risk
• Monitor post-verification behavior — Detect fraud patterns