Before you turn on phone verification for signups, test the whole path: entering a number, requesting a code, receiving it, entering it, and creating the account. Each step can fail on its own, and a test that only confirms the code screen appears will miss most of the problems users actually hit. The checks below cover input and country handling, delivery and resend behavior, wrong or expired codes, provider limits, accessible code entry, abuse controls, and recovery for users who cannot receive SMS.
Map the flow into separate events before you test
A phone verification signup involves at least five events that can succeed or fail independently: the number is accepted, a code is requested, the provider accepts that request, the handset receives the message, and the user submits a code that the server confirms before the account is created. Each event needs its own test and its own log entry. Provider acceptance is not handset delivery, and a correct code is not the same as a completed signup.
As an Amazon Associate I earn from qualifying purchases.
Entering and validating the phone number
Country context and formatting
Confirm that users can see or choose the country calling code, and that the same number typed with spaces, hyphens, parentheses, a leading zero, or a full international prefix is handled consistently. W3C’s supportive-forms guidance recommends accepting different phone-number formats as a way to prevent entry mistakes (W3C form guidance). Test a number pasted with its country code already present, since a form that strips or duplicates the prefix will reject valid numbers.
Validate before any SMS is sent
Twilio recommends validating phone numbers before sending a one-time passcode (Twilio best practices). Run format and country-support checks first so malformed, unsupported, or disallowed numbers never reach the send step. Write down which countries and number types you support, and show a specific message when an entry cannot be accepted. A message such as “We can’t send codes to this country yet” lets the user stop; a generic error after a long wait does not.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Delivery, waiting, and resend behavior
Late, missing, and repeated messages
Test delayed delivery, no delivery, a user who leaves the screen and returns, and a user who submits the same number twice. The screen should display the full number the code was sent to, so a typo is visible to the user, and it should offer a resend action with a visible countdown.
Do not present a successful API response as proof that the handset received the message. The provider accepted a request; carrier delivery is a separate event that can be delayed or never occur.
Cooldowns and repeated taps
Repeated taps on Resend should not produce a burst of messages or get around the cooldown. Twilio suggests limiting verifications to “1 request / 30 seconds per phone number with exponential backoff.” This is Twilio’s implementation advice, not a universal standard, so set your own cooldown to match your provider limits and your risk tolerance. Enforce the cooldown on the server, not only in the button state, and confirm that a page refresh or a new browser tab does not reset it.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Throttled responses
When the provider or your own limit rejects a request, show a retry time in plain language. Test the throttle paths directly against the limits your selected provider and plan actually enforce, rather than assuming a vendor recommendation matches them.
Wrong, expired, and repeated codes
Mistyped, expired, and reused codes
Test a wrong code, a correct code entered after it expires, a code reused after a successful verification, and a code from an earlier send after a newer one was issued. Error text should say what to do next, such as re-entering the code or requesting a new one, without revealing whether an account or number already exists.
Multiple open signup sessions
Open the signup flow in two tabs or on two devices, request a code in each, and submit the older code first. Decide which code is valid, and make sure every path gives the same result on repeat runs.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Attempt limits
NIST SP 800-63B-4 says verifiers should rate-limit failed authentication attempts when authenticator output is below 64 bits, and it requires rate limiting for outputs of that size (NIST SP 800-63B-4). A six-digit numeric code carries roughly 20 bits, so it falls in that category. Test a throttle or lockout after repeated wrong codes, then check how the lockout ends and whether one person can trigger it against another person’s number.
Provider limits and failure handling
Exercise API errors, rate limits, project quotas, disabled destinations, and provider outages. Firebase documents phone-authentication request and SMS limits, including per-IP limits (Firebase Authentication limits). Map each provider error to one of three user outcomes: retry after a set time, use another verification method, or contact support. Never display raw provider error text to end users.
Documented Firebase phone-auth figures
The table below reproduces the figures published on the Firebase limits page. Limits change and depend on service and plan, so confirm current values on the linked page before you design around them.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Limit | Documented figure | Test implication |
|---|---|---|
| Verification SMS per minute | 900 | Load-test up to this rate in staging against your plan’s configuration |
| Verification SMS per day | 3,000 | Check that peak daily signup volume stays under the cap, with headroom |
| Sends per IP per minute | 50 | Confirm that shared networks, such as offices or carrier NAT, do not trip this limit for legitimate users |
| Sends per IP per hour | 500 | Same check over a longer window |
Repeatable tests versus real delivery
Google Identity Platform lets developers register test phone numbers and codes. Those tests do not send actual SMS, which makes them well suited to repeatable unit and integration checks (Google Identity Platform test numbers). They cannot show carrier behavior. Before enabling the feature for everyone, run a separate real-device test in each launch market, using handsets on the mobile networks your users actually use. Provider test numbers serve the same purpose for other verification APIs.
Accessible code entry
W3C’s explanation of WCAG 2.2 Success Criterion 3.3.8 states: “A service that requires manual transcription of a verification code is not compliant.” The explanation also notes that this does not apply where an applicable alternative or assistive mechanism is available (W3C WCAG 2.2 SC 3.3.8 guidance). The criterion targets authentication of existing users, but signup codes benefit from the same low-friction design. Check that:
- The code field accepts a full pasted code, including when your UI uses separate digit boxes.
- Browser and password-manager one-time-code autofill fills the field.
- The field has an accessible name and a correctly identified input purpose (W3C input-purpose guidance).
- Screen-reader users are told when a code is wrong, and focus moves to the error or the field.
Abuse and unexpected spend
Test the abuse paths on purpose: many requests for one number, many numbers from one IP address, requests spread across many sources, a sudden spike toward one destination country, and a script that retries automatically. Measure how often per-number and per-IP limits block real users, especially on shared networks.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Twilio documents built-in fraud protections for its Verify SMS product (Twilio Verify SMS overview) and recommends retry buffers (Twilio best practices). Monitor send volume and completion rates by geography. Twilio recommends watching for geographic spikes, which can signal abuse or delivery trouble. Firebase documents its own project and IP limits, which you should test alongside any vendor controls you add.
Consent, expectations, and recovery
Tell users before the send that a verification message will be sent, and explain any messaging expectations that apply in the markets you support. Consent and messaging rules differ by jurisdiction and use case, so confirm the requirements for each actual launch market with your legal team.
Decide what happens when a user cannot receive SMS, has lost the phone, or has changed numbers. Twilio recommends establishing another authentication or recovery option early in the design (Twilio best practices). Test each path end to end: a phone with no signal, a user who moved the same number to a new SIM, and a user whose number has changed entirely. A recovery path that exists only on paper is a launch risk.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSMS codes versus carrier-based verification
SMS one-time codes and carrier-based phone-number verification are different approaches, and they should be evaluated separately. Firebase Phone Number Verification obtains a number assigned to the device’s SIM from a supported carrier and can fall back to SMS where carrier support is unavailable (Firebase Phone Number Verification). Its availability is not universal, so confirm carrier and country coverage for each target market.
| Factor | SMS one-time code | Carrier-based verification (Firebase) |
|---|---|---|
| How the number is confirmed | User receives and types a code | Number obtained from the device’s SIM through a supported carrier; SMS fallback where unsupported |
| Coverage | Devices that receive SMS on the networks you test | Limited to supported carriers and countries; not universal |
| Delivery dependency | Depends on SMS delivery | Depends on carrier support; SMS used as fallback |
| User friction | Requires typing or pasting a code | Not stated in the Firebase documentation reviewed |
| Abuse exposure | Governed by the controls described above | Not stated in the Firebase documentation reviewed |
Recommended test order for launch
- Run validation and formatting tests on fixed inputs. Confirm that no SMS is sent for malformed or unsupported numbers.
- Run the complete flow against provider test numbers, covering send, resend, correct and wrong codes, expiry, and account creation.
- Test real delivery on handsets across the carriers and countries you will support, and record timing from request to submitted code.
- Trigger cooldowns, provider throttles, and your own per-number and per-IP limits, and confirm the messages users see.
- Run an accessibility pass with paste, password-manager autofill, and a screen reader on the code step.
- Test abuse scenarios and the recovery paths, then confirm that dashboards separate send, delivery, verification, and abandonment by geography and provider.
Diagnosing “I never got the code”
Support teams need to separate these cases quickly. The table maps each symptom to the record that shows it.
Quick Recap
| Symptom reported | What to check first | Likely cause |
|---|---|---|
| Request rejected before any send | Validation and throttle logs for that number and IP | Malformed or unsupported number, cooldown active, or a limit reached |
| Provider accepted, user saw nothing | Provider status for that message | Carrier delay, or the wrong number was entered |
| Code rejected | Attempt count, expiry time, and the most recent code issued | Expired, superseded, or mistyped code, or an active lockout |
| Code accepted, account not created | Server logs after the verification step | An application error after verification, outside the phone step itself |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
