Sender IDs and trust

The sender ID is the first thing a user sees, and it is the first thing a carrier filter evaluates. Choosing it is part security decision, part deliverability decision, and heavily constrained by country regulation.

The four kinds of sender

• Alphanumeric (e.g. NVIAOTP): up to 11 characters, one-way, recognisable. Requires pre-registration in many countries; unsupported in the US and Canada.
• Long code: a normal mobile or landline number. Cheap and two-way, but heavily filtered for application traffic in North America unless registered (10DLC).
• Short code: 5–6 digits, high throughput, expensive and slow to provision, trusted by carriers.
• Toll-free: a middle ground in North America; requires verification and has moderate throughput.

Consistency is a security control

Users learn that codes come from a particular sender. If your sender changes between messages — because a fallback route uses a random long code — you have taught them to accept codes from anywhere, which is exactly what a phishing message relies on. Use the same registered sender per country for every OTP, and tell users in your help pages what it is.

Registration as deliverability

Carriers increasingly require you to register brand, use case and sample content before traffic flows. Treat registration as part of launch: a new market without registered senders will see silent filtering that looks, in your dashboards, like users who never type their codes.