Nigerian fintechs should send OTPs on a transactional (corporate) sender ID approved on MTN, Airtel, Glo and T2, keep the code message free of any promotional wording, and wrap it in fraud controls: purpose-specific codes, rate limits per number, device and IP, a country allow-list, and device binding for new phones. Networks typically filter promotional traffic for subscribers on Do-Not-Disturb, so an OTP sent on the wrong route can silently fail for a large share of your users.
Last reviewed: 27 October 2026
This guide is for product, engineering and risk teams at wallets, lenders, savings apps and payment companies. It covers which route an OTP should use, where OTPs belong in a fintech app, how to word them so customers are harder to trick, the fraud patterns to plan for, and how to build the flow with eSMS Verify. It is a technical guide, not legal advice.
Why the route decides whether the code arrives
The Nigerian Communications Commission (NCC) requires networks to run a Do-Not-Disturb service on short code 2442. A subscriber who texts STOP is on full DND and should not receive unsolicited messages. A subscriber who texts HELP can choose partial DND across 11 categories, where category 1 is banking, insurance and financial products. Category 1 is about marketing: a subscriber who allows it can receive financial promotions.
An OTP is not marketing. It is a message the customer asked for a few seconds ago. In practice, Nigerian networks separate the two by route and sender ID: transactional traffic (OTPs, alerts, receipts) goes through an approved transactional sender ID and typically reaches DND numbers, while promotional traffic is checked against DND. This split is operator practice rather than a published NCC rule, so treat it as how the networks work today and check your sender ID approval covers transactional use on every network.
Two practical rules follow:
- One sender ID for OTPs and alerts, another for marketing. Mixing them risks your OTP sender being reclassified or blocked because of a complaint about a promotion.
- No promotional text inside an OTP. "Your code is 482913. Get 10% cashback this weekend" is a promotion with a code attached. Networks may treat it as such.
Our article on bulk SMS to DND numbers in Nigeria explains what reaches DND subscribers and what is blocked.
Where OTPs belong in a fintech app
Not every screen needs an SMS code. Each one costs money, adds friction and gives attackers another trigger to abuse. Map your flows first:
| Flow | SMS OTP? | Why |
|---|---|---|
| Sign-up and phone number verification | Yes | Proves the customer holds the number you will send alerts to |
| Login on the bound device | Usually no | PIN or biometric is enough on a device you already trust |
| Login or app activation on a new device | Yes, plus PIN or biometric | The CBN circular of 12 March 2026 requires enhanced MFA here |
| Raising a transfer limit | Yes, plus transaction PIN | Limit changes take effect only after MFA under the same circular |
| Adding a new payout bank account | Yes | A common step in account takeover cash-out |
| PIN or password reset | Yes, with extra checks | Attackers who hold the SIM go straight for resets |
| Routine transfers to saved beneficiaries | Usually no | Transaction PIN in-app; send a debit alert afterwards |
The circular also limits mobile banking apps to one active device and caps transactions in the first 24 hours after activation at NGN 20,000, according to the Legal500 summary. Our guide to the CBN 2026 rules and SMS OTP walks through a full device-binding flow, so this article focuses on the route, the wording and the fraud controls around it.
Word the code so customers are harder to trick
Most fintech account takeovers in the region rely on persuading the customer to read out a code. The message itself is one of your best defences. Each OTP should:
- Start with your brand and put the code early, so it shows in the notification preview.
- Say what the code is for. A customer who reads "to link a new phone" while holding their usual phone knows something is wrong.
- State the amount for transaction approvals.
- Tell the customer that staff will never ask for it.
- Stay within one GSM-7 segment: write "NGN", not the naira sign, which forces Unicode and cuts the limit to 70 characters.
| Purpose | Sample message |
|---|---|
| Sign-up | KoboNest: 482913 is your sign-up code. It expires in 5 minutes. Our staff will never ask for this code. |
| New device | KoboNest: 731045 is your code to link a NEW phone to your account. If you did not request this, do not share it and call 0700 000 0000. |
| Transfer limit | KoboNest: 260918 approves raising your daily limit to NGN 500,000. Never share this code, even with KoboNest staff. |
| New payout account | KoboNest: 905512 adds GTB acct ****4821 as a payout account. Not you? Do not share the code and call 0700 000 0000. |
| Security notice | KoboNest: Your PIN was changed at 21:14. If this was not you, call 0700 000 0000 now. We will never ask for your PIN or codes. |
Keep the code six digits, valid for five to ten minutes, and accept only the latest code for a given request.
Fraud controls to build in from day one
SMS pumping
Attackers script your "send code" endpoint to trigger thousands of messages, either to run up your bill or to profit from traffic to numbers they control. Fintechs are a target because their sign-up endpoints are public. Defences:
- A country allow-list. If you only serve Nigerian customers, refuse anything that is not a +234 mobile number before calling the SMS API.
- Limits per number, per device, per IP and per account, with a cooldown before resend.
- Alerts when OTP volume rises without a matching rise in completed sign-ups. Conversion rate per hour is the signal to watch.
- A challenge (such as a CAPTCHA) on sign-up when traffic looks automated.
SIM swap
A fraudster who has the customer's number re-issued receives every code. SMS should therefore never be the only factor for high-risk actions. Pair it with a PIN or biometric, apply the new-device limits, and hold high-value transfers for review when a device change and a payout account change happen close together.
Social engineering
Fake support agents call customers and ask them to "confirm" a code. Purpose-specific wording, a clear "staff will never ask" line, and a security notice after every sensitive change shorten the time before the customer notices.
Enumeration
Do not reveal whether a number is registered. Return the same "if this number has an account, we have sent a code" response either way.
Building it with eSMS Verify
eSMS Verify is a managed OTP service: you call one endpoint to start a verification and another to check the code, and eSMS generates, sends, rate-limits and checks it. Your application still owns the business rules: which flows need a code, the country allow-list and the device and IP limits.
# Python 3: OTP start with a country allow-list and your own velocity limits
import os, re, requests
BASE = "https://sms.esmsafrica.io"
HEADERS = {"Authorization": "Bearer " + os.environ["ESMS_API_KEY"], # esms_test_... while building
"Content-Type": "application/json"}
def to_e164_ng(raw):
n = re.sub(r"[^\d+]", "", raw)
if n.startswith("+234"): return n
if n.startswith("234"): return "+" + n
if n.startswith("0"): return "+234" + n[1:]
return "+234" + n
def start_otp(phone, device_id, ip, purpose):
to = to_e164_ng(phone)
if not re.fullmatch(r"\+234[789]\d{9}", to):
return {"ok": False, "reason": "not a Nigerian mobile number"}
if too_many_requests(to, device_id, ip): # your own counters (Redis etc.)
return {"ok": False, "reason": "slow down"}
r = requests.post(BASE + "/v1/verify/start", headers=HEADERS, timeout=10,
json={"to": to, "app_id": os.environ["VERIFY_APP_ID"]})
r.raise_for_status()
v = r.json()
save_pending(v["verification_id"], to, device_id, purpose)
return {"ok": True, "verification_id": v["verification_id"]}
def check_otp(verification_id, user_code):
r = requests.post(BASE + "/v1/verify/check", headers=HEADERS, timeout=10,
json={"verification_id": verification_id, "code": user_code})
return r.json() # approve the action only when the status is approved
Use an esms_test_ key while building: sends are simulated without charge, so you can exercise wrong codes, expiry and your own limits. Switch to an esms_live_ key when the sender ID is approved. Security notices and debit alerts are ordinary transactional messages sent with POST https://sms.esmsafrica.io/api/messages/send and your transactional sender ID.
After launch, read delivery reports by network. A drop on one network usually points to a sender ID or route issue on that network, which our OTP debugging checklist for MTN, Airtel and Glo helps you isolate. The delivery reports guide covers the webhook.
Compliance and launch checklist
- Transactional sender ID approved on MTN, Airtel, Glo and T2, separate from any marketing sender ID.
- OTP templates name the brand, state the purpose, carry no promotion and fit one GSM-7 segment.
- SMS OTP paired with a PIN or biometric for new devices, limit changes, payout accounts and resets.
- New-device limits and one-active-device logic in line with the CBN circular, confirmed by your compliance team.
- Country allow-list, per-number, per-device and per-IP limits, and conversion-rate monitoring.
- Security notice to the registered number after every sensitive change.
- Phone numbers collected for OTP are not reused for marketing without separate consent. The Nigeria Data Protection Act 2023 gives customers the right to object to direct marketing.
- Delivery reports monitored per network, with an on-call owner.
What OTP traffic costs
Verify messages to Nigerian numbers are billed at the Nigeria SMS rate: NGN 9.1 ($0.0068) per message on the basic tier, with lower rates on the business tier (NGN 7.5). Volume tiers are on the pricing page. In practice, SMS pumping controls and fewer unnecessary codes save more than any rate change.
Frequently asked questions
Do OTPs reach customers who are on DND?
OTPs sent on an approved transactional sender ID typically reach DND numbers, because networks filter DND on promotional traffic. This is operator practice, so confirm your sender ID is approved for transactional use on each network.
Does DND category 1 affect my OTPs?
Category 1 lets a subscriber on partial DND choose to receive banking, insurance and financial promotions. It is about marketing. Your OTPs should not depend on it, and your promotions should go on a separate sender ID.
Is SMS OTP enough on its own for a Nigerian fintech?
Not for high-risk actions. The CBN circular asks for MFA on limit changes and enhanced MFA on new devices. Pair the SMS code with a PIN or biometric and apply new-device limits.
How do we stop bots from burning our SMS budget?
Refuse non-Nigerian numbers if you only serve Nigeria, limit requests per number, device and IP, add a cooldown before resend, and alert when OTP volume rises without more completed sign-ups.
Can we test without sending real messages?
Yes. Test keys (esms_test_...) simulate sends without charge, so the full flow can be tested before go-live.
Sources
- Legal500 (Pavestones Legal) - CBN guidelines on instant payment functionalities and mobile banking security
- NCC - Do-Not-Disturb (DND) service in Nigeria
- NCC - Rules on unsolicited calls and SMS
- Templars - Unsolicited messaging and the limits of opt-out provisions (NDPA 2023 s.36)
- eSMS Africa docs - Verify
See how Nigerian wallets and lenders combine OTPs, alerts and receipts on the fintech SMS page for Nigeria, check the Nigeria sender ID steps, and read our guide to cutting bank SMS alert costs. When you are ready, create an eSMS Africa account and test the flow with a free test key.
