How OTP Works in India: From Tap to SMS in 3 Seconds

You tap "Send OTP". You stare at the screen. "Resend OTP in 29s". And then, buzz, six digits drop in from something like XY-ABCBNK-T.

We all do this ten times a week. But have you ever wondered how that code actually reached you?

Here's how OTP works in India, in short. The app's server makes a random code and hands it to an SMS company, which passes it to a telecom operator like Jio or Airtel. The operator checks the sender, the message format and the delivery chain against TRAI's DLT register, then its SMS centre finds your phone on the network and delivers it. All of that usually happens in a few seconds.

Sounds like a lot of hands for one little code, right? It's easier than it sounds, because you already know how this works. You've seen it at the post office.

TL;DR

• An OTP SMS travels like a letter: writer (the app), courier agent (SMS aggregator), post office (telecom operator), sorting centre (SMSC), postman (the tower near you).
• Before any business SMS moves, the operator checks it against DLT, a register every sender and message format has to be listed in.
• The -T at the end of the sender name means "transactional". TRAI only allows that for messages sent within 30 minutes of something you did, like an OTP.
• Since 11 December 2024, SMS from an undeclared chain of senders is rejected. Links in SMS have to be pre-approved too.
• If your phone is off, the SMS centre holds your OTP and keeps trying until it expires, like a postman coming back tomorrow.

What happens when you tap "Send OTP"? The post office version

Let's say your bank wants to send you a letter with a secret number inside. Here's everyone who touches that letter, and who they are in the OTP world.

Post office world	OTP world
The person writing the letter	The app's server (your bank, Swiggy, IRCTC)
The courier agent who collects letters from many companies	The SMS aggregator (a "telemarketer" in TRAI's language)
The post office counter that checks the letter	Your telecom operator, checking DLT
The official register of approved senders and letter formats	DLT, the Distributed Ledger Technology platform
The sorting centre	The SMSC, Short Message Service Centre
The address book that says which area you're in right now	The network's subscriber register
The postman	The mobile tower near you
Your letterbox	Your phone

Keep this table in your head. Now let's follow one letter, stop by stop.

Stop 1: How does the app create the OTP?

Post office version: You write a letter and put a secret number inside.

Real version: The moment you tap "Send OTP", the app's server generates a random code, usually 4 to 6 digits. It saves that code along with your phone number and an expiry time, often a few minutes. Then it writes the message around it.

That message isn't free text. The bank can't write whatever it likes. It has to fill a template it registered earlier. It looks something like this:

Your OTP for login is {#numeric#}. Valid for 5 minutes. Do not share it with anyone. - ABC Bank

The fixed words are locked. Only the {#numeric#} slot changes. Think of it as a pre-printed form where the bank only fills one blank.

TRAI's 2025 rules say at least 30% of every template must be fixed text, and a template can't have more than three blanks without a good reason. From January 2026, each blank also has to be tagged with what it holds, like a number for the OTP. Why so strict? Hold that thought. It matters at Stop 3.

Stop 2: Why doesn't the bank send the SMS itself?

Post office version: Big companies don't walk to the post office with every letter. They hand them to a courier agent who collects from hundreds of companies and delivers in bulk.

Real version: Most apps don't have a direct line into Jio or Airtel. They call an SMS aggregator over the internet with a simple API request: "send this template, with this code, to this number."

The aggregator keeps a direct, always-on connection to the telecom operators, usually over a protocol called SMPP (Short Message Peer-to-Peer), and pushes the message in.

Here's the catch. A message can pass through more than one aggregator before it reaches the operator. In the old days, nobody tracked that chain properly. And that's exactly where scammers hid.

Stop 3: What does the telecom operator check before sending your OTP?

This is the counter at the post office. And in India, this counter is strict.

Post office version: The clerk opens a big register. Is this sender registered? Is this letter written on a format they got approved? Which courier agents handled it on the way? If anything doesn't match, the letter goes in the bin.

Real version: The register is DLT, and it's run on blockchain-based ledgers by the telecom operators under TRAI's rules. Every business (TRAI calls them Principal Entities) has to register three things before it can send a single SMS:

1. Itself, as an entity.
2. Its header, the sender name you see, like ABCBNK. Headers can be up to 11 characters.
3. Its templates, the approved message formats from Stop 1.

When the OTP arrives, the operator checks it against all of that. This is called scrubbing. Wrong header? Unregistered template? Rejected.

TRAI kept tightening this counter:

• 1 October 2024: Messages with links, APKs or call-back numbers that the sender hadn't whitelisted got blocked.
• 11 December 2024: Every message had to come through a declared chain of aggregators. The government said SMS sent through unregistered paths was being rejected from that date.
• 2025: Operators started adding a suffix to every business header.

That suffix is the one you see every day:

Suffix	Meaning	Example
-T	Transactional	OTPs, bank debit alerts
-S	Service	Order updates, reminders
-P	Promotional	Offers and ads
-G	Government	Official government messages

And TRAI's definition of "transactional" is sharp. It's a message sent in response to something you started, within thirty minutes of it. OTPs from banks, e-commerce and app logins are named right there in the rule.

So why all this paperwork? TRAI's own August 2024 direction explains it. It found cases where words like "OTP", "lottery" and "disconnection" were used in templates that had nothing to do with the sender's business. Scammers were slipping malicious links into the blank parts of messages. The fixed-text rule, the tagged blanks and the whitelisted links are all ways of making the blanks too small to hide a scam in.

Now you know why the rules got stricter. Did they slow your OTP down? When the traceability deadline came, TRAI publicly called reports of OTP delays "factually incorrect".

Stop 4: How does the SMS centre find your phone?

Your letter passed the counter. Now it goes to the sorting centre.

Post office version: The sorting centre looks up where you live right now. Maybe you moved to Bengaluru last month. The address book says which local post office covers you, and your letter goes there.

Real version: The operator's SMSC, the Short Message Service Centre, takes over. It asks the network's subscriber register a simple question: where is this SIM right now, which part of the network is it connected to? Then it routes the message to that part of the network, down to the tower near you.

If you're on a different network than the one the business uses, the first operator hands the message over to yours. TRAI's rules even have names for them: the Originating Access Provider (where the message enters) and the Terminating Access Provider (the one you're on).

And here's the part most people don't know. The SMSC works on "store and forward".

Post office version: The postman knocks. Nobody's home. He doesn't throw the letter away. He brings it back tomorrow. After enough days, it goes back.

Real version: If your phone is switched off or has no signal, the SMSC stores the SMS and keeps trying. Once your phone comes back, it delivers. If the message's validity period runs out first, it's dropped.

That's why you sometimes get an OTP 10 minutes late, long after it expired. The message wasn't lost. It was sitting at the sorting centre, waiting for you to be "home".

Stop 5: How does your phone auto-fill the OTP?

The postman reached your letterbox. One last trick.

Post office version: Imagine a letter with a special mark on the envelope that only one person in your house recognises. They pick it up and open it. Nobody else touches your other mail.

Real version: On Android, apps can use Google's SMS Retriever API. The app's server adds an 11-character hash to the end of the OTP message. That hash comes from the app's package name and its signing certificate, run through SHA-256 and turned into base64. Google's docs say the message must be no longer than 140 bytes and must include the one-time code and that hash.

When an SMS with the matching hash arrives, Android hands just that one message to the app. The app doesn't need permission to read all your SMS. That's why some apps fill the OTP in by themselves.

Here's the command from Google's docs that computes the hash from an app's signing key:

keytool -exportcert -alias PlayDeploymentCert -keystore MyProductionKeys.keystore | xxd -p | tr -d "[:space:]" | echo -n com.example.myapp `cat` | sha256sum | tr -d "[:space:]-" | xxd -r -p | base64 | cut -c1-11

That's SHA-256 and base64, two things you can play with in our hash generator and Base64 encoder to see how they behave.

So why does an OTP sometimes never come?

Now that you know the route, you can guess where it breaks. Every stop has its own failure.

• Stop 1, the writer: The app's server is down or hits a limit, so the message is never written.
• Stop 2, the courier: The app's SMS aggregator has an outage. This is why the same app's OTP fails while your bank's OTP works fine.
• Stop 3, the counter: The message doesn't match DLT. A wrong template, an unregistered header, or an undeclared chain means it's rejected before it ever leaves.
• Stop 4, the sorting centre: Your phone is off, out of coverage, or roaming badly. The SMSC is holding it for you.
• Stop 5, your letterbox: A full inbox, a spam filter, or blocking business messages on your phone.

Next time "Resend OTP" doesn't work, you'll at least know which stop to suspect. If it's only one app, the problem is most likely on that app's side (Stops 1 to 3). If no SMS is coming at all, check your phone first.

Where does the post office analogy break?

Two places, and both are worth knowing. First, speed and scale. A letter takes days. Industry estimates put India's commercial SMS traffic at around 1.5 to 1.7 billion messages a day. Every one of them goes through that DLT counter check, and most still land in seconds.

Second, privacy. A sealed envelope hides what's inside. An SMS has no envelope like that. It isn't end-to-end encrypted, and anyone who sees your screen can read it. That's exactly why every OTP says "do not share". The system protects the route. You protect the code. The same one-time code idea shows up everywhere, even in IRCTC Tatkal booking, where an Aadhaar OTP now stands between you and the berth.

If you build apps, this is worth remembering too. Sending an OTP isn't "just an API call". It's a letter going through five hands, a government register and a sorting centre. Design your retry button and your expiry time with that in mind.

Frequently Asked Questions

How does OTP SMS work in India?

The app's server generates a random code and sends it to an SMS aggregator, which passes it to a telecom operator. The operator checks the sender name, message template and delivery chain against TRAI's DLT register. The operator's SMS centre then finds your phone on the network and delivers the message, usually within seconds.

What is DLT in SMS?

DLT stands for Distributed Ledger Technology. It's a blockchain-based register run by telecom operators under TRAI's rules, where every business must register itself, its sender names (headers) and its message templates. Operators check each commercial SMS against DLT before delivering it, and reject messages that don't match.

What does -T, -S, -P or -G mean in an SMS sender name?

Since 2025, telecom operators add a suffix to business SMS headers to show the message type. -T means transactional (like OTPs and bank alerts), -S means service, -P means promotional, and -G means government. A transactional message has to be sent within 30 minutes of a transaction you started.

Why is my OTP not coming?

It can fail at any point on the route. The app's server or its SMS provider may be down, the message may fail the operator's DLT check, or your phone may be off or out of coverage. If only one app's OTP isn't arriving while others work, the problem is most likely on that app's side.

Why do I sometimes get an OTP late?

Operators' SMS centres work on store and forward. If your phone is switched off or has no signal, the SMS centre holds the message and keeps retrying until its validity period ends. When your phone reconnects, the stored OTP arrives, sometimes after it has already expired.

Want to see the math behind that 11-character app hash? Try it yourself in our free SHA-256 hash tool.

Written by Adithya Guttha, Founder of Art of Code.