99testsStart a job

Test case library · Login & identity

Test cases for SMS OTP login with a mobile number

These cases cover logging in with a mobile number and a one-time code sent by SMS, from entering the number to landing on the home screen. OTP login fails in the field for reasons a lab rarely shows: SMS that arrives late or out of order on busy carrier routes, auto-read that only works on debug builds, dual-SIM phones, and apps killed while the user switches to the messages app.

38 test cases8 release-blocking (P1)16 need a real phoneUpdated 2026-10-29

From the reviews. Login and OTP failures were 16.4% of the malfunction reviews in our India App Quality Report, and 7.1% of all reviews on banking app storefronts, the highest of any category.

category page · India App Quality Report

In scope

  • Mobile number entry and requesting the OTP
  • Android auto-read and iOS code autofill
  • Resend countdown, wrong attempts and expiry
  • Late, repeated and out-of-order SMS
  • Dual-SIM phones and changing the number mid-flow
  • OTP through a second channel, such as a voice call

Out of scope

  • New account sign-up and profile details (see mobile number sign-up)
  • SIM-based device binding
  • Email and password login

Before you start

  • Registered test numbers on Jio, Airtel and Vi SIMs that can receive SMS
  • A dual-SIM Android phone with both SIMs active, plus an iPhone
  • Android phones from at least two makers, including one with 3–4 GB RAM
  • The store-signed build from a Play Store testing track, as well as the debug build
  • The configured OTP validity, resend wait and attempt limit for the build under test
Show
Add to a test plan

Happy path6

OTP-01

Log in by typing the OTP from the SMS

P1functionalreal phone
  1. Enter a registered 10-digit mobile number and tap Get OTP
  2. Open the SMS when it arrives and type the code
  3. Tap Verify, then repeat with numbers on Jio, Airtel and Vi

Expected: The OTP screen shows the number the code was sent to, and Verify opens the home screen for that account. The SMS arrives on all three carriers.

Why a real phone: Checks real SMS delivery from the OTP provider to live SIMs on each carrier.

OTP-02

OTP is read and verified automatically on the store build

P2functionalreal phone
  1. Install the build from a Play Store testing track, not a debug build
  2. Enter a registered number and tap Get OTP
  3. Wait without touching the OTP field

Expected: The code fills by itself and verification starts without typing or any permission prompt. The home screen opens.

Why a real phone: The real SMS must carry the hash that matches the store-signed build.

OTP-03

Consent prompt fills the code on Jio, Airtel and Vi

P2functionalreal phone
  1. Use a build that reads the OTP through the Android consent prompt
  2. Request an OTP on a Jio SIM and tap Allow on the prompt
  3. Repeat on Airtel and Vi SIMs

Expected: On each carrier the system prompt shows the OTP message, and tapping Allow fills the code.

Why a real phone: SMS sender headers differ by carrier and region, which an emulator cannot reproduce.

OTP-04

iOS code suggestion fills every digit box

P2functionalreal phone
  1. On an iPhone, request an OTP and tap the first digit box
  2. Tap the code suggested above the keyboard when the SMS arrives

Expected: All digit boxes fill with the code, not just the first one, and verification starts or Verify becomes active.

Why a real phone: The iOS Simulator cannot receive SMS, so code suggestions need a real iPhone.

OTP-05

Resend unlocks only when the countdown ends

P1functional
  1. Request an OTP and watch the resend countdown
  2. Tap Resend while the countdown is still running
  3. Tap Resend after the countdown reaches zero

Expected: Resend stays disabled until the countdown ends, then sends a new code and restarts the countdown. A message confirms the code was sent again.

OTP-06

Get the code through a second channel, such as a voice call

P2functionalreal phone
  1. Request an OTP and wait until the app offers another channel, such as a call
  2. Choose the call option and answer the incoming call
  3. Enter the code read out on the call and tap Verify

Expected: The code arrives on the chosen channel for the entered number and signs in. If the SMS arrives later, it does not replace the code already entered.

Why a real phone: Needs a real call or message from the OTP service to a live number.

Validation & negative5

OTP-07

Number with fewer or more than 10 digits is stopped before sending

P2negative
  1. Enter 9 digits and tap Get OTP
  2. Try to enter 11 digits
  3. Paste text containing letters into the number field

Expected: The field stops at 10 digits or shows an inline error, and Get OTP stays disabled for invalid input. Letters are not accepted.

OTP-08

Wrong OTP shows a clear error and the attempts left

P2negative
  1. Request an OTP and enter a different code
  2. Tap Verify and read the message
  3. Enter the correct code and tap Verify

Expected: An error says the code is wrong and, if the app shows it, how many attempts remain. The correct code entered next signs in.

OTP-09

Code is blocked after the configured number of wrong attempts

P1security
  1. Enter wrong codes until the configured attempt limit is reached
  2. Enter the correct code from the SMS
  3. Reinstall the app and try the same number again

Expected: The correct code no longer signs in once the limit is reached, and the message says when to try again or to request a new code. Reinstalling does not reset the block.

OTP-10

Expired OTP is rejected with a way to get a new one

P2negative
  1. Request an OTP and leave the screen open past the configured validity
  2. Enter the code from the SMS and tap Verify

Expected: A message says the code has expired and offers Resend. The expired code does not sign in.

OTP-11

Deny the consent prompt and type the code instead

P2negative
  1. Request an OTP on a build that uses the consent prompt
  2. Tap Deny when the prompt appears
  3. Type the code manually and tap Verify

Expected: The prompt closes and does not reappear for the same SMS. The typed code signs in.

Edge cases7

OTP-12

Codes arrive out of order after two resends

P2edgereal phone
  1. In a weak-signal spot, request an OTP and tap Resend twice when allowed
  2. Note the order in which the SMS messages arrive
  3. Enter the code from the last SMS to arrive

Expected: The code from the latest request signs in. An older code is rejected with a message pointing to the newest SMS, and auto-read does not replace a newer code with an older one.

Why a real phone: Out-of-order delivery happens on real carrier routes under load or weak signal.

OTP-13

Auto-read fills the code just as the user taps Verify

P2edge
  1. Request an OTP and type the code from the notification quickly
  2. Tap Verify at the moment auto-read fills the field
  3. Repeat, this time double-tapping Verify

Expected: Only one verification runs and the home screen opens once. No 'code already used' or 'invalid OTP' error appears afterwards.

OTP-14

SMS text with other numbers in it fills only the OTP

P2edgereal phone
  1. Request an OTP and check the SMS for other numbers, such as validity or a reference
  2. Let auto-read fill the field, or paste the whole SMS into it

Expected: The field gets only the OTP digits, never the validity minutes or a reference number.

Why a real phone: Depends on the exact SMS text the provider sends to a real SIM.

OTP-15

Change the number after the OTP has been sent

P1security
  1. Request an OTP for number A
  2. Tap Change number, enter number B and request an OTP
  3. Enter the code sent to number A and tap Verify

Expected: The OTP screen now shows number B with a fresh countdown. The code sent to number A is rejected.

OTP-16

Number pasted with +91, spaces or a leading 0 is cleaned up

P2edge
  1. Paste a contact's number saved as +91, a space and 10 digits
  2. Paste the same number with a leading 0 instead of +91
  3. Tap Get OTP each time

Expected: The field shows the plain 10-digit number each time and the OTP screen shows it correctly. No 'invalid number' error appears and +91 is not added twice.

OTP-17

Paste a copied code into the digit boxes

P3edge
  1. Copy the code from the SMS or its notification
  2. Long-press the first digit box and tap Paste
  3. Repeat with the code copied with a space before it

Expected: All boxes fill with the digits in order and the space is ignored. Paste is offered on the digit boxes, not blocked.

OTP-18

Resend countdown keeps running while the app is in the background

P3edge
  1. Request an OTP and note the countdown
  2. Switch to another app for longer than the countdown
  3. Return to the app

Expected: The countdown has finished and Resend is available. It does not resume from where it was when the app was left.

Interruptions & network5

OTP-19

OTP arrives after the countdown ends but before it expires

P2interruptionreal phone
  1. Request an OTP in a spot where SMS is slow, such as a basement
  2. Let the countdown finish without tapping Resend
  3. Enter the code when the SMS finally arrives

Expected: The late code signs in because no newer code was requested. The screen has not moved away from OTP entry.

Why a real phone: Depends on real SMS delays on Jio, Airtel or Vi routes.

OTP-20

Mobile data drops before the code is submitted

P2interruption
  1. Request an OTP, then turn mobile data off before the SMS arrives
  2. Enter the code and tap Verify
  3. Turn data back on and tap Verify again

Expected: A no-connection message appears and the code stays in the field. The retry signs in and the failed try is not counted as a wrong attempt.

OTP-21

Incoming call while waiting for the OTP

P3interruptionreal phone
  1. Request an OTP
  2. Answer an incoming call and stay on it until the SMS arrives
  3. End the call and return to the app

Expected: The OTP screen still shows the same number and the countdown has moved on. Auto-read fills the code, or it can be typed.

Why a real phone: Call screens on OEM skins pause the app differently from emulator calls.

OTP-22

App killed while the user reads the code in the messages app

P1interruptionreal phone
  1. On a 3–4 GB RAM phone, open a few heavy apps
  2. Request an OTP and switch to the messages app to read it
  3. Return to the app from the recent apps screen

Expected: The OTP screen reopens for the same number with the countdown intact, and the code from the SMS signs in. No new OTP is sent automatically.

Why a real phone: OEM memory managers on budget phones kill backgrounded apps far more often than emulators.

OTP-23

Request the OTP on a slow 2G connection

P2performance
  1. Set the phone to 2G only, or move to a weak-signal spot
  2. Enter a number and tap Get OTP
  3. Tap Get OTP again while it is loading

Expected: A loading state shows and Get OTP stays disabled until the request finishes or fails with a retry message. The OTP screen opens only once.

Device & OS6

OTP-24

OTP sent to the SIM that is not used for mobile data

P2compatibilityreal phone
  1. On a dual-SIM phone, set mobile data to SIM 1
  2. Enter the SIM 2 number and tap Get OTP
  3. Wait for the SMS on SIM 2

Expected: The code that arrives on SIM 2 is auto-read or can be typed, and it signs in. The app does not ask to switch SIMs or use the SIM 1 number.

Why a real phone: Needs a phone with two live SIMs; emulators have no dual-SIM radio.

OTP-25

Number suggestions on a dual-SIM phone

P3compatibilityreal phone
  1. On a dual-SIM phone, tap the mobile number field
  2. Check the number suggestions offered by the phone
  3. Pick the second SIM's number, or dismiss the suggestions

Expected: The picked number fills as 10 digits without a doubled +91. If nothing is suggested or the suggestions are dismissed, the field stays open for typing.

Why a real phone: Suggestions come from the real SIMs, and some SIMs do not report their number.

OTP-26

Keyboard code suggestion and app auto-read fill the field together

P2compatibilityreal phone
  1. Use a keyboard that suggests codes from SMS, such as the phone maker's default
  2. Request an OTP and tap the keyboard's code suggestion as soon as it appears
  3. Let the app's auto-read run at the same time

Expected: The field holds the code once, with no doubled or extra digits. Verification runs only once.

Why a real phone: Code suggestions come from OEM keyboards reading a real incoming SMS.

OTP-27

OTP SMS filed as spam by the phone maker's messages app

P3compatibilityreal phone
  1. On Xiaomi, Vivo and Samsung phones, use the default messages app
  2. Request an OTP and watch for the notification
  3. Open the messages app and find the SMS

Expected: A notification shows when the SMS arrives, and the message is in the inbox or the OTP category, not in spam or blocked messages.

Why a real phone: Each phone maker's messages app filters and groups SMS in its own way.

OTP-28

OTP reaches a number with carrier do-not-disturb turned on

P1compatibilityreal phone
  1. On a Jio, Airtel or Vi test SIM, turn on the carrier's full do-not-disturb preference
  2. Wait until the carrier confirms the preference is active
  3. Request an OTP for that number

Expected: The OTP SMS arrives as it does for numbers without the preference. It takes no longer than on the other test SIMs.

Why a real phone: Carrier filtering of promotional messages applies only to real SIMs.

OTP-29

Phone without Google Play services, or with an outdated version

P3compatibility
  1. Use a phone without Google Play services, or one where it is out of date
  2. Request an OTP and open the OTP screen
  3. Type the code from the SMS and tap Verify

Expected: The OTP screen opens without a crash or an error about auto-read. The typed code signs in.

Security & privacy5

OTP-30

A code that has already signed in cannot be used again

P1security
  1. Log in with an OTP and note the code
  2. Sign out, enter the same number and tap Get OTP
  3. Enter the earlier code instead of the new one

Expected: The earlier code is rejected. Only the newly sent code signs in.

OTP-31

Repeated OTP requests for one number are throttled

P1security
  1. Request an OTP and tap Resend each time it unlocks
  2. Go back, re-enter the number and request again several times
  3. Reinstall the app and request again

Expected: After the configured number of requests, the app shows a message saying when the user can try again. Going back or reinstalling does not reset the limit.

OTP-32

Unregistered number gets the same OTP step as a registered one

P2security
  1. Enter a number that has no account and tap Get OTP
  2. Enter a registered number and tap Get OTP
  3. Compare the screens and messages

Expected: Both numbers reach the same OTP step with the same wording. Whether an account exists is shown only after the code is verified.

OTP-33

Phone clock moved forward to skip the resend countdown

P3security
  1. Request an OTP and leave the countdown running
  2. Turn off automatic time and move the phone clock forward
  3. Return to the app and tap Resend

Expected: Resend stays locked until the real wait has passed, or the request is refused with a message to wait.

OTP-34

Another SMS with a code-like number does not fill the OTP field

P2security
  1. Request an OTP
  2. Before it arrives, have someone send the phone an SMS containing a code-like number
  3. Wait for the real OTP SMS

Expected: The other SMS does not fill the field. Only the OTP message is auto-read or offered in the consent prompt.

Accessibility & language4

OTP-35

TalkBack reads the digit boxes, countdown and errors

P2accessibility
  1. Turn on TalkBack and open the OTP screen
  2. Swipe through the digit boxes and the Resend control
  3. Enter a wrong code and listen

Expected: The boxes are read as one code field or with their position, and the error is read out. The countdown is not announced every second, and Resend is read as unavailable until it ends.

OTP-36

Largest font and display size on the OTP screen

P2accessibility
  1. Set font size and display size to the largest in phone Settings
  2. Open the OTP screen on a small phone with the keyboard up

Expected: All digit boxes fit on one row or wrap readably, with no clipped digits. Resend and Verify can be reached without closing the keyboard.

OTP-37

OTP SMS in Hindi arrives whole and is auto-read

P2localizationreal phone
  1. Set the app language to Hindi, if the OTP SMS follows it
  2. Request an OTP and open the SMS
  3. Let auto-read fill the code

Expected: The SMS arrives as one message with readable Hindi text and the code intact. Auto-read fills the code as it does for the English SMS.

Why a real phone: Unicode SMS splitting and joining happen on the real carrier route and phone.

OTP-38

Code typed with Devanagari digits from a Hindi keyboard

P2localization
  1. Set a Hindi keyboard as the default
  2. Tap the OTP field and type the code using Devanagari digits
  3. Tap Verify

Expected: The keyboard opens in number mode, or Devanagari digits are converted to 0–9 and the code signs in. A correct code typed this way is not rejected as invalid.

In the field

Where OTP login breaks on real phones

  • Auto-read works on debug builds but not on the Play Store build, because the SMS carries the hash for the wrong signing key.
  • Sender headers change by carrier and region, so apps that accept only one exact sender stop auto-reading on Jio, Airtel or Vi.
  • At busy times SMS arrives late or out of order, and users type a code that a resend has already replaced.
  • On 3–4 GB RAM phones with aggressive memory management, the app is killed while the user reads the SMS and reopens at the number screen.
  • Numbers with carrier do-not-disturb preferences never get the code when the carrier treats the message as promotional.
  • OTP messages in Hindi or other Indian languages are sent as Unicode, split into two parts, and break auto-read or hide the code.

Run these 38 cases on real phones

They fit the Standard package: 10 × 45-minute sessions on 4 phones or browsers of your choice, up to ~50 cases, ₹18,999 + GST ($249), verified report in 3 business days. The 8 P1 cases alone fit Starter (₹9,999 + GST).

Download the CSV, pick the package at checkout and upload the file with your build. Testers run them on their own phones, on Jio, Airtel and Vi.

Questions

About testing OTP login

What is the difference between SMS Retriever and the SMS User Consent prompt on Android?

SMS Retriever reads the OTP with no prompt, but only if the SMS contains a hash string built from the app's signing key. The User Consent method shows a system prompt with the message and fills the code only after the user taps Allow, and it needs no hash. Test whichever your app uses on the build installed from the Play Store, on each carrier you support.

Why does OTP auto-read work in testing but fail for real users?

The most common reason is that the SMS template carries the hash for the debug or upload key, while users install a build signed with the Play Store app signing key. Other causes are a template edited without the hash, sender filters that expect one carrier's header, and Hindi or regional-language messages split into two parts. Always test auto-read on the store build with real SIMs from Jio, Airtel and Vi.

How do you test OTP login on a dual-SIM phone?

Use two active SIMs from different carriers and set mobile data on one of them. Send the OTP to the number on the other SIM, then swap the data SIM and repeat. Check that the SMS arrives, that auto-read or manual entry works, and that number suggestions show the right SIM's number, or nothing if the SIM does not report one.

Related flows

Test these next

Your AI wrote the test cases. Run them on real phones.

99tests runs your cases, AI-generated ones included, on the phones, laptops and browsers your users own. Every finding is verified, serious bugs come with a screen recording, and each case comes back pass, fail, blocked or not run.