SMS one-time password verification adds an identity verification step to the self-registration process.
After entering their registration details and mobile number, users receive a temporary verification code by SMS. Registration is completed only after the code is entered successfully.
This helps reduce registrations using invalid contact details and provides an additional layer of account security without requiring users to install an authentication application.
How it works
When SMS OTP verification is enabled for self-registration:
The user completes the registration form and enters a mobile phone number.
The system validates that the number is in international format, including the country code.
A six-digit verification code is generated and sent to the supplied mobile number.
The user enters the code on the verification screen.
If the code is correct and has not expired, the registration process continues and the account is created or activated.
The verification code is valid for five minutes.
Administrator setup
SMS OTP requires an active SMS service integration. Qmarkets system administrator will configure the SMS service and set the MFA to SMS OTP with email as fallback.
Configure the registration form
Add or enable the Mobile Phone Number field on the self-registration form and make it mandatory when SMS verification is required.
Mobile numbers must be entered in international format, including the leading + and country code.
For example: +44 7700 900123.
The mobile phone field becomes available when the SMS service is enabled and cannot be deleted from the system.
Review the SMS message
The OTP SMS uses a translatable system message. Administrators can review and translate this message under System Translation.
The default message communicates the verification code and its expiration time, for example:
Your verification code is 123456. The code expires in five minutes.
The SMS language can be determined by the language selected for the user or registration experience.
Security
The following are set in the system's security settings and applicable to all login attempts regardless of the method:
- Number of login attempts before suspension - How many login attempts before suspension (0 - unlimited, disable)
- Suspension Period - The period of suspension in seconds (default: 300)
- Number of login attempts before block - How many login attempts before blocking the user (0 - unlimited, disable)
User experience
After submitting the registration form, the user is shown a verification screen explaining that a code was sent to the registered mobile number.
The screen includes:
A numeric field for the six-digit verification code
A button to confirm the code and continue
A Send Again option if the message was not received
An error message when the code is incorrect or has expired
A link to login via email which will send an email with link to login.
Selecting Send Again generates a new code and sends another SMS. After clicking “Send Again” the link becomes disabled with timer 1 minute to prevent abuse.
When the correct code is entered, the mobile number is considered verified and the registration process continues.
If the code is incorrect, expired, or cannot be delivered, the user remains on the verification step and receives an explanatory message. 