App Development

Phone verification for your app: Twilio Verify, SMS and passkeys

10 min readBy Jaskirat Singh Talwar

A hand holding a phone above a desk with a laptop, a car key and an orange notebook

For most apps, the quickest safe way to verify a phone number is a managed service such as Twilio Verify, which sends the code, checks it and blocks a lot of fraud for you. As of October 2026 Twilio charges $0.05 per successful verification plus a channel fee (for example $0.0083 per SMS to the US). SMS codes are fine for confirming that a user owns a number, but they are weak as the only way to sign in, because of SIM swap and phishing. For sign-in, add passkeys, which are phishing-resistant by design, and keep SMS as a fallback.

Key takeaways

  • Separate two jobs: proving a user owns a phone number (SMS is fine) and protecting sign-in (passkeys or an authenticator app are stronger).
  • Twilio Verify bills mainly for successful verifications, sends over SMS, voice, WhatsApp, email and other channels, and includes Fraud Guard for SMS pumping, as of October 2026.
  • In the US, Twilio says you can use Verify instead of registering for A2P 10DLC if verification texts are all you send from those numbers. Any other texts need registration.
  • NIST's current guidance calls SMS and voice codes a "restricted" authenticator and says they are not phishing-resistant.
  • Turn on fraud controls before launch: restrict countries, rate-limit the phone field, and watch for traffic to countries you do not serve.

What does phone verification actually protect?

It proves that the person in front of the app can receive a message on a given number at that moment. That is useful at sign-up, when a number becomes a delivery or contact channel, and as one factor in two-step sign-in.

It does not prove who the person is, and it does not stop someone who has taken over the number. Decide first which job you need:

Job Good fit Why
Confirm a new user's number at sign-up SMS or WhatsApp code Cheap, familiar, works on any phone
Second factor at sign-in Authenticator app (TOTP) or passkey, SMS as fallback Not tied to the phone network
Passwordless sign-in Passkeys Phishing-resistant, nothing to type
High-value actions (payouts, account changes) Passkey or a fresh step-up check Codes can be phished in real time

On our own projects the pattern is the same. In the booking apps we built for a ground transport company, passengers and drivers register with Facebook login or with Twilio SMS verification, and the apps also include in-app calling. In AutoAccount, the accounting platform we built for Business Analytics Inc., sign-in uses JWT tokens with two-factor codes by SMS through Twilio or from an authenticator app, set up with a QR code.

How does Twilio Verify work?

Your server asks Verify to start a verification for a number and channel; Twilio generates and sends the code; the user types it in; your server asks Verify to check it. You never store the code yourself. Twilio's documentation says it "handles storing verification tokens and making sure messages are delivered globally."

As of October 2026, Twilio lists these Verify channels: SMS, voice, WhatsApp, email, TOTP (authenticator apps), Push, Silent Network Auth, Silent Device Approval and Passkeys. Two are worth a note:

  • Silent Network Auth checks the number with the mobile carrier in the background, with no code to type. Twilio prices it per country and does not bill a flow the carrier cannot complete.
  • Verify Passkeys is marked as beta or pilot in Twilio's own pages, with no public price. Treat it as early access, not something to plan a launch around.

Our Twilio integration work covers the parts around the API: Verify calls made with an API key rather than the main auth token, signature checks on webhooks, delivery status callbacks, and testing on a live account, because Twilio's test credentials do not send real messages.

What does Twilio Verify cost?

As of October 2026, Twilio's Verify pricing page lists:

Channel Price (US, as of October 2026)
Base fee $0.05 per successful verification
SMS $0.05 + $0.0083 per SMS sent
WhatsApp $0.05 + a per-message authentication template fee (the page shows both $0.0034 and $0.0147; check it before budgeting)
Voice $0.05 per successful verification, plus voice minutes at Twilio's voice rates
Email $0.05 per successful verification
TOTP and Push Channel fee included in the $0.05
Silent Network Auth $0.05 + a per-country fee (not listed on the page)
Passkeys Pilot, no price published

Three billing details matter for a budget:

  • The $0.05 base fee is not charged for failed, expired or abandoned verifications, but SMS and WhatsApp delivery attempts can still be billed when the user never finishes.
  • Twilio says volume pricing is "custom" and is typically considered from about 100,000 verifications a month.
  • Carrier surcharges, registration fees and short codes are separate.

So the real cost depends on your countries, your channel mix, how many users retry, and how much fraud reaches the phone field.

What can go wrong with SMS codes?

Three things, and each has a known control.

SIM swap. A criminal persuades or bribes a mobile carrier to move a victim's number to a new SIM, then receives their codes. The FBI's Internet Crime Complaint Center warned in 2022 that criminals were using SIM swaps to drain bank and cryptocurrency accounts. NIST's SP 800-63B-4 says verifiers "SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior)" before sending a code by phone. Twilio Lookup can return line type and optional risk data on a number before you send.

Phishing in real time. A fake site asks for the code and replays it on the real one within seconds. NIST is blunt: "Out-of-band authentication is not phishing-resistant." It classes SMS and voice delivery as "restricted", which means an organisation must assess and accept the risk and offer users an alternative authenticator.

SMS pumping (toll fraud). Twilio describes it as fraudsters taking advantage of a phone number input field to trigger texts to numbers run by one mobile operator, then sharing the revenue. You pay for every message. Twilio's advice, as of October 2026:

  • Turn on Verify Fraud Guard, which watches your SMS traffic and blocks destination prefixes when it sees pumping. It has Basic, Standard (the default level) and Max settings; Max blocks more aggressively and Twilio says it has occasional false positives (under 2%). The Verify pricing page says this protection is included in the base fee. It does not cover voice.
  • Limit Verify's geographic permissions to the countries you actually serve.
  • Use Lookup Line Type Intelligence to send codes only to mobile numbers.

Add your own controls on top: rate limits per number, per IP address and per device on the "send code" endpoint, a cap on resends, and an alert when traffic to a new country appears.

When should you use passkeys instead?

Use passkeys for sign-in wherever your users' phones and browsers support them, and keep a fallback for those that do not. A passkey is a key pair: the private key stays on the user's device or in their password manager, and the website keeps only the public key. The FIDO Alliance calls passkeys "phishing resistant and secure by design", and Apple's developer page explains why: passkeys are linked to the app or website they were created for, so a user cannot be tricked into using one on a fake site.

The standards are mature. The W3C published Web Authentication Level 3 as a Recommendation on 25 August 2026. Apple syncs passkeys through iCloud Keychain, end-to-end encrypted. Google Password Manager syncs them between a user's Android devices and Chrome, and Google supports passkeys on Android, the web and iOS. Third-party password managers can also store them.

Passkeys still need a plan for:

  • Account recovery. If a user loses every device, how do they get back in? A verified phone number or email is the usual recovery route, so phone verification does not disappear; it moves to recovery and sign-up.
  • Mixed devices. Offer a passkey prompt after sign-in ("sign in faster next time") rather than forcing it on day one.
  • Shared or older devices. Keep an authenticator-app or SMS fallback for those users.

A sensible order for most products: SMS or WhatsApp verification at sign-up, passkeys offered for sign-in, an authenticator app as the second factor for staff and admin accounts, and SMS kept as a fallback with fraud controls on.

What are the US 10DLC and toll-free rules?

In the US, business texts from standard local numbers ("10DLC") need A2P 10DLC brand and campaign registration, and Twilio says unregistered traffic gets extra carrier fees. Twilio's 10DLC documentation also says: "If you're only using 10DLC numbers to send user verification text messages, you can use Twilio Verify rather than registering for A2P 10DLC." If the same app also sends reminders or marketing, you need registration for that traffic.

Toll-free numbers sit outside 10DLC and have their own verification. Twilio says its toll-free numbers cannot send SMS to the US and Canada until toll-free verification is approved, and that rejections include "opt-in not provided" (error 30476), so show how users consent. Since 15 September 2026, new toll-free verification submissions must also include a privacy policy URL and a terms and conditions URL.

Reminder texts are a different job from verification. For a dental clinic in Australia we built a reminder system that sends SMS through Twilio 24 hours and 1 hour before each appointment; messages like these follow each country's sender rules, not the Verify route. If you are weighing message channels more broadly, our guide to RCS, SMS and WhatsApp for business messages compares them.

FAQ

Is SMS verification still acceptable in 2026?

Yes, for confirming that a user owns a phone number and as a fallback factor. NIST's SP 800-63B-4 still allows it as a "restricted" authenticator, with a risk assessment and an alternative offered to users. It should not be the only protection on accounts that hold money or sensitive data.

Do I need Twilio Verify, or can I send codes with Programmable Messaging?

You can send your own codes with Programmable Messaging, but then you generate, store, expire and rate-limit them yourself, and in the US those texts need 10DLC or toll-free registration. Verify handles the codes, includes Fraud Guard for SMS, and in the US can be used instead of 10DLC registration when verification texts are all you send.

How much does Twilio Verify cost per user?

As of October 2026, $0.05 per successful verification plus the channel fee, for example $0.0083 per SMS to the US. Retries, failed deliveries and fraud raise the real figure, so check Twilio's pricing page for your countries.

What is SMS pumping and how do I stop it?

Fraudsters use your phone number field to trigger texts to numbers that share revenue with them, and you pay for every message. Turn on Verify Fraud Guard, allow only the countries you serve, send only to mobile numbers, and rate-limit the endpoint that sends codes.

Can passkeys replace phone verification completely?

For sign-in, often yes. For sign-up and account recovery, most products still verify a phone number or email, because a user who loses all their devices needs another way back in.

Does Twilio Verify support passkeys?

Twilio lists Passkeys as a Verify channel, but its own pages describe it as beta or pilot with no public price, as of October 2026. Passkeys can also be built directly on the WebAuthn standard and the Apple and Google platform APIs.

Sources (15 links)
Share this article