#SMS One-Time Code (SMS OTP)

4 min read

#Availability and setup

SMS self-service is being validated for the approved AiDial test accounts; it is not generally available. Approved Client Admins and Partner Admins manage their own SMS method in Account Security or personal Settings when the supported native service and account policy allow it. Internal staff retain stronger-factor rules. The profile mobile field cannot configure SMS. Unavailable controls refer to help@aidial.com.au, with no customer provider-console link.

Read the collection notice, enter an Australian mobile you control and acknowledge its use for security codes. Confirm this step establishes identity. On return, select the same step and re-enter the same number, then deliberately apply it. Private inputs are not kept across redirects.

After each acknowledged step, sign in normally before reading current SMS state or continuing. Enter the possession code exactly as received and confirm/apply verification. After another ordinary sign-in, verified-phone readback permits the separate Enable SMS factor step. Verification, enrollment and returning from setup do not count as SMS-satisfied sign-in. Test a separate normal SMS login.

#Change, abandon and remove

Changing a previously bound recipient requires an established authenticator, security key, passkey or supported recovery proof. SMS alone cannot redirect its own recipient. Pending replacement retains the old verified SMS recipient until the new one is verified. Keep a tested independent method throughout.

While replacement is pending, you can also choose another replacement, remove the SMS factor or remove the phone when your current proof and required-method policy allow it. You do not have to finish verifying an unwanted replacement before removing it.

Resend is bound to current pending state and native controls. Wait for the current code lifetime to end; removal/re-addition or changing numbers does not reset that interval. Wrong, expired or replayed codes cannot verify another recipient. Native attempt limits apply.

Abandoning an initial phone removes only that pending phone. Abandoning replacement with a retained original restores it as pending and starts NEW possession verification, subject to the resend interval. It never instantly verifies it. Closing the page clears local input without cancelling native work.

Remove SMS factor retains the verified phone. Remove phone also removes SMS. Native policy prevents loss of the last required usable method. Required-MFA roles must freshly demonstrate a retained method; native rechecks it during removal. Direct own-user removal also requires retained MFA unless the trusted Portal/API supplies a current optional-role decision. Optional SMS self-removal keeps its existing proof requirements and remains subject to native required-MFA policy. For same-recipient factor replacement, retain/test another method, remove SMS, sign in again, confirm and enable it on the still-verified phone, then independently test SMS login. Removal alone is incomplete replacement.

#Outcomes and recovery

A known acknowledgment remains applied even if session/audit follow-up failed. Sign in again; never repeat a mutation because an old login stopped working. Unknown outcomes block changes: sign in normally and read state. An advanced native revision may safely reconcile old custody; unchanged state stays unresolved. Do not remove another factor to resolve uncertainty.

Normal secure sign-in owns SMS send/resend/check; current email verification, role/tenant and required MFA still apply before complete login. For delivery failure use another method or an already-issued recovery code when offered, then identity-verified organisation administrator/AiDial support. Never share codes, seeds, tokens or challenge screenshots.

The existing notice identifies Twilio Inc. (United States) for security-code delivery and possible processing outside Australia. An Australian number does not establish Australian processing. Use a number you control, not a shared one. Status returns a four-digit mask; full recipients/codes do not enter browser errors, logs or audits. Removing SMS retains the phone; choose phone removal when appropriate under required-factor policy, or seek verified support if unable to authorize it.