SMS OTP vs Email OTP: Shift-Deadline Security for HR SaaS Login

When implementing a two-factor authentication (2FA) login or password-reset flow near a shift boundary for an HR SaaS application, the decision to use SMS OTP (one-time password) versus email OTP should be made dynamically based on the employee's verified, reachable destination at runtime. The system should allow one controlled fallback option, and the code validity should remain independent from the message delivery.

The primary goal is to ensure a completed login or reset within the expiry window, with any provider acceptance, email open, or SMS handoff serving only as intermediate signals.

The integration effort should be evaluated based on the entire path, not just the wiring up of a single channel. It is essential to cover the whole story, including four separate observable stages: creating a challenge, queuing a message attempt, recording the channel outcome, and accepting the code once. These identities should be kept separate to maintain a clear audit trail and handle retries at the delivery attempt level rather than the challenge level.

When considering deadlines, it is crucial to analyze the failure signal first and ensure that the chosen channel is the employee's verified, reachable destination. A shorter expiry time, one-time consumption, and attempt limits should be implemented to manage the risk of shift-boundary failures. SMS and email both have their limitations, as neither can prove that the intended employee read the code.

Domain authentication plays a role in email deliverability, but it does not guarantee proof of possession. SMS, on the other hand, faces its own set of challenges between submission and human receipt.

To determine the best channel, it is necessary to model queued, submitted, delivered, temporarily failed, and permanently failed states separately, without allowing any of them to consume or validate the challenge. The timer for a fallback should be set based on the reset SLO and observed latency distribution for the destination cohort, rather than relying on a fixed timer.

The security comparison between SMS and email is contextual, and regional labels such as US or EU should not be used to make this decision. Instead, measure deliverability and latency for the actual workforce cohorts and maintain consistent security controls across both channels.

The design review should include an explicit boundary where a five-minute lifetime and six verification attempts are used as local policy values, which can be adjusted through configuration and reviewed against the reset SLO and support process. The `Challenge` struct and its associated functions (`NewChallenge` and `Verify`) should be implemented to handle the challenge creation, verification, and tracking of attempts.

The integration ownership should be budgeted before making a buy-versus-build decision, taking into account on-call work and the overall operational impact.