SMS OTP Versus Email OTP for Site Access (With a Fallback Boundary)

The page indicates that a supervisor lacks the ability to access the construction-site portal. An SMS code failed to arrive, and the login screen offered email as a secondary option, which also resulted in a delayed code. On-call personnel can view two requests but are unable to determine which delivery failed first from the pushed event.

In summary, the recommendation is to use SMS OTP as the primary built-in verification method for a US/EU SaaS login. Email OTP should be treated as a custom fallback option with its own code generation, storage, expiry, verification, and templates. This approach is considered the least complex solution due to the dedicated OTP and verify operations available in the SMS channel, while email lacks a managed OTP API.

The fallback state machine should be designed for idempotency, with both channels being rate-limited and delivery events being polled. Neither channel should be treated as a second factor when both routes ultimately depend on the same compromised account or device. The recommendation is an operational one rather than an ideological stance.

Email can be useful when a worker has poor mobile reception but functioning Wi-Fi, while SMS can be helpful when the worker cannot access an inbox from a shared or locked-down device. Neither channel eliminates the need for recovery policies, abuse controls, or an audit trail. The page is the final signal in the authentication process.

To properly assess the situation, a more detailed analysis of the authentication state machine should be conducted, counting each transition in the process. The events related to email and SMS should be monitored, even though they are pull-based and lack webhook events. The poller is an integral part of the login reliability path, and its performance should be tracked with its own alert.