Why SMS Verification Codes Expire and How to Beat the Clock

How Long Codes Last

There is no standard. Time-based one-time passwords generated by authenticator apps rotate every 30 seconds by specification, and some platforms apply the same window to SMS. Most consumer platforms use something between two and ten minutes. Observed windows, which platforms change without notice: WhatsApp and Telegram give roughly five minutes before the resend option appears and the old code is invalidated; Google around ten; Instagram and Facebook five to ten; Discord and Tinder closer to five; Uber and Bolt a few minutes with four-digit codes; and most banks and fintechs, including Revolut, Wise, and PayPal, two to five minutes with a hard cutoff.

A platform can also invalidate a code early. Requesting a resend usually voids the previous code even if it has time left, and some platforms void the code when you leave the verification screen or restart the app. The safe assumption is that only the most recently requested code is live, and it has less time than the platform says.

What the code is, how it is generated, and why it is tied to the number are covered at /blog/sms-otp-explained.

Why Platforms Keep Shortening the Window

A code that lasts ten minutes gives an attacker ten minutes to phish it. The common attack is a fake login page or a phone call from "the bank" that asks the victim to read out the code that has arrived; the attacker enters it on the real site. Every minute of validity widens that window, so security teams shorten it, and regulators push in the same direction: PSD2 strong-customer-authentication guidance in Europe expects short-lived, single-use codes, and NIST's digital identity guidelines recommend limiting OTP validity.

A second reason is brute-force resistance. A six-digit code has a million combinations, and a platform that allows several attempts within a long window is guessable at scale. Short windows plus attempt limits close that. A third reason is cost: SMS pumping fraud, where attackers trigger codes to premium-rate ranges, made platforms limit both validity and resends. The result is that windows are shorter than they were five years ago and are not getting longer.

Where the Delay Comes From

The platform sends the code to an SMS aggregator, which picks a route to the destination carrier. A direct route to a large carrier delivers in one to five seconds. A grey route, a cheaper path that hops through intermediate carriers or through another country, can take thirty seconds to several minutes and sometimes drops the message entirely. Aggregators choose routes by cost and by the sending platform's tier, and routing to some countries is slow at certain hours when the cheap routes are congested.

The receiving side adds its own delay. A number that is roaming, on a congested network, or on a carrier with strict SMS filtering may hold the message. Filters that look for OTP patterns from unknown senders, common on some African and South Asian carriers, add seconds to minutes. None of this is visible to you; the only symptom is a code that arrives with a minute left, or arrives after it has already expired. The full troubleshooting sequence for codes that do not arrive at all is at /blog/sms-not-arriving-troubleshooting.

Acting Fast With a Temp Number

With a temp number the delay is the same as with any number, but the way you handle the inbox decides whether you make the window. The habits below are the difference between a code used with three minutes to spare and one that expired while you were switching tabs.

• Open the TempNumber.me dashboard and have the activation showing before you tap "send code" on the platform. Do not buy the activation, then go to the platform, then come back to find the inbox.
• Keep the platform and the dashboard side by side, or on two devices. Switching apps on a phone costs seconds and sometimes reloads the verification screen, which on some platforms voids the code.
• Use the copy button on the code the moment it appears. Retyping six digits under time pressure is where mistakes happen, and a wrong entry on a strict platform counts against the attempt limit.
• Do not request a resend while the first code is still in transit. The resend voids the first, and if the first then arrives, you will enter a dead code.
• If nothing has arrived by half the window, decide then: wait, or cancel the activation and take a different country. Waiting until the code expires and then resending doubles the time spent and often hits the resend limit.
• For platforms with 30-second or two-minute windows, pick a country with a direct route to the major carriers. Fast-route countries for common services are listed at /blog/how-to-choose-country-for-verification.

Resend Limits and Lockouts

Every platform caps resends. Common patterns: three resends in fifteen minutes, then a cooldown of an hour; or five in a day, then a 24-hour block on that number. WhatsApp shows a countdown to the next allowed SMS request that grows with each attempt, from a minute to an hour to twelve hours. Telegram behaves similarly and after enough attempts refuses the number for a day. Google and Instagram block the number quietly and show a generic "try again later".

The trap is that a slow route and a resend limit combine. Two slow codes, two resends, and the platform locks the number before a fast code has a chance. On a temp number that means the activation is wasted and the number may be flagged for that platform. The rule that avoids it: if a code expired twice in a row on the same number, the route is slow for that country, and the third attempt will not be faster. Cancel the activation, pick a different country, and start again with the dashboard open. Requests for credit on activations where no code arrived are handled case by case via support@tempnumber.me.

Shared Numbers and the Clock

Shared public SMS inboxes make the timing problem worse in two ways. The page refreshes on a schedule rather than in real time, so a code with a five-minute window may be shown two minutes after it landed. And the number is receiving codes for many people at once, so you scan a list of messages to find yours while the clock runs, and someone else may enter it first. Platforms also throttle delivery to numbers they have seen thousands of times, which lengthens the very delay you are trying to beat.

A private number removes both. The TempNumber.me dashboard shows the code for your activation as it arrives, with nothing else in the inbox, and nobody else can read or use it. Beating the clock is mostly about having the code in front of you the second it lands, and a private inbox is the only kind that does that.

A Checklist for Short Windows

For platforms with the shortest windows, banks, fintechs, and anything using a 30-second TOTP-style SMS, run through this before requesting the code: dashboard open on the activation, platform on the code-entry screen, a country with a direct route chosen, no resend planned, and a decision made in advance to switch country if the first code is late. Under those conditions a code that arrives in five seconds is entered in fifteen, and the window is never the problem.