## What is a one-time passcode?

A one-time passcode is a unique, system-generated code valid for a single session. It is sent to a user’s phone number or email address, and the user must submit it back to the system for verification. This ensures that the user controls the communication channel being verified.

## How it works in RiskOS™

1. **Add the OTP step** to your workflow and select the delivery channel ( **SMS, Email, or Voice**).  
2. Configure the **status, sub-status, and queue** to control how paused cases are tracked.  
3. When the workflow reaches the OTP step:  
   - RiskOS™ sends the OTP via the selected channel.  
   - The evaluation pauses until the OTP is provided via an **API PATCH call** (see API docs for details).  
4. The user provides the OTP through your application.  
5. RiskOS™ verifies the OTP received via the PATCH call and updates the evaluation outcome.

> 📘  
>  **Note**:  
>  OTP is currently not supported for KYB and UBO verification.

## Supported channels

- **Email**: OTP sent to the user’s email address provided in `data.individual.email`.  
- **SMS**: OTP sent via text message to the phone number provided in `data.individual.phone_number`.  
- **Voice (Phone Call)**: OTP delivered through an automated voice call to the phone number provided in `data.individual.phone_number`.

See also: **[OTP Verification](https://help.socure.com/riskos/docs/one-time-passcode-otp#/)**

Updated 3 months ago