WhatsApp vs SMS for OTP and Notifications

Updated on October 29, 2026

For verification codes and notifications in markets where WhatsApp is widespread, such as Brazil, WhatsApp is usually the first choice and SMS the backup. WhatsApp delivers messages with buttons, tells you when a message was delivered and read, and has official rates published by Meta. SMS reaches any phone, including people without WhatsApp. The strategy that works best is combined: try WhatsApp first and, if it does not deliver within a few seconds, send an SMS.

This article compares the two channels on reach, features, cost and security, and shows how to build the fallback in code.

Quick comparison

Criterion	WhatsApp (official API)	SMS
Reach	Only people with a WhatsApp account	Any phone with an active line
Needs internet	Yes	No
Delivery status	`sent`, `delivered`, `read`, `failed` via webhook	Carrier delivery report, when available
Read receipts	Yes, when available	No
Format	Text, media, buttons, lists	Short text, split into segments
Sender identity	Display name approved by Meta	Short code or long number, depending on the carrier
Price	Meta’s official rate card by category and country	Varies by vendor and carrier
Starting contact	Approved template	Free text (subject to vendor rules)
Typical fraud	Form abuse (mass requests)	SMS pumping

Reach: who gets each channel

SMS reaches any phone with an active line and signal, with no app or mobile data required. No app beats that.

WhatsApp only delivers to numbers with an active WhatsApp account. If the number is not on WhatsApp, the API accepts the call, but the status webhook returns failed, usually with code 131026, which Meta describes as “Unable to deliver message”. The error is explained in detail in WhatsApp API error 131026.

That is why, for sign-up OTP that must work for 100% of users, SMS remains important as a fallback.

Want to try it while you read? Create a Vectalk account and send your first message through the official API. Create free account →

Features: what WhatsApp does that SMS does not

Authentication templates

Meta has a dedicated template category for verification codes. Per the documentation, this template has fixed text set by Meta and a single button, which can be:

copy code: the user taps and the code goes to the clipboard;
one-tap autofill: on Android, the button opens your app and passes the code;
zero-tap: Android only, no button; your app receives the code automatically.

The template can include a security disclaimer (“do not share this code”) and an expiration warning from 1 to 90 minutes. Meta also sends authentication codes only to the user’s primary device, not to linked devices. Step-by-step setup is in WhatsApp OTP with authentication templates.

Sending a code with a copy-code button:

{
  "messaging_product": "whatsapp",
  "to": "15551234567",
  "type": "template",
  "template": {
    "name": "verification_code",
    "language": { "code": "en_US" },
    "components": [
      {
        "type": "body",
        "parameters": [{ "type": "text", "text": "482913" }]
      },
      {
        "type": "button",
        "sub_type": "url",
        "index": "0",
        "parameters": [{ "type": "text", "text": "482913" }]
      }
    ]
  }
}

Notifications with an action

For notifications (order shipped, appointment tomorrow, invoice ready), WhatsApp supports an image or document in the header plus reply or link buttons. The customer confirms the appointment with one tap, and the reply reaches your webhook. With SMS, the same action depends on the customer opening a link or replying with text.

Delivery and read status

Every message sent through the API generates webhook events. That lets you measure delivery and reads per template, and trigger the fallback when delivery does not happen. See WhatsApp API message status webhooks.

Cost

Meta charges per delivered message, with rates set by category and country. As an example, for recipients in Brazil since October 1, 2026, in Brazilian reais (BRL):

Category	Typical use	Meta rate
Authentication	Verification code, login	BRL 0.0350
Utility	Order, delivery, appointment reminder, invoice	BRL 0.0350
Marketing	Offer, product news	BRL 0.3217

A few practical points:

undelivered messages are not charged, which includes numbers without WhatsApp;
since October 1, 2026, utility templates sent inside the customer service window are also charged;
in some countries, Meta applies an authentication-international rate, higher than the local one;
utility and authentication have volume discounts; see how the tiers work.

Billing details for Brazil are in WhatsApp API pricing in Brazil.

SMS

SMS pricing depends on the vendor, volume, route type and destination carrier. There is no single public rate card like Meta’s. To compare, ask each vendor for the price per delivered segment in your destination countries and whether they bill per send or per delivery.

Remember that a long SMS is split into segments: GSM-7 encoding fits 160 characters in a single message; with characters outside the GSM-7 alphabet (such as many Portuguese and Spanish accented letters) or emoji, the text switches to Unicode and the limit drops to 70 characters. A notification with accents can become two or three billed segments.

Fraud: SMS pumping

SMS pumping (also called artificially inflated traffic) is a fraud in which bots use your sign-up or login form to request codes for number ranges controlled by people who profit from message termination fees. You pay for every SMS, and no real person receives it. Twilio, for example, documents this attack and offers its own tools to block it.

On WhatsApp, the message does not go through carrier termination billing and is only charged when delivered to a WhatsApp account, which removes the financial incentive for this type of fraud. That does not eliminate abuse: bots can still request codes in bulk for valid numbers. The defenses apply to both channels:

request limits per number, per IP and per device;
CAPTCHA or invisible verification before sending the code;
blocking country prefixes where you do not operate;
an alert when the code conversion rate (requests vs. validations) drops suddenly.

Combined strategy: WhatsApp first, SMS fallback

The most common OTP flow:

The user enters their number.
Your system sends the authentication template via WhatsApp and stores the message ID (wamid).
If the webhook returns delivered within a few seconds, wait for the code.
If it returns failed (for example, 131026) or nothing arrives in time, send the same code by SMS.
Show on screen which channel was used and offer “resend by SMS”.

Node.js example:

const VECTALK = 'https://apis.vectalk.com.br/api/messages';
const TIMEOUT_MS = 8000;

async function sendOtp(phone, code, { waitForStatus, sendSms }) {
  const r = await fetch(VECTALK, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.VECTALK_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      messaging_product: 'whatsapp',
      to: phone,
      type: 'template',
      template: {
        name: 'verification_code',
        language: { code: 'en_US' },
        components: [
          { type: 'body', parameters: [{ type: 'text', text: code }] },
          { type: 'button', sub_type: 'url', index: '0', parameters: [{ type: 'text', text: code }] },
        ],
      },
    }),
  });

  if (r.ok) {
    const { messages } = await r.json();
    // waitForStatus resolves when the webhook reports delivered/failed for this wamid
    const status = await waitForStatus(messages[0].id, TIMEOUT_MS);
    if (status === 'delivered' || status === 'read') return 'whatsapp';
  }

  await sendSms(phone, `Your code: ${code}`);
  return 'sms';
}

The waitForStatus function reads the events your webhook stores (for example, in a queue or Redis) and returns the first status for that wamid within the timeout. Tune the timeout by measuring the real time to delivered for your users.

For non-urgent notifications, such as an appointment reminder for tomorrow, the timeout can be minutes, and the SMS only goes out to people who did not get the WhatsApp message.

What about RCS?

RCS is the evolution of SMS, with WhatsApp-like features inside the phone’s default messaging app. It has its own availability and rules. The comparison is in RCS vs. WhatsApp.

How to do this with Vectalk

Vectalk is a proxy for Meta’s official WhatsApp Cloud API. You create the authentication or utility template in the dashboard (a Template Library gives you examples to start from), send it through POST https://apis.vectalk.com.br/api/messages with Meta’s payload and receive statuses on your webhook, in the format of Meta’s documentation. Billing is prepaid: each delivered message is deducted from your balance, and you do not add a card on Meta.

Vectalk does not send SMS. The SMS fallback stays with the SMS vendor you already use, triggered by your system when the WhatsApp status does not arrive. See the official WhatsApp API guide, the documentation, or create your account.

Frequently asked questions

WhatsApp or SMS: which is cheaper?

It depends on your SMS vendor and message length. On WhatsApp, Meta’s authentication and utility rate for Brazil is BRL 0.0350 per delivered message since October 1, 2026; other countries follow Meta’s rate card. Compare with the price per delivered segment your SMS vendor charges.

Does WhatsApp charge when the number is not on WhatsApp?

No. Meta only charges delivered messages. If the number is not on WhatsApp, the status comes back as failed, with no Meta charge.

Can I send a verification code in a utility template?

No. Verification codes have their own category, authentication, with fixed text set by Meta. Using another category for OTP leads to rejection or recategorization of the template.

How long should I wait before sending the SMS?

There is no official number. Measure the time to delivered for your users and pick a timeout that covers most of them, always offering a “resend by SMS” button.

Does WhatsApp end SMS pumping?

It removes the financial incentive for that fraud, since the message does not generate termination revenue for carriers. But bots can still abuse your form, so keep limits per number and per IP.

Official sources checked on October 29, 2026: authentication templates, Cloud API error codes, Cloud API pricing, Twilio: SMS pumping protection, Vectalk documentation.

Put your business on the official WhatsApp

Create your account, connect your number to the official API (you can keep the app with coexistence) and start serving customers and sending messages.

Create free account

Read the docs

WhatsApp vs. SMS for codes and notifications: delivery, cost and conversion