# Missed Call Verification vs OTP

> Missed call verification vs OTP: how a caller-ID check via webhook confirms mobile ownership, where it is weaker than an OTP, and which to use for sign-ups, logins, payments and field checks.

Source: https://edesy.in/blog/missed-call-verification-vs-otp

**Short answer:** missed call verification asks the user to give a missed call **from the number
they claim to own**. If the caller ID your system receives matches, you treat the number as
verified. It is cheaper and simpler than an SMS OTP and works on any phone, but it relies on
caller ID, so use it for **low-to-medium-risk checks** (lead forms, sign-ups, attendance) and an
**OTP for logins, payments and account changes**.

On Edesy, the caller-ID check works **today** with a missed call number and its real-time
webhook. A packaged verification flow is **available on request**; we set it up for your account
quickly.

[Get a Missed Call Number](https://missedcall.edesy.in/?utm_source=edesy.in&utm_medium=blog&utm_campaign=missed-call)

## How Missed Call Verification Works

1. The user enters their mobile number in your form or app.
2. You show: "To verify, give a missed call to 9XXXXXXXXX from this number within 2 minutes."
3. The user dials. The call is cut with a busy tone and costs them nothing.
4. Edesy sends a signed `call.missed` webhook to your server with `data.from` (the caller's number
   in +91 format), `data.to` and the time.
5. Your server looks for a pending verification for that number inside the time window.
6. If it matches, mark the number verified and update the user's screen.

You can also poll `GET /missed-calls` on the REST API at `https://voice-api.edesy.in/v1` if you
cannot receive webhooks, but the webhook is faster.

### Minimal server logic

```text
on POST /edesy-webhook:
  verify X-Edesy-Signature (HMAC-SHA256 of raw body with your secret)
  event = parse JSON
  if event.event != "call.missed": return 200
  phone = normalise(event.data.from)
  pending = find pending verification where phone = phone and created_at > now - 2 minutes
  if pending and not pending.verified:
      mark verified, store event.data.call_sid
  return 200
```

Retries carry the same `call_sid`, so storing it makes the handler idempotent. The
[webhook signature verifier](https://edesy.in/tools/webhook-signature-verifier) helps you check your HMAC code.

## Missed Call vs SMS OTP vs Voice OTP

| | Missed call (caller ID) | SMS OTP | Voice OTP |
|---|---|---|---|
| What it proves | The phone dialled out from that number | The SIM received a message | The phone answered and heard the code |
| User effort | Dial and hang up | Wait, read, type a code | Answer, listen, type a code |
| Works on basic phones | Yes | Yes | Yes |
| Needs literacy | No | Yes | Partly (must type the code) |
| Cost to user | Nothing | Nothing | Nothing |
| Delivery issues | Few; user initiates the call | SMS delays and filtering | Call must be answered |
| Phishing resistance | Moderate | Weak if user shares code | Weak if user shares code |
| Spoofing risk | Caller ID can be spoofed in some routes | SIM swap | SIM swap |
| Best for | Lead forms, sign-ups, field checks | Logins, transactions | Users who miss SMS or cannot read |

## When Caller ID Is Enough

- **Lead and enquiry forms.** You want to know the number is real and belongs to the person
  before a sales call.
- **Free sign-ups and waitlists.** Stopping fake numbers matters more than stopping a determined
  attacker.
- **Contest and sampling entries.** One verified number per entry.
- **Delivery or appointment confirmation.** The customer confirms from their registered number.
- **Field staff attendance.** The registered mobile calls in; see
  [missed call attendance](https://edesy.in/blog/missed-call-employee-attendance).
- **Users who struggle with codes.** Older or low-literacy users find "just give a missed call"
  far easier.

## When to Use an OTP Instead

- **Logins and password resets.** Account takeover risk justifies a code.
- **Payments, wallet top-ups and withdrawals.**
- **Changing the registered number, email or bank details.**
- **Regulated flows** where an OTP is expected or required.
- **Anything an attacker would profit from.** Caller ID is generally reliable on Indian mobile
  networks but is not a cryptographic proof.

For users who do not receive SMS reliably, a [voice OTP](https://edesy.in/voice-otp) reads the code aloud in a call
and works on any phone.

## Design Tips for Missed Call Verification

- **Short window.** Accept the call only within a few minutes of the request.
- **Exact match.** Normalise both numbers to +91 E.164 before comparing.
- **One number per flow.** Use a dedicated verification number so marketing calls do not mix in.
- **Clear on-screen text.** Show the number large, with "from the number you entered".
- **Fallback.** Offer an OTP if the call does not arrive, for example from a different SIM in a
  dual-SIM phone.
- **Rate-limit.** Cap verification attempts per number and per IP.
- **Do not treat it as login.** Verified means "this person controls this number now", nothing
  more.

## Example Flows

### Lead form on a landing page

A user fills a two-field enquiry form. Instead of sending an SMS code, the thank-you screen says
"Give a missed call from 98XXXXXXXX to confirm". Your page polls your own server every few seconds;
when the webhook arrives and matches, the screen changes to "Confirmed, we will call you shortly"
and the lead is pushed to sales as verified. Unverified leads can still be kept, but sales calls
the verified ones first.

### Delivery or cash-on-delivery confirmation

An order confirmation page asks the buyer to give a missed call from the number on the order to
confirm. A matching call within the window marks the order confirmed; no match after a few hours
sends it to a human or an automated confirmation call. This filters out fake numbers before you
ship.

### Field agent check

A field agent gives a missed call from their registered phone when they reach a customer. It is
the same caller-ID match, used as a lightweight presence record, with the location caveats
described in the attendance guide.

## What Can Go Wrong

| Problem | Cause | Handling |
|---|---|---|
| Call never arrives | User dialled from the other SIM | Show which number to call from; offer OTP fallback |
| Number mismatch | Different formats (0, +91, spaces) | Normalise both sides to +91 E.164 |
| Duplicate events | Webhook retries after a timeout | De-duplicate on `call_sid` |
| Late arrival | Network delay or user waited | Allow a short grace period, then expire |
| Shared family phone | Several users on one number | Treat the number as verified, not the person |

## Cost

Verification volume is usually steady, so pricing is simple:

| Volume per month | Plan | Approx. cost before GST |
|---|---|---|
| 1,000 verifications | Pay as you go | ₹499 + ₹300 = ₹799 |
| 3,000 verifications | Pay as you go | ₹499 + ₹900 = ₹1,399 |
| 10,000 verifications | Unlimited | ₹1,498 |

Add 18% GST. Above about 3,330 events per number a month, Unlimited is cheaper. A one-time setup
fee may apply per number, and KYC is required before a number is issued. See
[missed call service pricing in India](https://edesy.in/blog/missed-call-service-pricing-india).

## Honest Summary

- **Live today:** a missed call number, real-time signed webhook and API. You can build caller-ID
  verification in an afternoon.
- **On request:** a packaged verification flow, which we set up for your account quickly.
- **Not a replacement for OTP** on sensitive actions.

Read more on the [mobile verification use case](https://edesy.in/missed-call-service/use-cases/mobile-verification).

[Get a Missed Call Number](https://missedcall.edesy.in/?utm_source=edesy.in&utm_medium=blog&utm_campaign=missed-call)

## Related Reading

- [What is a missed call service?](https://edesy.in/blog/what-is-missed-call-service)
- [Mobile verification with missed calls](https://edesy.in/missed-call-service/use-cases/mobile-verification)
- [Voice OTP](https://edesy.in/voice-otp)
- [Missed call docs](https://edesy.in/docs/missed-call)

## Frequently Asked Questions

### What is missed call verification?

The user is asked to give a missed call from the mobile number they entered. Your system receives the caller's number and checks that it matches. If it does, the number is treated as verified, with no SMS or code to type.

### Is missed call verification as secure as an OTP?

Not for high-risk actions. It relies on network caller ID, which is generally reliable for Indian mobile calls but not cryptographic. Use it for low-to-medium-risk checks such as lead forms and sign-ups, and an OTP for logins, payments and account changes.

### Does Edesy have a missed call verification product?

Not as a packaged product. You can build the check today with a missed call number and its real-time webhook. A packaged verification flow is available on request; we set it up for your account quickly.

### Does the user pay for the verification call?

No. The call is rejected before it is answered, so the user is not charged.

### When should I use a voice OTP instead?

When the user may not receive SMS reliably, cannot read the code, or the action is sensitive. A voice OTP reads the code aloud in a phone call and works on any phone.