Authentication is the foundation of system security, yet implementing two-factor authentication (2FA) at scale often becomes a significant cost driver. While global SMS providers offer convenience, their per-message pricing models can become prohibitive for startups or regional applications. Designing an [[[architecture](/blog/building-a-scalable-e-commerce-platform-architecture-decisions-that-actually-matter)](/blog/shipping-a-cloud-product-build-privacy-and-contract-risk-into-the-architecture)](/blog/architecture-patterns-the-six-shapes-a-system-can-take-and-why-they-are-not-a-menu) that balances security requirements with cost-efficiency requires moving away from monolithic global providers toward a regionalized, multi-channel delivery strategy.

The primary objective is to maintain a high-trust verification flow while utilizing lower-cost regional SMS aggregators for primary delivery and leveraging SMTP-based email as a reliable, near-zero-cost recovery mechanism. This approach requires careful handling of rate limiting, token lifecycle management, and delivery failure states.

Regional SMS Routing Logic

Global SMS delivery is plagued by ‘grey route’ issues and variable pricing. To reduce costs, implement a routing layer that maps user country codes to local, low-cost aggregators. By bypassing high-margin international carriers, you can reduce SMS costs by 40-60%. This requires maintaining a lookup table of providers that support specific regions with consistent delivery SLAs.

interface SMSProvider {
  send(phone: string, message: string): Promise<boolean>;
}

class RoutingEngine {
  private providers: Map<string, SMSProvider>;
  
  async routeOTP(phone: string, otp: string) {
    const region = this.getRegion(phone);
    const provider = this.providers.get(region) || this.defaultProvider;
    return await provider.send(phone, `Your verification code is ${otp}`);
  }
}

Token Lifecycle and Security

Storing OTPs in a persistent database is an anti-pattern that creates unnecessary latency and security surface area. Instead, utilize an ephemeral key-value store like Redis with strict Time-To-Live (TTL) settings. Each OTP should be tied to a specific session identifier and a hashed user ID to prevent replay attacks and token brute-forcing.

Always enforce a maximum of three attempts per OTP window. After three failed attempts, the token should be invalidated immediately, and a cool-down period must be enforced at the application layer.

Email Recovery as a Cost-Effective Fallback

When SMS delivery fails—whether due to carrier blocking or local outages—the system must fall back to email. Email delivery is significantly cheaper than SMS, but it carries higher latency and security risks. To mitigate these risks, never send the OTP directly in an unencrypted email body if possible. Instead, send a time-bound, cryptographically signed magic link that redirects the user to an authenticated state.

Handling Delivery Failures

Implement an asynchronous queue for delivery tasks. If the primary SMS provider returns a delivery error, the system should catch the exception, log the failure for observability, and immediately trigger the secondary email flow. Using a message broker like RabbitMQ or SQS allows you to decouple the authentication request from the delivery execution.

Observability and Rate Limiting

Without proper observability, you are effectively flying blind regarding delivery costs. Track ‘Cost Per Successful Authentication’ as a core metric. Monitor the latency of each SMS provider to ensure that the regional routing is actually performing as expected. If an aggregator’s latency spikes, the system should automatically failover to a more reliable, albeit more expensive, provider.

• Use Redis TTL for OTP storage to minimize database load.
• Implement exponential backoff for retries on failed SMS deliveries.
• Use signed JWTs for email recovery links to prevent link tampering.
• Maintain a strict rate-limit per IP and per user account to prevent SMS flooding.

Conclusion

Building a cost-effective 2FA system is an exercise in balancing reliability with infrastructure expenditure. By implementing regional routing logic, leveraging ephemeral storage for tokens, and establishing a robust fallback mechanism using email, you can significantly reduce your operational overhead while maintaining a secure authentication flow. The key is to treat delivery as a pluggable service, allowing your architecture to evolve as your user base and geographical footprint grow.