2FA Cost 2026: SMS vs. WhatsApp, Worked Examples for the US, UK and Germany

SendSeven Team, Editorial Team

If you think SMS is always the cheapest way to send a verification code, Meta's latest WhatsApp rate card says otherwise. A full cost comparison for the US, UK and Germany, including platform fees, SMB worked examples from 1,000 OTPs a month, and when SMS still makes sense.

Say two-factor authentication and most people still picture a verification code arriving by text. For years that was the safe default: cheap, universal, no app to install. On Meta's rate card effective 1 October 2026, the numbers look different. Meta charges WhatsApp Authentication messages far below its Marketing rate, and in the US, the UK and Germany a one-time password over WhatsApp now costs less than the same code by SMS. In the US, the gap is wide.

This analysis works out the real, all-in cost for 2026, including your messaging platform's own fee, using SendSeven's published pricing as the reference: no per-seat licence, one monthly base fee with messages included. SendSeven charges a fixed price per message, not a percentage on Meta's price list, and the same price on SMS and WhatsApp. On top come the network costs: Meta's own per-message fees for WhatsApp, and the per-country SMS rates paid from your prepaid SMS credit.

What does a 2FA message cost in 2026?

Three components make up the final price of a 2FA message, whichever channel you send it on:

1. Network cost: the per-country SMS rate for SMS, or Meta's own per-message fee for the Authentication template category for WhatsApp.
2. Your messaging platform's fee: at SendSeven, a monthly base fee that includes a set number of messages, then a fixed price per message. It is identical on SMS and WhatsApp.
3. Local sales tax: every price in this article is net. Add VAT or sales tax depending on where your business is registered.

Per 100 OTPs to US numbers beyond your plan's included messages, that works out to €0.78 net over WhatsApp against €3.50 net over SMS (API Only plan, platform fee included). Within the 1,000 messages a month that the API Only channel fee already covers, only the network cost remains: €0.28 against €3.00. At 3,000 US OTPs a month, the difference comes to close to €1,000 a year.

The short answer for a busy founder

If you are building a new authentication flow in 2026, start with Authentication templates over the WhatsApp Business API as your primary channel and keep SMS as a fallback for numbers without a WhatsApp account. If you already run 2FA over SMS, the saving reaches four figures a year from roughly 2,600 OTPs a month in the UK and roughly 3,000 in the US or Germany. Below that, the switch still pays, just in smaller amounts. The worked numbers are further down this article.

SMS OTP: how the price is built

SMS has been the default channel for verification codes for decades. The price per message depends on the recipient's country, because delivery runs over that person's mobile network.

1. Network cost per SMS

SendSeven passes SMS network costs through from your prepaid SMS credit, at a fixed rate per destination country. For the three markets in this comparison (net, as of 6 May 2026, listed on our pricing page):

Other providers build their SMS prices differently, so compare their all-in rate for your own destination countries rather than a single headline number.

2. Platform fee per message

On top of the network cost, your messaging platform charges for routing, delivery receipts and API access. At SendSeven, every plan includes a number of messages each month; only messages beyond that are charged:

API Only is the cheapest route for pure authentication workflows: every channel, SMS included, runs on the same 0.5-cent message price beyond the 1,000 messages included per channel, without the unified inbox, Flows or the campaign builder. For developer teams sending OTPs straight from their own backend, that is all they need. Sending codes needs no automation or AI, so on the Full Suite the Basic plan covers it; Professional adds the Flow Builder and AI features.

3. Total cost per SMS (network + SendSeven)

Add both components and you get these net prices per SMS beyond your plan's included messages:

This table is the benchmark WhatsApp Authentication has to beat. A 3.5-cent SMS to a US number is still a reasonable price; WhatsApp has simply become cheaper.

WhatsApp OTP: how the price is built

A WhatsApp OTP is sent as an Authentication template, one of Meta's three template categories next to Marketing and Utility, reserved for one-time passcodes. Meta fixes the wording: the message reads “[code] is your verification code.”, optionally followed by “For your security, do not share this code.” and an expiry line of 1 to 90 minutes. Instead of a link, the template carries a button: copy code, or one-tap or zero-tap autofill on Android. Promotional content has no place in it.

1. Meta's Authentication rate (October 2026)

Meta prices messages by the recipient's country, not your business location. The Authentication rates on Meta's rate card effective 1 October 2026 are:

The standout number: an Authentication message to a US number costs less than three-tenths of a euro cent, about a sixteenth of the German rate. This is Meta's own regional pricing, not a SendSeven discount. Meta charges Authentication at the same rate as Utility, and in the US, the UK and Germany that rate did not change on 1 October 2026. Since 1 October 2026, Meta has also billed service messages at the Utility and Authentication rate in all 47 markets; only the first 1,000 per business phone number and month stay free.

2. Platform fee per WhatsApp message

SendSeven charges exactly what it charges for SMS: the included messages and the per-message rate in the plan table above apply to every WhatsApp message, whether Marketing, Utility, Authentication or Service, with Meta's own per-message fees on top. The fee covers API access, webhook routing, template management and delivery receipts. On API Only, that is half a cent per WhatsApp message beyond the 1,000 included, with no shared inbox, campaign builder or automation attached.

3. Total cost per WhatsApp Authentication message (Meta + SendSeven)

Net prices per message beyond your plan's included messages:

In the best case, API Only with US recipients, a verification code over WhatsApp costs 0.78 of one euro cent. Within the included messages it is just Meta's 0.28 cents.

Direct cost comparison: US, UK, Germany

Here is the number this article exists to answer: what does a 2FA message cost in 2026, channel against channel, platform fee included?

Basic / Professional (Full Suite)

API Only (for developers)

Three things worth noting before the worked examples:

• WhatsApp beats SMS in every market and on every plan. Even in Germany, the most expensive of the three markets for WhatsApp, the saving is around 31% on Basic.
• The saving per message is the same on every plan. SendSeven charges the same fee on both channels, so the difference is always the network cost: 0.0272 € (US), 0.0318 € (UK) or 0.0294 € (Germany). The plan only changes the base you compare against, which is why the percentage is higher on API Only.
• The United States sees the biggest gap. Meta's North America Authentication rate is a fraction of a cent, so a WhatsApp code to a US number costs roughly a fifth of the SMS on API Only.

Worked examples: 1,000, 3,000 and 15,000 OTPs a month

Theory is fine; real monthly bills are better. Three volumes that map to how small and mid-sized businesses actually send 2FA, with the base fee and the included messages counted in:

Scenario A: US SaaS startup, 1,000 logins a month (US recipients)

API Only, one active channel: €9 a month, and all 1,000 OTPs fit inside the 1,000 included messages.

The switch pays off even at low volume. 1,000 OTPs a month is roughly 100 active accounts that each receive ten codes a month. If you keep SMS as a fallback, that is a second active channel at another €9 a month, plus the SMS you actually send.

Scenario B: International SMB, 3,000 OTPs a month (mix UK 50% / US 35% / Germany 15%)

Basic plan, assuming OTPs are the only traffic: €49 base fee with 2,500 messages included, plus 500 × 0.02 € = €59.00 a month to SendSeven, on either channel.

If your customer-service messages already use up the 2,500 included, every OTP is charged at 0.02 € on both channels and the saving stays exactly the same: €1,073.88 a year. The US leg has the largest percentage saving; even blended with pricier UK and German traffic, the yearly saving lands just over €1,000.

Scenario C: UK bank or insurer, 15,000 OTPs a month (UK only)

A backend that only sends codes fits API Only: €9 for one channel, 1,000 messages included, 14,000 × 0.005 € = €70 beyond that, so €79.00 a month to SendSeven.

If the same bank also runs its customer service on the Enterprise plan (€499 a month, 40,000 messages included), the OTPs fit inside the bundle: €1,249 a month by SMS against €772 by WhatsApp. The saving is the same €5,724 a year, 38.2% of the total. The higher the volume, the larger the absolute saving, because it grows by 0.0318 € with every UK OTP you move from SMS to WhatsApp.

When SMS is still the right choice

As clear as the cost case is, SMS keeps its place. Plan it as your primary channel, or at least a fallback, in these situations:

• Recipients without a WhatsApp account. WhatsApp is widely used in the UK and Germany. In the US, its reach is lower and iMessage and SMS dominate everyday messaging. Without an SMS fallback, you do not reach everyone.
• Internal policies that name the channel. Banks, insurers and other regulated businesses often have security policies that specify which channels may carry login codes. Check with your compliance team before switching.
• Public-sector and government applications. If your 2FA send is part of a government service, review your data protection impact assessment. WhatsApp is a cloud service run by Meta, with processing partly outside the recipient's country; SMS stays within carrier networks. For many public-sector buyers, that rules WhatsApp out.
• Recipients without a smartphone. SMS works on any mobile phone that takes a SIM card. WhatsApp needs a smartphone on a current OS. For audiences with many older handsets, SMS stays essential.
• Emergency and critical-infrastructure workflows. A 2FA flow that has to keep working in a cyber incident should not depend on a single cloud platform. An SMS backup path is standard practice here.

Which is why the sensible default is almost always a hybrid strategy: send the WhatsApp Authentication message first, and send an SMS if no delivered status arrives within 30 to 60 seconds. The fallback logic lives in your own backend. SendSeven reports sent, delivered, read and failed events by webhook, and your code decides when to switch; more on that in the migration section below.

Security: SIM swapping vs. end-to-end encryption

Cost is one side of this comparison; security is the other. WhatsApp Authentication is less exposed to the best-known weakness of SMS-based 2FA, SIM swapping, and its fixed format makes fake codes easier to spot.

SIM swapping targets SMS

SIM swapping (also called SIM jacking) is a well-documented attack on SMS-based 2FA. An attacker convinces the victim's carrier, through social engineering, forged ID or a bribed insider, to move the victim's number onto a new SIM. From then on, every 2FA text goes straight to the attacker; the victim often only notices once an account has been drained. The FBI's Internet Crime Complaint Center (IC3) received 1,611 SIM-swapping complaints with adjusted losses of more than $68 million in 2021 alone, against 320 complaints and approximately $12 million in losses from January 2018 to December 2020.

WhatsApp: a swapped SIM alone does not get the code

WhatsApp messages are end-to-end encrypted with the Signal protocol, and an Authentication message is delivered only to the user's primary WhatsApp device. A SIM swap alone therefore does not redirect the code: the attacker would first have to register the victim's WhatsApp account on a new phone. If the user has set a two-step verification PIN, that step fails without it, and a new registration logs the original phone out, which alerts the user. WhatsApp is not immune, but the bar is higher than for SMS, where the code goes to whoever holds the SIM.

Authentication templates: a fixed format

Meta fixes the wording of Authentication templates, so a code from your business always looks the same: the code, the optional security and expiry lines, and a copy-code or autofill button. You cannot add your own text or promotions. A consistent format makes an odd-looking “verification” message easier to spot. SMS has no such format: a phishing text reading “tap here to verify your bank app” looks just like a genuine one.

NIST: SMS still “restricted” as a 2FA factor

The US National Institute of Standards and Technology (NIST) classes SMS and voice codes as a restricted authenticator: still permitted, but flagged as weaker, with extra obligations for organisations that use it. The current revision of its Digital Identity Guidelines, SP 800-63-4 (August 2025), keeps that classification. It also counts out-of-band codes as not phishing-resistant, so WhatsApp Authentication does not reach that category either. The case for WhatsApp is SIM-swap resistance, not a higher NIST rating.

Migration: moving from SMS OTP to WhatsApp OTP

Moving an existing 2FA workflow works best in four steps:

1. Submit an Authentication template. Create a template in the Authentication category through the WhatsApp Cloud API. Meta fixes the text; you choose whether to add the security note and an expiry time, and which button to use (copy code, or one-tap or zero-tap autofill on Android). Approval usually takes minutes (automated), up to 24 hours when Meta reviews it manually; see our template setup guide.
2. Document consent. Every user who will receive Authentication messages needs documented opt-in. For existing accounts, a one-time prompt at the next regular login (“We can now also send your login code over WhatsApp. Turn it on?”) with an active tap typically works. Record the timestamp.
3. Build the fallback. In your backend, send the WhatsApp OTP, wait 30 to 60 seconds, and send an SMS if no delivered event has arrived. SendSeven delivers the sent, delivered, read and failed events by webhook; your code makes the decision.
4. Roll out in stages. Start with 10 percent of your user base, ideally a region or cohort where WhatsApp is widely used. Track delivery rate, average code-entry time and support tickets for two weeks. If it holds up, scale to 50 percent, then 100.

The implementation itself is small: one template and a few lines of REST API code for the fallback. Plan for one to two days of an experienced developer's time, plus the staged rollout. Our webhook setup guide covers the delivery events.

GDPR, UK GDPR and the TCPA for 2FA messaging

Any 2FA workflow processes a personal phone number and a verification code. Both are personal data under GDPR and UK GDPR, and sending over WhatsApp adds Meta to the parties involved. This is not legal advice; check the specifics against the rules that apply where your customers are.

Legal basis

Processing the phone number for 2FA generally relies on Article 6(1)(b) GDPR / UK GDPR (performance of a contract), where 2FA is a contractually or legally required security measure. Many businesses also ask for consent (Article 6(1)(a)) before switching a user to WhatsApp, because the number is then also processed by Meta. Document whichever basis you choose.

Data processing agreements

You need a data processing agreement (under Article 28 GDPR, or the UK equivalent) with your messaging platform. At SendSeven, the DPA is part of the Terms of Service and available on request. When you connect WhatsApp, you also accept Meta's own WhatsApp Business terms; SMS is delivered through a gateway provider based in Germany.

Data residency

SendSeven stores and processes data primarily in the EU, on Google Cloud in Frankfurt (region europe-west3), with AI features opt-in and off by default. Meta processes WhatsApp messages as a cloud service and relies on the EU-US Data Privacy Framework for transfers to the US. For UK-only workflows, check your setup against UK GDPR and PECR specifically, since they are not identical to the EU regime post-Brexit. In the US, a transactional message such as a login code is generally treated differently from marketing texts under the TCPA, but documented consent and a clear opt-out remain good practice regardless.

Choosing a provider: what to check in an OTP platform

If you are evaluating 2FA delivery for the first time, or replacing an existing provider, this checklist covers what actually matters:

• Both channels from one provider. A platform that only does SMS or only does WhatsApp forces you into two integrations, two DPAs and two invoices. One platform for both, plus an email fallback, cuts that admin in half.
• A fixed fee, not a percentage. Ask how the platform charges on top of Meta's rates. At SendSeven it is a fixed price per message, not a percentage on Meta's price list, with Meta's own per-message fees on top, not included in the plan price.
• A low entry price with messages included. A 1,000-OTP-a-month startup should not pay for capacity it does not use. SendSeven starts at €9 per channel a month with 1,000 messages included (API Only), or €49 a month with 2,500 included (Full Suite, Basic plan).
• EU hosting plus a proper DPA. Look for a named data centre location (for example “Frankfurt, GCP europe-west3”), not a vague “EU hosting” claim.
• Webhooks for delivery proof. Your backend needs real-time sent, delivered, read and failed events. A platform without webhook push forces you into polling loops, which do not scale.
• No per-seat pricing. 2FA is a technical workflow; your developers and operations team need access. A per-seat licence adds cost with no real benefit here.

SendSeven covers each of these. To model your own numbers, our pricing page lists the SMS rate for every destination country, and Meta's rates by market are in our WhatsApp Business API cost guide.

Frequently asked questions

Is WhatsApp Authentication really cheaper than SMS in 2026?

Yes, in the US, UK and Germany, on every SendSeven plan. Per message beyond your plan's included messages, the gap runs from about 31% in Germany (Basic plan) to nearly 78% in the US (API Only plan). The driver is Meta's low Authentication rate, especially for North America at 0.0028 € per message. SendSeven charges the same fee on both channels, so it does not reduce the saving.

What does a WhatsApp Authentication message cost in the US?

Meta's rate is 0.0028 € net per Authentication message. For messages beyond your plan's included ones, SendSeven's fee brings it to 0.0228 € on Basic or 0.0078 € on API Only. The same code by SMS to a US number costs 0.035 € (API Only) to 0.050 € (Basic). Within the included messages, only Meta's 0.0028 € remains, against 0.03 € for the SMS.

Why is the United States so much cheaper than Germany for WhatsApp Authentication?

Meta prices Authentication messages by the recipient's country, and its North America rate (0.0028 €) is about a sixteenth of the German rate (0.0456 €). SMS to the US is cheaper too (0.03 € against 0.075 €), but the WhatsApp rate falls much further, so the percentage saving is largest in the US.

Do I need an Authentication template for WhatsApp OTPs?

Yes. Verification and login codes sent over the WhatsApp Business API must use a template in the Authentication category. Meta fixes the wording: the code, an optional security note and expiry time, and a copy-code or autofill button. Approval usually takes minutes (automated), up to 24 hours with manual review. Promotional content is not allowed.

What happens if a recipient doesn't use WhatsApp?

Then you reach them by SMS. Common practice: send the WhatsApp OTP first and send an SMS if no delivered status arrives within 30 to 60 seconds. On SendSeven both channels run through the same API; your backend decides when to switch, based on the delivery events SendSeven sends by webhook.

Is WhatsApp Authentication GDPR compliant?

It can be, when implemented correctly. You need a legal basis and documented opt-in for the WhatsApp channel, a data processing agreement with your platform provider, and a data protection impact assessment for high-risk workflows. At SendSeven the DPA is part of the Terms of Service and available on request, and data is stored and processed primarily in the EU (Frankfurt). This is not legal advice.

How secure is SMS 2FA, really?

SMS 2FA is far stronger than a password alone, but it is the weakest of the common 2FA factors. The main attack is SIM swapping, where an attacker moves the victim's number onto a new SIM. NIST classes SMS as a restricted authenticator in SP 800-63-4: still allowed, but with extra conditions. WhatsApp resists SIM swapping better, because a swapped SIM alone does not move the WhatsApp account.

How fast is migrating from SMS OTP to WhatsApp OTP?

The implementation itself typically takes an experienced developer one to two days of REST API work. Meta usually approves an Authentication template within minutes (automated), up to 24 hours with manual review. Add time for opt-in messaging to existing users and a staged rollout, for example 10, 50, then 100 percent of users over a few weeks.

Can I send both channels from one platform?

Yes. On SendSeven, WhatsApp and SMS, along with email, Telegram, Messenger, Instagram, live chat and browser push, are reachable through the same REST API. One authentication routine in your backend picks the channel per user and handles the fallback. On API Only, each active channel costs €9 a month with 1,000 messages included.

Conclusion: WhatsApp is the new default channel for 2FA in 2026

The core finding of this comparison: the old rule of thumb that “SMS is always cheapest” no longer holds in 2026. If you are building a 2FA workflow today, WhatsApp Authentication as the primary channel is meaningfully cheaper in the US, UK and Germany alike, and dramatically so in the US. Meta's low Authentication rate, resistance to SIM swapping and a fixed, recognisable format from a named business sender instead of an anonymous short code make WhatsApp Authentication the sensible default.

SMS keeps its place as a fallback and for recipients without WhatsApp. A hybrid setup across both channels, ideally from one platform, is the most resilient. SendSeven offers both, with a DPA on request, data stored and processed primarily in the EU, and a base fee from €49/month (Full Suite) or €9/channel/month (API Only). For a typical SMB sending 3,000 OTPs a month to mixed UK/US/German numbers, the annual saving against SMS lands around €1,074; at 15,000 UK OTPs a month, it is €5,724.

Related reading and sources

Sources: WhatsApp Business Platform pricing, Meta's official rate card (effective 1 October 2026); Meta, Authentication templates; NIST Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (August 2025); FBI IC3, SIM swapping public service announcement (8 February 2022).