On this page
OTP lead verification asks the person enquiring to enter a one-time code sent to the mobile number they gave. It does reduce fake enquiries from bots, typing errors and made-up numbers, because those cannot complete the step. It does not stop real people who have no plan to buy, and it costs you some genuine leads too.
This guide covers OTP alone. For the full set of defences, from bot checks to click credits, see 5 ways property agents can protect themselves from spam leads.
What is OTP lead verification?
It is a step on an enquiry form that checks the phone number works and is in the hands of the person filling in the form. The lead is marked verified only after the code sent to that number is typed back in.
A short code, often six digits, that can be used once and only for a short time. On lead forms it is sent by SMS or WhatsApp to the number the person entered. Google's lead form codes typically expire after 15 minutes.2 NIST's US government guidelines treat a code as invalid after 10 minutes and accept it only once.9
On a typical form, it works in four steps:
- The buyer fills in the form, including a mobile number.
- The form sends a code to that number by SMS or WhatsApp.
- The buyer types the code into the form before it expires.
- The lead arrives marked verified. Google adds a "Phone number verified" field to your lead data, and Meta a "phone_number_verified" column showing TRUE or FALSE.23
What happens to people who do not finish depends on where the form lives. On Google's and Meta's own lead forms, they cannot submit at all. "If a user doesn't successfully verify their phone number, the system won't submit the lead," says Google.2 On your own landing page, you can choose to accept the enquiry anyway and mark it unverified, so a buyer who missed the code still reaches you.
Does OTP verification reduce fake property enquiries?
Yes, for fakes that depend on a bad number. No, for real people who are not buyers. Google describes the step like this:
"This adds a one-time password (OTP) step to your form, filtering out invalid numbers, automated spam, and bots." (Google Ads Help)1
That matters because, as Google notes, "sometimes real users submit fake contact details or other invalid information".4 A code they cannot receive stops them. But what OTP proves is narrow: someone could receive a message on that number at that moment. It says nothing about budget, timing or intent.
| Type of bad enquiry | Does OTP stop it? | Why |
|---|---|---|
| Bots and scripted form fills | Mostly | They cannot read a code sent to a real phone,1 but they can still make your form send codes (see costs below)14 |
| Typing errors and wrong numbers | Yes | The code goes to the wrong phone, so the form is never completed |
| Made-up numbers | Yes | No working phone receives the code1 |
| Landline numbers | Yes, on Meta forms | Meta says a landline cannot verify, so the person is not counted as a lead3 |
| Someone else's real number | Usually | The code reaches the number's owner, not the person typing |
| Curious visitors and price checkers | No | They verify their own number like any buyer |
| Other agents looking for buyers | No | Same; screen them separately |
| A number after a SIM change or transfer | Not reliably | NIST lists SIM change and number porting as risk signs for SMS codes9 |
Neither Google nor Meta publishes how many fake leads verification removes for property campaigns. Judge it on your own numbers: how many verified leads you reach, and how many become appointments.
What does OTP verification cost you?
Some genuine leads, a fee for each code, and one more thing to protect from abuse. Weigh all three before you switch it on.
- Fewer leads. Google says "your total number of leads and cost per lead (CPL) may be affected", and Meta says much the same.23 Some buyers will not wait for a code or will mistype it, and on Google's and Meta's forms they are not submitted at all.23 Meta may switch the setting on by default for eligible advertisers, so check your forms.3
- Messaging fees. Google's and Meta's forms send the code for you. On your own page, you pay your messaging provider for each code. On WhatsApp, Meta charges per delivered message, at rates set by message category and the recipient's country calling code.11
- Sender ID registration. If your codes go out under a Sender ID, such as a brand name, it must be registered with the SMS Sender ID Registry, which needs a UEN. SGNIC charges S$545.00 once per organisation and S$218.00 a year per Sender ID, including GST.5
- SMS abuse. A form that sends texts on request can be abused. Google Cloud describes SMS abuse as a malicious actor causing "a service to send SMS through a carrier that they have a revenue sharing agreement with", which "can lead to higher costs".13 It names phone verification as "a potential target" and says SMS checks themselves do not protect against it.14
To limit abuse, check each request before a code is sent, and allow codes only to the countries you sell to. Google recommends a region policy "that limits traffic to your specific operating regions".1314 The trade-off: a Singapore-only rule means an overseas buyer cannot verify with a foreign number, so decide project by project.
Should you send the code by SMS or WhatsApp?
Both work in Singapore, and you may not get to choose. Google's lead forms use SMS only, while Meta picks the channel itself.23 Meta lists Singapore among the markets where codes for Facebook lead ads usually go by WhatsApp first, and says the list may change. Instagram codes generally go by SMS, and a person can ask for an SMS code at any time.3
| SMS code | WhatsApp code | |
|---|---|---|
| Who can receive it | Any mobile number that takes SMS | Only numbers on WhatsApp, which confirms each number with a code at sign-up12 |
| How the sender shows | A Sender ID; unregistered ones are marked "Likely-SCAM"56 | Your WhatsApp Business account |
| Message text | You write it | Fixed wording: the code, then "is your verification code.", with an optional "For your security, do not share this code."10 |
| Cost | Your SMS provider's rate, plus SSIR fees for a Sender ID5 | Meta's per-message rate for authentication messages to that country11 |
| Where it is the default | Google lead forms and Instagram lead ads23 | Facebook lead ads in Singapore, with SMS as the fallback3 |
Whichever channel you use, remember what buyers are told. The Singapore Police Force advises the public: "Do not disclose your personal information, bank/card details and One-Time Passwords (OTPs) to anyone."15 So the code belongs in your form only. Never ask a lead to read out their code on a call or send it to you on WhatsApp. To a careful buyer, that is what a scam looks like.
What should your form and code message say under the PDPA?
Tell people what you will do with their number before they submit, keep the code message to the code, and ask for marketing consent separately. A verified number is not consent.
- Notify and get consent. You must tell people the purpose "on or before" you collect their data, and have their consent for it.8 Google's lead forms also require a link to your privacy policy.1 Our new launch landing page checklist covers what the rest of the page must show.
- Keep the code message clean. Under the Do Not Call rules, a message is a "specified message" if one of its purposes is to advertise or promote goods, services or land.7 A plain code is not one. Add a launch teaser or a link and it may become one: PDPC says a message sent for another purpose "must not" also be used for marketing.7
- Replying to the enquiry. A message sent "for the sole purpose of responding to a request from an individual for information about a good or service" is not a specified message.7 Where the request reaches you through a third party, PDPC advises due diligence to confirm the person really made it.7 PDPC does not mention OTP. A verified number is one piece of evidence; how much weight it carries is for you and your agency to judge.
- Marketing beyond the enquiry. For other launches or later promotions by call, SMS or WhatsApp, check the DNC Registry within 21 days, or hold "clear and unambiguous consent in evidential form from the user or subscriber of the number".7 The DNC rules cover WhatsApp as well as SMS.7 Because that consent must come from the person who holds the number, verifying the number first helps show the right person ticked the box.
Example wording, built on PDPC's examples (adapt it with your agency):
- Above the phone field: "We'll text a one-time code to this number to confirm it's yours. We use your name, number and email to reply to your enquiry about [project]."
- Above the Submit button: "I'd also like to hear about other new launches from [your name] by:", followed by a separate, unticked box for each of phone call, SMS and WhatsApp. PDPC treats a near-identical checkbox clause as clear and unambiguous consent, and says a vague line such as "you consent to the use of your personal data for marketing purposes" is not specific enough.7
- The code message: "[code] is your verification code for your enquiry with [your name]. Do not share this code."
This summarises PDPC, IMDA, SGNIC, Google and Meta guidance as of 12 Nov 2026. It is general information, not legal advice. Check the current documents and your agency's own rules before you change your forms.
What are the alternatives to OTP verification?
Use OTP as one layer, not the only one. These options sit beside it, or replace it where losing genuine leads hurts more than the fakes do.
- Bot checks on your own form. Google recommends reCAPTCHA and server-side validation on lead forms, plus a double opt-in email where you collect email addresses.4 These stop scripts but not a person typing a fake number. Our spam leads guide covers how to set them up.
- Google lead forms with qualifying questions. Alongside phone verification on Search campaigns, a multiple-choice "qualifying question" tags matching answers as qualified leads.1
- Meta instant forms with verification. Meta's OTP works with any form type, including higher intent, but ads with it turned on run only on Facebook and Instagram placements on mobile devices.3 A number verified once is not asked again for 180 days.3
- Click-to-WhatsApp. A buyer who messages you does so from their own WhatsApp account, and WhatsApp activates an account only after the number is confirmed with a code.12 You get a working number without an extra step, but no form fields, and the DNC rules still apply to any marketing you send later.7
- Screening after the lead arrives. Call verified leads first, check names for other agents, and keep a note of fakes so you recognise them. Then follow up quickly on the leads that pass: see why timely follow-ups convert property enquiries.
On Property Ecosystem, leads that complete SMS OTP verification arrive tagged as OTP-verified. Leads that do not still reach you, marked not verified, so you can decide whether to call. FraudDetect™ checks each enquiry for property agents and spam, and leads are cross-checked with the CEA registry, showing names and agencies for co-broking. In the ProjectSG Suite app you can filter your list to OTP-verified numbers only.
Frequently asked questions
Does OTP verification stop other agents from enquiring?
No. An agent can verify their own number like any buyer. Screening for agents is a separate step, such as a cross-check against the CEA registry before you call.
Why did my lead numbers drop after I turned on OTP?
Is an SMS code secure enough for lead verification?
For this job, usually. NIST's US government guidelines class SMS as a "restricted" way to authenticate logins and advise watching for SIM changes and number porting.9 Lead verification asks a smaller question than a bank login: can this person receive messages on this number? An SMS code answers that, but it is not proof of identity.
Can I ask a lead to tell me their OTP over the phone?
No. Singapore police advise the public never to disclose OTPs to anyone,15 so the request would look like a scam. Codes belong in the form. If a buyer could not verify, call the number they gave and confirm the enquiry in conversation.
Does a verified number mean I can send marketing messages?
No. Verification confirms the number; it is not consent. Before marketing calls, SMS or WhatsApp messages, check the DNC Registry within 21 days, or hold clear and unambiguous consent in evidential form from the person who holds the number.7
Sources
- Google Ads Help, Create lead form assets, accessed 12 Nov 2026.
- Google Ads Help, About phone number verification, accessed 12 Nov 2026.
- Meta Business Help Centre, How to enable phone verification to improve lead quality, accessed 12 Nov 2026.
- Google Ads Help, About invalid traffic, accessed 12 Nov 2026.
- SGNIC (a subsidiary of IMDA), Overview of SMS Sender ID Registry, accessed 12 Nov 2026.
- IMDA, Annex B: IMDA and Telcos' Anti-Scam Measures, Jan 2024, accessed 12 Nov 2026.
- Personal Data Protection Commission, Advisory Guidelines on the Do Not Call Provisions, revised 1 Feb 2021, accessed 12 Nov 2026.
- Personal Data Protection Commission, Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, accessed 12 Nov 2026.
- NIST, SP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator Management, Jul 2025, accessed 12 Nov 2026.
- Meta for Developers, Authentication templates (WhatsApp Business Platform), updated 5 Oct 2026, accessed 12 Nov 2026.
- Meta for Developers, Pricing on the WhatsApp Business Platform, updated 30 Sep 2026, accessed 12 Nov 2026.
- WhatsApp Help Center, About registration, accessed 12 Nov 2026.
- Google Cloud, Use SMS regions to protect your app from SMS abuse, last updated 10 Nov 2026, accessed 12 Nov 2026.
- Google Cloud, Detect and prevent SMS fraud, last updated 10 Nov 2026, accessed 12 Nov 2026.
- Singapore Police Force, Police advisory on phishing scams involving fraudulent social media advertisements, 2 Oct 2026, accessed 12 Nov 2026.
The ProjectSG team writes about Google Ads, lead generation and new launch marketing for Singapore property agents, drawing on campaigns we run every day.
Researched and drafted with AI assistance, then fact-checked and approved by a named ProjectSG reviewer before publishing. Last updated 12 Nov 2026. Read our editorial policy. Spotted an error? Email info@project.sg.
