iRealtee OS Glossary

One-time Password

A one-time password serves as a second layer of verification beyond traditional username-password combinations. The system generates a unique numeric or alphanu...

One-time Password

One-time Password (OTP) is an automatically generated authentication code valid for only one login session or transaction, protecting user accounts from unauthorized access even when primary credentials are compromised.

A one-time password serves as a second layer of verification beyond traditional username-password combinations. The system generates a unique numeric or alphanumeric code that expires after a brief validity period, typically five minutes. You cannot reuse an OTP once entered or after expiration.

Key Components

  • Random code generator: Cryptographic algorithm producing unpredictable sequences
  • Delivery channel: SMS, email, or authenticator app transmission
  • Time-bound validity: Codes expire within a defined window (usually 60-300 seconds)
  • Single-use enforcement: System invalidates code after first successful verification
  • Server-side validation: Backend verifies code matches generated value

How it Works

  1. User initiates a login attempt or sensitive action
  2. System authenticates primary credentials (username/password)
  3. Server generates a cryptographically random code
  4. OTP transmits to registered mobile number via SMS
  5. User enters the received code within the validity window
  6. System validates the code against the generated value
  7. Access grants upon successful verification

Philippine mobile carriers—Globe, Smart, and DITO—deliver SMS-based OTPs across the archipelago. The National Privacy Commission recommends OTP as part of secure authentication mechanisms under NPC Circular No. 2023-06.

Pros & Cons

Advantages:

  • Blocks access even when passwords are stolen through phishing or data breaches
  • Meets Data Privacy Act compliance requirements for sensitive data protection
  • Invalidates credential sharing among unauthorized users
  • Creates an auditable trail of authentication events

Disadvantages:

  • Requires reliable mobile network connectivity for SMS delivery
  • Adds a step to the login process
  • Users without registered mobile numbers cannot authenticate
  • SMS delivery delays may frustrate users during peak network congestion

Real-World Application

In iRealtee, OTP verification secures sensitive profile changes that affect agent finances and account integrity. When you update your bank account details for commission withdrawal, the system sends an OTP to your registered mobile number before processing the change. This prevents unauthorized parties from redirecting commission payments to fraudulent accounts.

Email modification requests also trigger OTP verification. Since email addresses serve as account recovery mechanisms, changing this information without verification could lock legitimate users out of their accounts. The OTP requirement ensures only the registered account holder can approve such changes.

Philippine real estate brokers managing client data benefit from OTP protection during bulk data exports. Under the Data Privacy Act of 2012, organizations must implement technical safeguards when processing personal information. OTP verification satisfies the "reasonable and appropriate" security measure standard required by law.

iRealtee triggers OTP verification at these security checkpoints:

The audit trail logs all OTP verification attempts with timestamps, device fingerprints, and outcome status. This record supports compliance documentation for NPC audits and helps identify unusual access patterns indicating compromised credentials.

References

Looking for another term? Browse the full glossary.

Back to Glossary