Verify a Phone With a Reply-1 SMS Double Opt-In
A phone number is a wonderful payment alias — everyone has one, it is easy to share, and it maps naturally to mobile money. But a number you have not proven is a liability. Anyone can type a stranger's digits into a form. Before a number becomes payable, KibiPay makes the owner prove control with a reply-1 SMS double opt-in.
What double opt-in means here
Double opt-in is a two-step consent handshake. Step one: the user enters their number and asks to add it. Step two: they receive an SMS and must actively reply, typically with the digit 1, to confirm. Nothing is verified until that reply lands. The point is that consent is affirmative and traceable, not assumed from a checkbox.
Why reply-1 rather than a code
Both one-time codes and reply-1 confirmations prove possession of the handset. Reply-1 has one advantage for payments onboarding: it establishes a two-way messaging relationship. The user has now texted your long code or short code, which is exactly the consent record that A2P 10DLC programs expect to see.
- The inbound reply is logged with a timestamp — a durable consent artifact.
- It confirms the number can both receive and send, ruling out many spoofed entries.
- It sets up the channel for later transactional messages like receipts.
Staying compliant with A2P 10DLC
In the US, application-to-person messaging over standard 10-digit long codes is governed by 10DLC rules. Carriers want registered campaigns, clear opt-in language, and evidence of consent. A reply-1 flow produces that evidence naturally: the user was told what they were signing up for, and they replied to confirm.
| Requirement | How reply-1 satisfies it |
|---|---|
| Explicit consent | User replies 1 to an opt-in message |
| Consent record | Inbound message stored with timestamp |
| Opt-out path | STOP handling honored on the same channel |
What happens after confirmation
Once the reply lands, KibiPay marks the phone alias as verified in the directory. Verification status is not cosmetic — it is a gate. An unverified number can exist as a draft, but the routing engine will not select a mobile-money destination for it until proof of ownership exists. That keeps payments from flowing to numbers nobody has claimed.
Edge cases worth handling
Real phone verification has to survive the messy middle: users who mistype their number, ported numbers, and people who reply with "yes" instead of "1". A forgiving parser and a clear retry path matter more than strict matching. And every verified number needs an easy way to revoke, because ownership of a number can change hands.
The bigger picture
Phone verification is one instance of a broader principle: an alias is only as trustworthy as the proof behind it. For how aliases and proxy lookups fit into modern rails, see this overview. In KibiPay, the reply-1 step is the small friction that makes the large convenience of pay-by-phone safe.
The recipient experience
Verification is not only a compliance gate; it shapes how confident a payer feels. When a sender pays a phone alias that carries a verified badge, they are paying a destination someone has actively claimed, not a number typed on a hope. That signal travels: a directory full of verified numbers is one people trust to route mobile money without a second thought. The reply-1 step also seeds the very channel a recipient will later receive receipts on, so a single confirmation does double duty — proving ownership today and enabling notifications tomorrow. Small as it is, that one inbound message is load-bearing for the entire pay-by-phone experience, and it is why KibiPay puts it before payability rather than after.
Prove the number, then let people pay it. That order is the whole compliance story in one sentence.