Your client portal sits quiet. Invoices pile up in the inbox. Contracts expire in email drafts. You send reminder after reminder. Adoption hovers at 18%—mostly power users who bookmark the link. The rest? They never log in. One team discovered the problem wasn't the portal. It was the gate. Email login links required a password lookup, a browser tab, a mental step. SMS one-time passwords eliminated that friction. Forty-eight hours later, adoption jumped to 78%. This is not a tech report or a vendor claim. It's a sequence you can deploy today, mapped to cost per failed attempt, regional SMS gateway pricing, and the exact moment retry logic kicks in. Why email login fails (and SMS doesn't) Email login links work for employees. They live in your company systems. They know where to go. Clients are different. They check email once a week. They delete invoices. They don't remember your portal exists until they need a receipt. When they do, the link is buried. Or expired. Or they try to log in and forget their password. The friction is not the portal. It's the steps before the portal: Find the email (client searches inbox, finds three invoice emails, opens wrong one) Click the link (link is 90 days old, expired) Reset password or search for old one (client gives up, calls you) Navigate to what they need (they still don't know where their invoice is) SMS OTP removes steps two and three: SMS arrives on-screen instantly (no inbox search, no link clicking) Six-digit code works everywhere (no password to reset or remember) Code expires in 10 minutes (urgency reinforces action) Client enters portal while SMS is still visible (no tab switching, no link chasing) The result: 18% adoption became 78% in 48 hours across one team's client base (approximately 200 active users). The SMS OTP sequence: trigger, timing, and retry logic Here's the sequence that moved the needle: Trigger: When SMS fires The sequence starts when a client lands on the login page and enters their email or phone number. No password field. Client enters phone number System checks: is this number in our database? (tied to a client account) If yes: SMS fires instantly with a six-digit code If no: error message + option to sign up Critical: never require a password. The password field is a dead end. Timing window SMS sent at T+0 Code valid for 10 minutes (enough time to find the client's attention, too short to forget) If code not used by T+10, send a second message: "Your code expired. Request a new one." Client clicks "request new code" (or link in expiration SMS) New SMS fires at T+11 Why 10 minutes? Shorter windows (5 minutes) create friction—clients panic if they miss it. Longer windows (30 minutes) break the urgency that makes SMS work. Ten minutes is the sweet spot observed across this team's data. Retry logic Attempt 1: Initial SMS sent Attempt 1 failure (code not entered within 10 min): Expiration SMS sent; client can request a new code Attempts 2–5: Each new request fires a fresh SMS immediately Attempt 6+: Rate limit kicks in—"Please wait 5 minutes before requesting another code." (prevents brute force; also flags suspicious activity) After 3 failed attempts (wrong code entered): Account temporarily locks; client must verify via email fallback or call support This logic costs money per SMS sent, but it protects both the client and your system. Cost per attempt and regional SMS pricing SMS is cheap—until you scale failed attempts. Here's what the math looks like: Major SMS gateways and pricing (per SMS, international) Twilio: US/Canada: $0.0075 per SMS India: $0.04 per SMS Southeast Asia (Malaysia, Singapore, Indonesia): $0.08–0.12 per SMS Volume discount at 1M+ messages/month: ~10% off AWS SNS: US: $0.00645 per SMS India: $0.02–0.03 per SMS Southeast Asia: $0.07–0.10 per SMS No volume discounts; pay per SMS sent Regional SMS gateways (India, Malaysia, Indonesia): Exotel (India): ₹0.50–2.50 per SMS; OTP routes charge premium Netcore (India): ₹1–3 per SMS OTP MSG91 (India, APAC): ₹0.80–2.50 per SMS OTP Clickatell (APAC): $0.05–0.10 per SMS (varies by country) Regional gateways are 40–60% cheaper than Twilio in India and Southeast Asia, but offer less global coverage. If your client base is concentrated in one region, regional gateways win the math. Cost per successful login Not all login attempts succeed on the first SMS. Scenario: 200 client login attempts in a week Success on first attempt: 180 clients (90%) Expired code, request new code: 15 clients (7.5%) Wrong code entered, account locked: 5 clients (2.5%) Total SMS sent: 200 (first attempt) + 15 (retries) + 5 (support fallback) = 220 SMS Cost per successful login: Using Twilio (India): (220 × $0.04) ÷ 200 = $0.044 per login Using MSG91 (India): (220 × ₹1.50) ÷ 200 = ₹1.65 per login (~$0.02) Using Twilio (Southeast Asia): (220 × $0.10) ÷ 200 = $0.11 per login Compare this to password reset emails (free) plus support costs (high): one wrong password triggers a reset flow, then a call to support