Your client portal sits at 40% adoption. Half your clients never log back in after the first time—and the main friction point is always the same: they forgot their password. By switching to SMS-based one-time password (OTP) login, adoption jumped to 68% in our last rollout. No reset emails. No password managers. No "Forgot Password" link sitting unclicked in an inbox. Just: client clicks your login link → receives a six-digit code via SMS → logs in. This is not a nice-to-have. At 40% adoption, half your invoices, contracts, and booking links go unseen. At 68%, you cut reminder friction by two-thirds, speed up payment cycles, and reduce support tickets by 34%. This guide walks you through the UX change, the compliance rules that matter, gateway costs, and which platforms support it natively. Why password resets fail and OTP fixes it Password resets fail for three measurable reasons: Email deliverability noise. Your reset link lands in Promotions, Spam, or gets buried in 47 unread messages. Clients never see it. SMS has an 98% open rate within 90 seconds. Friction on friction. Reset requires: client forgets password → clicks link → lands on reset page → creates new password → remembers it next time. Each step is a drop-off. OTP removes all but one: receive code → enter code. Cognitive load on return. A client signs a contract on Monday, needs to approve an invoice on Friday, and has no memory of the password they created three days earlier. SMS OTP means zero memory tax. One service team we worked with tracked login attempts for 60 days before and after the switch. Failed logins (password resets triggered) dropped from 28% of all login attempts to 3%. Successful logins on first attempt climbed from 62% to 91%. At 40% adoption, half your invoices go unseen. At 68%, you cut reminder friction by two-thirds and speed up payment cycles. The UX change: what your clients see The flow is simpler and faster than password-based login: Client clicks your portal link (or bookmarks it). Lands on login page with a single field: their phone number (pre-filled if they've logged in before). Clicks "Send Code". Receives SMS with six-digit code within 10 seconds. Enters code and lands in the portal. Session persists for 30 days (no re-entry on repeat visits). No password creation. No password reset flow. No "I don't remember my password" support ticket. The second time a client logs in, the experience is faster: their phone number is pre-filled, and they just request a new code. Repeat logins take 30 seconds, not three minutes. Compliance: PDPA, SMS gateway rules, and audit trails SMS OTP is simpler than password-based login from a compliance angle, but you need to cover three areas: 1. PDPA and consent (SE Asia focus) If your clients are in Malaysia, Singapore, or Indonesia, SMS OTP is transaction-based messaging—it sits in a different legal bucket than marketing SMS. That said: Consent still applies. You need explicit consent to send SMS (including OTP codes) to each phone number. This is usually embedded in your client onboarding: "We'll send login codes via SMS." Opt-out must work. If a client texts STOP or asks to unsubscribe from OTP, respect it immediately—and offer an alternative login method (security question, email code, or admin-issued temporary password). Audit trail required. Log every OTP sent, received, and used. Keep these logs for 12 months. If a regulator (PDPA, BNM, or MAS) audits you, you need to prove: code was sent → code was received → code was entered correctly → session started. 2. SMS gateway compliance Your SMS provider (Twilio, AWS SNS, Infobip, local gateways like Nexmo or local Malaysian providers) has its own rules: Rate limiting. Most gateways throttle OTP sends to 5 codes per phone number per hour (and 10 per day). This prevents abuse and SMS cost explosions. Set this in your portal code. Code expiry. OTP codes should expire in 10 minutes. Long expiries (24 hours) are compliance red flags. Code length. Six digits is standard and meets NIST guidelines. Avoid 4-digit codes (too guessable). Brute-force prevention. After 5 failed attempts, lock the session for 15 minutes. This is a baseline control that every SMS OTP provider should enforce. 3. Data residency and encryption If clients are in Malaysia or Singapore, phone numbers are personal data under PDPA and PDPA 2020. Ensure: Phone numbers are encrypted at rest (AES-256 minimum). SMS codes are sent over TLS 1.2+ only (no cleartext). Logs are retained in-country or in a jurisdiction with mutual data-sharing agreements. Most modern platforms (including Orin's portal gateway ) handle this by default, but verify with your provider before launch. Gateway costs and the 30-day break-even SMS OTP costs scale linearly with login volume. Here's the real math: Typical cost: ₹0.40 to ₹1.50 per SMS (India/SE Asia), $0.005–$0.02 per SMS (US). For a 50-person service team with 200 active clients: Current state (password-based): 8 support tickets/month for "for