1. The Complete 12-Point SMS OTP QA Test Matrix
Every authentication release should validate both deterministic state transitions (in a mock environment) and live carrier delivery (using real Non-VoIP SIMs):
| ID | Test Scenario | Input / Action | Expected System Behavior | Test Layer |
|---|---|---|---|---|
| TC-01 | Happy Path E.164 | Enter valid +1 or +44 number, submit correct 6-digit OTP within 60s |
HTTP 200; session authenticated; OTP invalidated immediately | Mock + Live SIM |
| TC-02 | Single-Use Replay | Resubmit the exact same valid OTP a second time | HTTP 400 OTP_ALREADY_USED; reject replay attempt |
Mock Simulator |
| TC-03 | Expired Token (TTL) | Submit correct OTP after 10-minute TTL window expires | HTTP 400 OTP_EXPIRED; prompt user to request new code |
Mock Simulator |
| TC-04 | Resend Cooldown | Click “Resend SMS” 3 times within 15 seconds | Enforce 30–60s countdown timer; return HTTP 429 TOO_MANY_REQUESTS |
Mock Simulator |
| TC-05 | Superseded Code | Request OTP #1, wait 60s, request OTP #2, then submit OTP #1 | Reject OTP #1; only the latest active OTP #2 is valid | Mock Simulator |
| TC-06 | Brute-Force Lockout | Submit 5 consecutive wrong 6-digit codes (000000..000004) |
Invalidate current OTP on 5th failure; lock phone for 15 mins | Mock Simulator |
| TC-07 | Trunk Prefix Normalization | Enter +44 07700 900077 with leading domestic 0 |
Normalize to +447700900077 before dispatching SMS |
E.164 Validator |
| TC-08 | VoIP Line Rejection | Submit known virtual VoIP number when policy requires cellular | HLR check blocks SMS dispatch before incurring carrier cost | Live Carrier |
| TC-09 | Delayed SMS Arrival | Carrier delivers SMS after 90 seconds | UI keeps input state alive; background polling resolves cleanly | Live SIM |
| TC-10 | 10-Minute Carrier Timeout | Upstream carrier drops SMS packet completely | Session expires at 600s; wallet/escrow hold refunds 100% | Live SIM |
| TC-11 | Concurrent Sessions | User opens 3 parallel verification tabs simultaneously | Isolate state by session_id + phone_number without cross-talk |
Mock + Live SIM |
| TC-12 | Unicode / Localized Template | Send Japanese (+81) or Arabic (+971) UCS-2 SMS template |
Verify 70-char UCS-2 segment splitting does not truncate OTP | Live SIM |