# Twilio Verify vs Prelude, and the Prelude alternatives worth a look > Prelude and Twilio Verify both send a one-time code and check it, but they are built around different priorities. Prelude does verification only and screens every request for fraud before it sends anything. Twilio Verify covers more ways to verify someone from one API. Here is how they compare, and what else to consider. Source: https://getoxtro.com/blog/twilio-verify-vs-prelude Last updated: 2026-11-10 ## The short answer - **Choose Prelude** if SMS pumping and fake sign-ups are your main worry, or you verify users in many countries and want messaging apps such as WhatsApp, Telegram and Viber as fallbacks. - **Choose Twilio Verify** if you want every factor from one vendor: SMS, voice, WhatsApp, email, authenticator apps, passkeys and Silent Network Auth, or you already send messages through Twilio. - **Look at the alternatives** if you want fallback handled in one request (Vonage), missed-call verification for a mobile app (Sinch), or a steady SMS volume with pumping protection (Plivo). ## Side by side | | Prelude | Twilio Verify | | --- | --- | --- | | Focus | Verification only | Verification inside a larger messaging platform | | Channels | SMS, RCS, WhatsApp, Telegram, Viber, Zalo, Silent Network Auth | SMS, voice, WhatsApp, email, TOTP, passkeys, Silent Network Auth | | Fraud screening | Scores each request before sending; suspicious ones are blocked | Fraud Guard and rate limits on the service | | Fallback | Routes and falls back between channels for you | You start a new verification on another channel | | Start a code | `POST /v2/verification` | `POST /v2/Services/{ServiceSid}/Verifications` | | Check a code | `POST /v2/verification/check` | `POST /v2/Services/{ServiceSid}/VerificationCheck` | Channel lists come from each provider's documentation in October and November 2026. Both add channels often. ## How Prelude handles fraud Prelude's main difference is what happens before a code goes out. Each request is checked against Prelude's own data and against signals you send with it, such as the device and IP address. A request that looks suspicious comes back as `blocked`, and no code is sent. Accounts with challenge mode switched on can get `challenged` instead: the verification goes ahead, but only on channels other than SMS and voice, which are the ones SMS pumping targets. The check step is a separate call with the phone number and the code. It returns `success`, `failure` or `expired_or_not_found`, and Prelude stops examining codes after too many wrong attempts. **What happens to a verification request at a provider that screens for fraud** *Real sign-up* 1. A person signs up and your app sends the number to the provider, with signals such as the IP address and device. 2. The request looks normal: a real device, a sensible country, no burst of requests. 3. The provider sends the code on the usual channel, here SMS. 4. The code arrives and the user verifies. *Suspicious* 1. A request comes in from a network and number range that have been abused before. 2. The score is borderline: it could be a real person, but it looks risky. 3. With challenge mode on, Prelude answers "challenged": the verification goes ahead, but not by SMS or voice, the channels pumping schemes earn from. 4. A real person still gets the code, and a fraudster earns nothing. *Pumping bot* 1. A bot submits thousands of numbers in an expensive range, hoping to earn a share of the SMS fees you pay. 2. The request is answered "blocked". No code is sent, so there is nothing to bill. ## How Twilio Verify works With Twilio you create a Verify Service once, then start each verification with the number and a channel: `sms`, `call`, `whatsapp`, `email`, `sna` or `auto`. To check it, you send the number and the code to the VerificationCheck endpoint and get back a status of `approved` when it matches. If a code does not arrive, you start a new verification on another channel, for example voice after SMS. WhatsApp codes need your own registered WhatsApp sender. ## Prelude alternatives - **Vonage Verify:** you list channels in order, such as WhatsApp, then SMS, then voice, and Vonage moves down the list for you when the user does not finish a step. - **Sinch Verification:** flash call verifies an Android user with a missed call, so there is no code to type. It also offers verification over mobile data. - **Plivo Verify:** SMS with voice as fallback, plus Fraud Shield against SMS pumping. It is provisioned for brands with a monthly commitment. - **Twilio Verify:** the widest set of factors, covered above. Each one is compared in more detail in our guide to [the top 5 SMS verification providers](https://getoxtro.com/blog/top-5-sms-verification-providers-for-secure-user-authentication), and the [developer comparison](https://getoxtro.com/blog/compare-the-top-5-sms-verification-platforms-for-developers) shows their APIs. ## When a WhatsApp code from your own number is enough Every provider above sends WhatsApp codes through the official WhatsApp Business Platform, which means Meta's fixed authentication templates and a fee per message. If your users already talk to you on WhatsApp, there is a lighter option. Oxtro, our product, sends the code as a normal chat message from a WhatsApp number you already own. You call `POST /v1/otp/send`, Oxtro creates the code and stores only a hash of it, and `POST /v1/otp/verify` checks what the user types. Expiry, attempt limits, a resend cooldown and per-phone caps are built in. The [WhatsApp OTP page](https://getoxtro.com/use-cases/whatsapp-otp) explains the setup. Oxtro is not the official WhatsApp Business Platform, and WhatsApp can restrict a number it believes is sending automated messages. Keep the volume in line with real sign-ups and keep a fallback for logins that must always work. Our guide to [keeping your number safe](https://getoxtro.com/docs/number-safety) covers the details. ## Questions to ask before you switch - **What counts as a billable verification?** Some providers charge per attempt, some per successful verification, and some per message, resends included. - **Are blocked requests charged?** With fraud screening this matters, because a sign-up form under attack can see thousands of them. - **How does the API report a block?** Your form needs to show the user something sensible when a request is refused. - **What does delivery look like in your top countries?** Test with real numbers there before you commit.