QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/OTP verification test cases

Test cases

OTP test cases about the guessing window

Twenty six cases covering code expiry, attempt limits, single use enforcement, older codes staying live, resend throttling, delivery failure, number normalisation, verification bypass, autofill and the accessibility of segmented code inputs.

26cases/7coverage types/10security cases/FreeCSV download

All 26 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

26 worked examples

OTP-01

Verify successfully with a valid code

TypeFunctionalPriorityHigh
Test data
Freshly issued code entered within the validity window
Expected result
Accepted, the code is consumed, the user proceeds, and the attempt counter for that identity resets.
OTP-02

Reject an incorrect code

TypeNegativePriorityHigh
Test data
Valid format, wrong digits
Expected result
Refused with a generic message and the remaining attempts stated. No indication of which digits were wrong.
OTP-03

Enforce the attempt limit

TypeSecurityPriorityHigh
Test data
Wrong code entered up to and beyond the allowed attempts
Expected result
Blocked after the limit with a stated cooldown, and the code is invalidated rather than left available for a further attempt after the wait.
OTP-04

Brute force the verification endpoint directly

TypeSecurityPriorityHigh
Test data
One thousand codes submitted to the API for one identity
Expected result
Rate limited per identity and per source, and locked after the attempt limit. A six digit code with no limit is guessable in minutes.
OTP-05

Use a code after expiry

TypeBoundaryPriorityHigh
Test data
Just inside the validity window, then one second beyond it
Expected result
Accepted inside, refused outside with an offer to resend. Validity should be short, typically five to ten minutes.
OTP-06

Reuse a code that has already been verified

TypeSecurityPriorityHigh
Test data
Same code submitted a second time
Expected result
Refused. Codes are single use even inside their validity window.
OTP-07

Use an older code after requesting a new one

TypeSecurityPriorityHigh
Test data
Request a code, request a second, then submit the first
Expected result
The first is invalid. Leaving multiple codes live at once multiplies the guessing surface and is a common implementation slip.
OTP-08

Use a code issued for a different identity

TypeSecurityPriorityHigh
Test data
Valid code from account A submitted for account B
Expected result
Refused. Codes are bound to the identity and the specific verification attempt.
OTP-09

Throttle resend requests

TypeSecurityPriorityHigh
Test data
Resend pressed ten times in one minute
Expected result
A visible countdown, a small number of resends per window, and a hard daily cap per identity. This protects both your costs and the recipient.
OTP-10

Check the cost and abuse ceiling on delivery

TypeSecurityPriorityHigh
Test data
Requests for many different phone numbers from one source
Expected result
Blocked or challenged. Unthrottled message sending is a direct financial abuse route, and premium rate destinations make it worse.
OTP-11

Verify code format and character handling

TypeBoundaryPriorityMedium
Test data
Fewer digits, more digits, letters, spaces, and a code pasted with a trailing space
Expected result
Length and character rules enforced with a clear message, and pasted values are trimmed rather than refused.
OTP-12

Verify codes are random and not sequential

TypeSecurityPriorityHigh
Test data
Twenty codes issued in sequence and compared
Expected result
No predictable pattern, generated from a cryptographically secure source. Timestamp derived codes are guessable.
OTP-13

Confirm the code is not returned in the response or logs

TypeSecurityPriorityHigh
Test data
Inspect the request response and every log sink after requesting a code
Expected result
The code appears only in the delivered message. Debug behaviour that returns it in the API response must never reach production.
OTP-14

Handle delivery failure

TypeNegativePriorityHigh
Test data
Provider rejects the number, message undeliverable, provider timing out
Expected result
The user is told delivery failed and offered an alternative channel or support route, rather than being left waiting for a message that will never arrive.
OTP-15

Verify an alternative channel

TypeFunctionalPriorityMedium
Test data
Fall back from SMS to voice call or email if supported
Expected result
The alternative issues a new code, invalidates the previous one, and shares the same attempt and expiry rules.
OTP-16

Validate phone number formats

TypeBoundaryPriorityHigh
Test data
International prefix, local format, leading zeros, spaces and brackets, an invalid country code
Expected result
Normalised consistently so the same number cannot be registered twice in two formats, and invalid numbers are refused before a message is attempted.
OTP-17

Change the destination number or address mid flow

TypeStatePriorityHigh
Test data
Request a code, edit the number, then submit the original code
Expected result
The original code is invalidated by the change. Verification applies to the new destination only.
OTP-18

Verify behaviour across two concurrent sessions

TypeStatePriorityMedium
Test data
Start verification on two devices for the same identity
Expected result
Documented behaviour, and only one code is valid at a time. The second request must not silently break the first device without telling the user.
OTP-19

Interrupt the flow and return

TypeStatePriorityHigh
Test data
Background the app or navigate away, then return within the validity window
Expected result
The pending verification is still available with the remaining time shown, rather than restarting and sending another message.
OTP-20

Verify autofill and paste behaviour

TypeCompatibilityPriorityHigh
Test data
iOS and Android SMS autofill, plus paste into a multi box input
Expected result
One time code autofill works, and pasting a six digit code into segmented boxes distributes correctly rather than putting everything in the first box.
OTP-21

Verify the countdown and resend availability

TypeFunctionalPriorityMedium
Test data
Watch the timer to zero, then resend
Expected result
The timer is accurate, resend becomes available exactly when stated, and the timer survives a page refresh rather than resetting to give a free retry.
OTP-22

Check the message content

TypeFunctionalPriorityMedium
Test data
Delivered SMS or email
Expected result
Names the product, states the expiry, includes the code in a copyable form, carries the platform autofill markers, and warns against sharing it.
OTP-23

Verify an account is not left in a half verified state

TypeStatePriorityHigh
Test data
Abandon verification after the code is issued but before it is entered
Expected result
No partially provisioned account or session with elevated rights. The identity remains unverified until a code is accepted.
OTP-24

Confirm verification cannot be skipped

TypeSecurityPriorityHigh
Test data
Call the post verification endpoint directly, and replay a successful verification response
Expected result
Refused without a server side record of a consumed valid code. Trusting a client flag is the bypass to look for.
OTP-25

Time zone and clock skew handling

TypeBoundaryPriorityMedium
Test data
Device clock set several minutes wrong, and a time based authenticator app if supported
Expected result
Expiry is computed server side, so a wrong device clock changes nothing. Time based codes allow a small tolerance window.
OTP-26

Complete verification by keyboard and screen reader

TypeAccessibilityPriorityHigh
Test data
Keyboard only, then NVDA or VoiceOver, with segmented code boxes
Expected result
Boxes are labelled as one field, focus advances and reverses sensibly with Backspace, the remaining time and errors are announced, and the timer does not steal focus while the user types.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Attempt limits, expiry, code reuse and resend throttling are all High: a six digit code with unlimited attempts is not a second factor, it is a formality.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Count the guesses, then count the codes

A six digit code is one million possibilities, which is nothing without an attempt limit and everything with one.

Attack the endpoint, not the form

Submit a thousand codes to the API. Interface level attempt counters are frequently absent on the server.

Request twice, submit the first

If both codes work, you have doubled the attacker window. Requesting a new code must kill the old one.

Hold resend down

Unthrottled sending is a direct cost, and it makes your product a tool for harassing a phone number.

Skip the step entirely

Call the endpoint after verification directly. If a client side flag is trusted, the whole factor is decorative.

What Most Sets Miss

Four gaps that make a code decorative

Multiple live codes is the most frequent implementation slip we find. A user presses resend three times, each request issues a code, and all three remain valid until they expire. The guessing surface triples, and nobody notices because every code works, which looks like correct behaviour. Requesting a new code must invalidate every previous one for that identity.

Server side attempt limits are the second. The form counts three tries and locks, and the endpoint behind it accepts unlimited submissions. Six digits fall to a scripted attack in minutes. Test with a script rather than by typing, and check the limit is per identity as well as per source, since one attacker with many addresses defeats a source only limit.

Resend throttling protects two things at once: your delivery costs and the person receiving the messages. Without a countdown, a per window cap and a daily ceiling, your service can be used to flood someone with messages, and each one is billed to you.

Finally, the segmented code input is one of the most common accessibility failures on modern products. Six separate boxes typically announce as six unlabelled fields, paste puts the whole code in the first box, Backspace does not move focus back, and a countdown that updates aggressively interrupts a screen reader mid word. All four are fixable, and all four are usually shipped.

Suggest an improvement

Building phone or email verification?

QAble tests verification flows including provider failures, rate limits and the bypass paths that only appear when you call the API directly.

Security testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Sources

  • OWASP ASVS verification requirements for authentication, session and access control.
  • WCAG 2.2 the success criteria behind the accessibility cases.
  • WAI-ARIA Authoring Practices expected keyboard and screen reader behaviour for widgets.

Want your second factor to actually be a second factor?

QAble tests authentication and verification with ISTQB-certified engineers. Start with a free QA audit of your product.

Talk to QA Advisor