OTP on Both Mobile and Email: Balancing Convenience and Security in eVoting

In the world of digital voting, voter authentication is one of the most sensitive and critical aspects. Over the years, customers conducting elections on eVoting platforms have repeatedly demanded one feature above all others, sending election invitations and OTPs on both mobile number and email ID. At first glance, this demand appears completely reasonable. People change phone numbers, forget to update email IDs, or face network issues. If voting access depends on only one communication channel, genuine voters may lose their right to vote. However, unlike many platforms that rush to satisfy convenience requests, we have always taken a measured, security-first approach. This blog explains why customers demand OTP on both the risks involved, how other industries handle it, why many eVoting agencies get it wrong, and how Right2Vote has finally implemented this feature without compromising election integrity.

Why Customers Demand OTP on Both Mobile and Email?

The primary reason customers ask for OTPs on both mobile and email is simple: they want to ensure no voter is denied access. Elections are often time-bound. If a voter does not receive the OTP on time, they may completely miss the opportunity to vote. From the election officer’s point of view, even a small number of missed votes can raise questions about fairness and participation.

Customers typically manage large voter databases, such as housing apartments, associations, cooperatives, trade unions, professional bodies or corporate shareholders. These databases are not always updated regularly. Members may change phone numbers, stop using old email IDs or make typing errors while sharing their details. Sending the invite and OTP on both channels increases the probability that the voter receives at least one valid communication and is able to vote successfully.

From a convenience standpoint, this feature also reduces support calls and complaints. Election officers do not want to spend the entire voting day handling messages like “I didn’t get the OTP” or “The email ID on record is old.” So the demand is genuine, practical and rooted in real operational challenges.

The Biggest Challenge: Quality of the Voter Database

While the demand sounds logical, it also exposes the biggest weakness in eVoting processes, the quality of the voter database.

Election officers are often unsure whether the voter database they have is accurate. Many members do not update their contact details for years. If the system sends the OTP only to one channel and that channel is incorrect, a genuine voter could be denied the right to vote. By sending invites and OTPs to both mobile numbers and email IDs, the election officer improves the chances that the voter still receives access credentials and participates in the election.

This is also the strongest argument against sending OTP to both. If one of the two contact details is incorrect, there is a real risk that someone else (not the voter) receives the OTP. This directly violates the core principle of secure voting: only the eligible voter must be able to cast the vote. If an unauthorised person gains access, the election result can be challenged, leading to complaints, disputes or even legal action.

Unlike banking systems, eVoting platforms do not usually perform identity verification (KYC) directly. They rely entirely on the data provided by the client. This makes dual-channel OTP a double-edged sword.

“Banks Also Send OTP on Mobile and Email” – Is That a Fair Comparison?

Customers often use banks and other financial institutions as examples, saying, “If banks can send OTP to both mobile and email, why can’t eVoting platforms?”

Why the Comparison Exists?

Banks do send OTPs on multiple channels. Customers are familiar with this process and trust it. Naturally, they expect the same convenience from eVoting platforms.

Why the Comparison Is Incomplete?

Banks own and control their customer databases. They conduct strict Know Your Customer (KYC) checks before onboarding. They regularly update customer details and perform periodic re-verification. In addition to OTPs, banks use multi-factor authentication passwords, customer IDs, security questions, device binding, grids and transaction limits.

In contrast, an eVoting platform does not onboard voters directly. The voter list is provided by the client, and the platform has no way to independently verify whether the mobile number or email ID truly belongs to the voter. In many simple elections, OTP is the only authentication factor. If that OTP reaches the wrong person, the risk is far greater than in banking.

This is why blindly copying the banking model into eVoting can be dangerous.

Other eVoting Agencies Sending OTP on Both Channels

Another point customers raise is that other eVoting agencies already send invites and OTPs on both mobile and email.

Are They Compromising Security?

In many cases, YES. A large number of uncertified or inexperienced eVoting agencies prioritise convenience over security. Some platforms go as far as sending the login ID and password together in the same email or SMS, which is a serious security flaw. If the email ID or phone number is incorrect, anyone receiving that message can log in and vote without restriction.

Such practices may work in the short term but expose election officers to long-term risks, complaints, mistrust, reputational damage and legal disputes.

At Right2Vote, we have always believed that elections are not just another IT feature. They require the same seriousness, checks and accountability as any formal democratic process.

How the OTP on Mobile and Email Feature Works in Right2Vote

The OTP on Mobile and Email feature in Right2Vote is designed to balance ease of access and strong authentication.

When a voter is registered for an election, their mobile number and email ID are securely stored. Once voting opens, the voter receives an invitation email and an SMS notification. Both messages contain information about the election along with a secure voting link. When the voter clicks on the link, they are redirected to the Right2Vote login page with their login ID prefilled. This avoids confusion and reduces errors, especially for less tech-savvy voters.

When the voter clicks on the “Get OTP” button, the same OTP is sent simultaneously to both the registered email ID and mobile number. The voter can use either medium to retrieve the OTP and complete authentication.

For elections where the feature of ‘same OTP on both Email and Mobile’ is used, we provide voters a system-generated user ID, and they are not allowed to use their email ID or Mobile number as the user ID. This is to ensure that a voter does not get access to any other polls where the email ID or the mobile number is registered in the voter list. This ensures that the risk of old/incorrect data in the client’s voter list is limited to his or her election. 

Why This Improves Reliability Without Compromising Security?

This dual-delivery approach ensures there is no hindrance during login or voting. If the SMS is delayed, the email works. If the mobile network is weak, the email acts as a backup. At the same time, authentication is still tightly controlled within the Right2Vote system, ensuring only authorised voters can proceed.

By carefully designing this feature and offering it with the right checks, Right2Vote delivers maximum reliability, improved voter participation and a smooth voting experience, without sacrificing the integrity of the election.

Conclusion: Convenience with Responsibility

The demand for OTP on both mobile and email is real and completely justified. However, in eVoting, convenience can never come at the cost of security. For more than 10 years, Right2Vote has been providing trusted eVoting services, and we clearly understand the true value of security, transparency and client trust. Our platform’s credibility is backed by strong certifications; we are STQC certified three times in a row, ISO 27001  certified and certified by a CERT-In empanelled agency, leaving no room for questions about our security standards. Till now, Right2Vote has successfully conducted 21000+ elections and earned the trust of 4000+ associations and housing societies across India.

By introducing the OTP on Mobile and Email feature with a security-first mindset, Right2Vote ensures that no genuine voter is left out, while election officers and organisations remain protected from unauthorised access, disputes, and risks. This is not just another feature, it is our continued commitment to trustworthy, reliable and responsible digital voting.

To know more about Right2Vote’s election technology, please refer:

• Government of India certificates
• Features for eVoting
• Security and safety
• Pricing
• Our customers
• Contact Us