Phone number verification in Nigeria, as anywhere, means checking at signup that a number is correctly formed and that the person signing up can receive a code sent to it. It shows that someone holds the number at that moment, and it does not tell you who they are.

To cut fake signups with phone verification, whether they come from fake numbers or bots, run three checks in order: validate the number’s format, send an SMS one-time password (OTP), and put limits around the endpoint that sends it. The examples use Arkesel’s own OTP API, and the table below shows which junk signups each layer leaves behind.

Why do Nigerian signup forms need phone number verification?

A phone field with no checks accepts whatever a person or a script types into it. Junk signups can arrive as mistyped numbers, foreign numbers on a Nigeria-only product, numbers nobody holds, virtual numbers used for throwaway accounts, and scripts that submit the form repeatedly.

Fraud figures give some context here, though none of them measures signup fraud. NIBSS reports that digital payment fraud losses fell 51 percent to ₦25.85 billion in 2025, from ₦52.26 billion in 2024, and that the 2024 total was largely driven by a single ₦31.1 billion incident involving one entity. Reported fraud incidents in the payment system fell from 123,918 in 2021 to 67,518 in 2025. These are payment fraud numbers, so they do not show how many fake accounts exist or what phone verification prevents.

Here is what each layer does with each kind of junk signup:

Step 1: What is the correct format of a Nigerian mobile number?

A Nigerian mobile number is a 0 followed by ten digits in national form, or +234 followed by the same ten digits in international form. The NCC’s National Numbering Plan lists each range as a national destination code such as 805 followed by a seven-digit subscriber number, written nationally with a leading 0 as 0805.

Convert every entry to the international form before you check or store it. That form is a plus sign, the country code and the number with no spaces. It is commonly called E.164, and the source code of Google’s libphonenumber uses that name for this format. People will type 0805 XXX XXXX, 234 805 XXX XXXX or +234 805 XXX XXXX for the same number. Converting them gives you one value, so your duplicate check can see them as one number.

For Nigerian phone number format validation, we recommend a maintained library over a hand-written regular expression, because a hand-written pattern only knows the prefixes you typed into it. One example is libphonenumber, Google’s common Java, C++ and JavaScript library for parsing, formatting and validating international phone numbers. Before you reject anyone on a library’s result, test it against a sample of numbers from your own users.

Run the check in the form so people get instant feedback, and say what you expected, such as “Enter a Nigerian mobile number, like 0805 XXX XXXX.” Run it again on the server, because a script posting directly to your endpoint never touches your form.

If your product serves only Nigerian numbers, reject anything that does not convert to +234. If you serve other countries too, allow only the country codes you serve.

Passing this check only means the number is worth sending a code to. A well-formed number can still be unassigned or switched off.

Can you tell a Nigerian number’s network from its prefix?

A prefix shows the original allocation, not the current network. The NCC’s Mobile Number Allocation Table lists ranges as at December 2023, such as 0803 to MTN, 0802 to Airtel, 0805 to Glo and 0809 to 9Mobile. The Mobile Number Portability Regulations, 2014 let subscribers move their mobile subscription to another network while retaining their mobile numbers.

So stop the format check at “is this a well-formed Nigerian mobile number?” We recommend against using the prefix to label a user’s network or to reject a number.

Step 2: How do you prove the user holds the number?

To verify a phone number by API in Nigeria, send a one-time code by SMS and ask the user to enter it. A correct code shows that the person at the form can read messages sent to that number.

Arkesel’s OTP verification API for Nigeria does this through two endpoints on sms.arkesel.com. Both calls must use your main SMS API key, sent in the api-key header, because OTP does not work with any of the Multiple API Keys. A signup flow uses them in this order:

1. Call api/otp/generate with the user’s number in number.
2. Set medium to sms. The field is required on every request and has no default.
3. Set sender_id to your whitelisted sender ID, covered below.
4. Set type to numeric for a digits-only code.
5. Set length from 6 to 15 digits.
6. Set expiry from 1 to 10 minutes.
7. Write message with a %otp_code% slot where the code should appear.
8. Ask the user to enter the code.
9. Call api/otp/verify with the user’s number in number and the code they entered in code.
10. If the code is correct, mark the phone as verified on your own user record.

The API specification’s only OTP example number is 233544919953, a Ghanaian number written with no plus sign. Before your first send, check your +234 value against the OTP API documentation, which has the full request format. That page loads the raw API specification file, which may download rather than open as a page. Our guide on how to integrate an SMS OTP API covers the full build.

For signup, we suggest starting with a 6-digit code and a 5-minute expiry. That gives the user a short code to type and leaves time for a slow message. Our OTP expiry and rate-limiting best practices explain how to choose by use case.

Show the number on the code-entry screen, with a way to change it. A person who mistyped one digit can otherwise wait for a code that has gone to a stranger’s phone.

Nigerian numbers receive Arkesel OTPs by SMS only, because voice OTP covers Ghanaian numbers only. There is also no automatic fallback between channels. If an SMS fails, nothing retries for you, so a resend is another SMS request that your own code makes.

Whitelist your sender ID before you plan a launch date

In Nigeria, transactional and OTP messages can only be delivered via the DND route, which lets verification traffic past a recipient’s Do Not Disturb restriction. That route requires a whitelisted sender ID, and whitelisting takes about 4–6 weeks.

Only companies registered in Nigeria can register a Nigerian sender ID. If your company is registered elsewhere, speak to Arkesel before you plan around this flow.

To whitelist a sender ID, you submit:

• CAC certificate
• Operational licence, such as the CBN licence for a financial institution
• Office address
• Preferred sender ID, which must be 11 characters or fewer and not all numeric
• Up to three message samples
• Company name
• Website URL

A sender ID already approved through another provider still goes through this full registration, including the whitelisting wait. The registration can run in parallel while the sender ID keeps sending through the old provider.

Once the sender ID is whitelisted, every OTP send from it uses the DND route automatically, so you don’t request the route on each send. If codes still fail to arrive, work through our guide to common OTP API integration issues.

Begin the whitelisting now, and ask the Arkesel team if you need help with it. While it runs, set up the Arkesel OTP API for Nigerian numbers.

Step 3: How do you keep bots from draining your OTP SMS budget?

Limit how often a number or IP address can request a code, cap wrong entries, and challenge traffic that speeds up. Arkesel bills per OTP sent, not per successful verification, so a script that triggers sends and never verifies still costs you money. Rates are on the pricing page.

Build these controls into your own application, in front of the call to api/otp/generate. The values below are our suggested starting points, not benchmarks, so adjust them against your own traffic.

• Per-number limit: allow 5 OTPs per number per hour.
• Per-IP limit: allow 10 OTP requests per IP address per hour.
• Resend cooldown: wait 30 seconds before the first resend.
• Longer waits: double the wait after each further resend.
• Wrong-code cap: allow 5 wrong entries per code.
• Lockout: once the cap is reached, block that number for 15 minutes.
• CAPTCHA: if requests from one IP address speed up, show a CAPTCHA before the next send.
• Hidden field: add a form field that people never see, often called a honeypot.
• Hidden field check: if that field arrives filled in, refuse the request.

Then watch one number: codes verified divided by codes sent, from your own logs. A sharp drop is your signal to review recent sends for a pattern, such as one IP range or a run of similar numbers. If the pattern looks like OTP SMS pumping fraud, where fake traffic is generated to collect message fees, that guide has the response steps.

Does phone verification prove who the user is?

No. An OTP proves possession of a number, not identity, and regulated use cases need a separate identity step.

An OTP also says nothing about a number’s history. A recycled number (one reassigned to a new subscriber) or a swapped SIM can pass, because the code goes to whoever holds the line now. We suggest recording the date each number was verified and asking for a fresh OTP before a sensitive action, such as changing payout details. Our guide to securing transactions with OTP APIs covers the wider protections.

Recycled numbers also affect how you handle duplicates. If a new signup verifies a number already attached to another account, give the person a route to support before you refuse the signup, because they may be the number’s new holder.

The NCC is working on this gap. In February 2026 it opened a stakeholder consultation on a Telecoms Identity Risk Management System (TIRMS), a platform meant to let service providers verify whether a mobile number has been recycled, swapped or barred before granting access to services. Its first phase focuses on churned (inactive through dormancy), recycled and swapped numbers. TIRMS is at consultation stage: it is not a service you can use, and it is not an Arkesel capability, so design your signup flow without it.

A reference signup flow for Nigerian users

Put together, the three layers run in this order:

1. Convert the entered number to the +234 form.
2. If the format check fails, show an error and stop.
3. If a send limit has been reached, show the wait time and stop.
4. Save the account as unverified.
5. Send the OTP by SMS.
6. If the user enters the correct code, mark the number as verified.
7. If the wrong-code cap is reached, apply the 15-minute lockout to that number.
8. Give full access only to verified accounts.

Log four events for each attempt: format rejection, limit block, OTP sent and OTP verified. Those logs show which layer is stopping what, and they give you the verified-to-sent figure from Step 3.

Frequently asked questions

How do I check that a Nigerian number is real before sending an OTP?

Before the send, a format check can confirm that the number is well-formed and starts with +234. It cannot show that someone holds the number. A completed OTP is your evidence of that.

How do I stop bots from creating fake accounts with phone verification?

Reject malformed numbers, withhold full access until the code is verified, and limit sends per number and per IP address. A bot with access to numbers that can receive SMS can still get through, so keep watching your verified-to-sent figure.

Can I send Arkesel OTPs to Nigerian numbers by voice?

No. Voice OTP covers Ghanaian numbers only, so Nigerian numbers receive OTPs by SMS, and you set medium to sms on each request.

Where to start

Start with the sender ID, because whitelisting takes the longest. You can build the format check and the limits while it runs. The API specification documents a sandbox field on SMS send, and its OTP generate schema lists none. While you wait for whitelisting, we suggest mocking the two OTP calls in your tests.

Related Articles

• OTP Not Delivered in Ghana? Find Out Why on MTN or Telecel

Verify Nigerian signups with Arkesel’s OTP API, and see the Arkesel developer API for Nigeria for the SMS and OTP APIs.

Keep reading

Popular Posts

DDeveloper Guides

OTP Not Delivered in Ghana? Find Out Why on MTN or Telecel

OTP not delivered in Ghana? Check sender ID approval on MTN and Telecel, read the delivery…

November 2, 2026Read →

DDeveloper Guides

USSD Application Testing: Load Tests and the Tools to Use

USSD application testing for Ghana: check every menu path on MTN, Telecel and AT, then load…

October 1, 2026Read →

DDeveloper Guides

Bulk SMS API for Ghana and Nigeria: A Developer’s Integration Guide (2026)

Integrate a bulk SMS API in Ghana with direct MNO connections. Code examples in Python, Node.js,…

June 7, 2026Read →