Passwordless login by email can feel safer because there is no password database to defend. That part is true, but it hides a quieter problem: many teams treat the inbox like a neutral transport layer when it is actualy part of the auth boundary. If one inbox can collect codes for multiple sessions, environments, or users, your OTP flow gets harder to reason about and easier to abuse.
I have seen this show up in test systems first, then later in production design reviews. The app logic looked fine, the email templates looked fine, yet the control plane around verification was fuzzy. That fuzziness is where replay, mix-ups, and weak audit trails start.
Why passwordless email OTP flows fail in subtle ways
Most broken passwordless flows are not broken because the code generator is weak. They fail because delivery context is loose.
Common examples:
