Short answer: use a password reset email for the normal US/EU SaaS login-recovery path; keep SMS OTP as an optional backup for higher-risk accounts. Email reset links usually require less application code, avoid telecom registration and per-country SMS pricing, and leave a cleaner compliance trail.
The practical flow is small. A user asks for recovery, your backend creates a single-use token, and an email carries a link to the reset page. Your system owns token hashing, expiry, invalidation, and rate limits. The delivery provider only transports the message and exposes evidence that your compliance team can retain. That separation matters: a delivered message is not proof that a token is valid.
I would start with email for an ordinary B2B tenant. Keep the decision reversible by putting both channels behind one recovery interface, then add SMS only where a risk policy calls for a second factor.
Keep it boring.
How should a SaaS compare password reset email and SMS OTP for US/EU recovery?
