Short answer: for a beginner-friendly SaaS login in the US or EU, SMS OTP is the simplest managed starting point; authenticator apps are stronger, while an email code is a fallback you must build and evidence yourself.
The decision is less about a clever factor comparison than about what your compliance file can prove six months later. A password-reset message with a short expiry is a useful test case: the user needs reach, the security team needs an audit trail, and the storage owner needs a defensible retention policy.
What is the bill actually made of?
Count the work before counting the vendor invoice. With SMS, the recurring unit is a message plus verification traffic, and the operational cost is the evidence around it: destination country, request ID, expiry, attempts, and the final result. An authenticator app shifts recurring delivery cost toward enrollment and recovery engineering. Email looks inexpensive until your team owns code generation, hashing or encryption, expiry, replay prevention, suppression, deliverability, and proof that the right mailbox controlled the session. That is a long list for a “cheap” fallback.
For a password-reset flow, retain a salted hash of the one-time code, a five-minute expiry, a one-time-use marker, the account identifier, and a correlation ID. Do not retain the plaintext code or the reset token after redemption. Retention is a security decision: keeping every message body forever creates evidence, but it also creates a second secret store.
