MMY India: OTP, SIM and DND
MMY registration asks for a mobile number and sends a one-time code by SMS. You type the code in. The app cannot read the message, because READ_SMS is not in the manifest. On a dual-SIM Indian phone, the practical question is which number receives the code, and whether a DND filter eats it.
The code
The code arrives by SMS, and you type it
The manifest declares READ_PHONE_STATE and does not declare READ_SMS. Those are different permissions. Phone state lets an app see that a call is active or read a device identifier, depending on the Android version. It does not open the inbox. So the one-time code, if the app sends one to the number you typed, lands in the messages app, and you copy it across by hand.
That is a small piece of hygiene, not a hardship. It also means an SMS-blocker, a spam folder inside the messages app, or a full inbox can stop registration without the MMY screen saying anything useful. Look in the messages app, including the spam or blocked tab, before you request the code a second time. A second request fired too quickly usually does nothing; wait out the timer the screen shows.
The SIM must be able to receive SMS. A data-only SIM, a SIM with outgoing SMS barred by the operator, or a SIM that has not finished activating will not get the code. Voice working is not proof that SMS works. Send yourself a message from another phone if you are unsure.
Dual SIM
Dual-SIM phones: which number receives
Most phones sold in India have two SIM trays. The code goes to the number you typed into the app, not to "the phone". If you type the number of SIM 1 and SIM 1 is the one with a full inbox or a DND registration, that is where the problem is. The other SIM being healthy does not help.
- Read the number back before you submit it. A wrong digit sends the code to a stranger, and you will wait for a message that is never coming to this phone.
- Match the tray. Settings, SIM manager, shows which slot holds which number. Pulling the tray out to read the card is the reliable check if the labels in settings are stale.
- Preferred SIM for SMS is a phone setting about messages you send, not about messages you receive. Incoming SMS arrives on the SIM whose number was dialled. Changing the preferred SIM does not redirect the code.
- If you use one SIM for calls and another for data, type the call SIM's number only if that SIM receives SMS. Some cheap data SIMs do not.
A phone with no SIM at all, running on Wi-Fi, cannot receive the code. Borrowing a friend's OTP is borrowing their number, and the account will be tied to that number, not to you. Do not do that.
DND
DND filters and blocked senders
India's DND registry, set through the operator or the TRAI app, blocks promotional SMS categories. A one-time code is not a promotion, but filters are blunt, and a strict DND setting plus a third-party SMS cleaner can drop a short code from an unknown header. If the code never arrives, check three places before you blame the app: the messages app's spam tab, any cleaner app's quarantine, and the DND preference on that SIM.
Also check that the phone has signal on the SIM you named, not only Wi-Fi. SMS does not travel over Wi-Fi calling on every operator setup, and a phone showing full Wi-Fi bars in a basement can still have no cellular path for the message. Step outside, wait, then request the code once.
What the app cannot do
What the app cannot read
Because READ_SMS is absent, the app cannot lift the code out of the inbox, and it cannot scan your other messages. Contacts, camera and location are absent as well. The thirteen declared permissions are network, audio, vibration, wake lock, notifications, phone state, an advertising id, an install referrer, message delivery through Google, and two vendor lines. Phone state is the one to read twice. It is not an inbox permission.
POST_NOTIFICATIONS, on Android 13 and newer, is a runtime prompt. Declining it does not stop the SMS. The code is a text message, not an app notification. Declining the prompt only means you will not see the app's own alerts later, which on a shared household phone is often what you want. That trade-off is on the age page.
When you change phones, the same number is the recovery path, and only if the new handset has that SIM or a SIM that still receives SMS for that number. A number port that has not completed will silently strand the code. The new phone page covers the order of operations. State rules are unchanged by a successful OTP: a code proves the SIM, not that play is permitted where you are. Check states separately.