Push, SMS OTP & Other Hidden App Costs (and How to Cut Them)

The costs that arrive after launch day

Let us be blunt. In the AI era, almost anyone can get an app built. Keeping it alive and profitable is the hard part, and it is mostly about the small bills nobody mentioned in the sales call: a few cents per SMS, a percentage on every payment, a storage line that grows every month, and the developer hours needed to keep it all running.

None of these costs is scary on its own. Together, unwatched, they can quietly eat the margin of a delivery or ride business. This guide explains how push notifications and SMS OTP are billed, how fraud turns OTP into a money leak, what the cheaper alternatives are, and how to cut both running costs and team costs. Prices are as of October 2026 from official pricing pages; check the provider's page before budgeting.

How push notifications work

When the app shows "Your driver has arrived", your server does not talk to the phone directly. It sends the message to a push service, which delivers it to the device:

• Firebase Cloud Messaging (FCM) delivers to Android, and can also send to iOS apps.
• Apple Push Notification service (APNs) is Apple's delivery network for iPhones; FCM hands iOS messages to APNs, which needs your Apple developer credentials configured.

Notification messages vs data messages

FCM has two message types, and choosing the right one matters:

• Notification messages are displayed automatically by the system when the app is in the background. Good for "Order picked up" or promotions.
• Data messages carry only your own key-value data and are handled by your app code. Good for silently updating a trip status or refreshing a screen.

Both can carry up to 4,096 bytes. A message can contain both parts; in the background, the data part is only handled when the user taps the notification.

Topics

Topic messaging sends one message to every device subscribed to a named topic, for example all drivers in one city. It is ideal for broadcasts, but Google notes that once a topic send is accepted it cannot be cancelled, so double-check before you press send.

In the Flutter apps we build at Joldisoft, both types are sent through FCM from the backend, with notification messages for user-facing alerts and data messages for silent status updates.

What push costs

Firebase lists Cloud Messaging as no-cost. The real costs are indirect: the server and queue workers that send messages, and the engineering time to keep tokens up to date and messages relevant. The bigger risk is not the bill but annoying users until they switch notifications off.

SMS OTP: useful, paid, and a fraud target

One-time passcodes by SMS are the default login for many on-demand apps because almost every rider and driver has a phone number. But every SMS is paid.

As a reference point, Twilio lists outbound SMS to US numbers at $0.0083 per segment plus a carrier fee (for example $0.0035 to $0.005 depending on the carrier), as of October 2026. A standard segment is 160 characters, and failed messages carry a small processing fee. International rates vary widely by country, often far higher than domestic US rates, so always check the price list for your market. Firebase Phone Authentication on the paid Blaze plan is also billed per SMS sent.

SMS pumping: the fraud nobody warns you about

SMS pumping (also called artificially inflated traffic) happens when fraudsters use your phone-number field to trigger large volumes of OTP messages to number ranges they profit from, often through a complicit or exploited mobile operator. The tell-tale signs are a spike of messages to adjacent numbers on one network, usually with no completed verification.

The result is a bill for thousands of messages that produced zero real users. Twilio's recommended defences include:

• Turning on fraud protection features for verification and messaging.
• Restricting geographic permissions so you can only send SMS to countries you actually operate in.
• Using line-type lookups to send OTP only to mobile numbers and to block suspicious carriers.

Add your own controls too: rate-limit OTP requests per phone number, per device and per IP; add a short cool-down before "resend code"; and put a daily spending alert on your SMS account.

Cheaper or more reliable alternatives to SMS OTP

WhatsApp authentication messages

In many countries, people use WhatsApp more reliably than SMS. Meta's WhatsApp Business Platform has a dedicated authentication template category for one-time passcodes. Key points from Meta's pricing page, as of October 2026:

• Since July 1, 2025, Meta charges per delivered message, by category and by the recipient's country code. Authentication and utility messages have volume tiers.
• Some markets have a higher authentication-international rate for eligible businesses. From October 1, 2026, this can apply in up to 18 markets, including newly added Bangladesh, Iraq, Kazakhstan, Kuwait, Morocco, Nepal, Oman, Sri Lanka and Ukraine.
• Service (customer-reply) messages were free from November 1, 2024; from October 1, 2026, Meta charges for them again, with 1,000 free service messages per business phone number per month.

Whether WhatsApp is cheaper than SMS depends on your country's rates, so compare both price lists for your market. Always keep SMS as a fallback for users without WhatsApp.

Other options

• Email OTP or magic links. Very cheap at scale: Amazon SES, for example, lists outbound email at $0.10 per 1,000 emails on its à la carte pricing. Less suitable for drivers who rarely check email.
• Verify once, then stay logged in. Long-lived, securely stored sessions mean users rarely need a new code. Many apps send an OTP far more often than they need to.
• Push-based confirmation for users who already have the app installed and logged in on another device.
• Flash calls and network-based verification. Some providers offer verification through a missed call or directly through the mobile network. Availability and pricing vary by country and provider.

The other recurring costs founders forget

• App store accounts. Apple charges an annual developer fee and Google Play a one-time registration fee (see our cost guide for details). Good news for on-demand apps: Apple's guideline 3.1.3(e) says purchases of physical goods or services consumed outside the app must use payment methods other than in-app purchase, so rides and food orders are paid through your own gateway, not the store's commission system.
• Payment gateway fees. Stripe's standard US pricing is 2.9% + 30¢ per successful domestic card payment, plus 1.5% for international cards and 1% if currency conversion is needed, as of October 2026. Local gateways often have different rates; on thin delivery margins, a fraction of a percent matters.
• Maps. Usually the second-biggest variable bill. See our guide to Google Maps costs and alternatives.
• Servers, storage and CDN. Driver documents and food photos accumulate. Plan object storage and backups, and delete what you no longer need.
• Monitoring and error tracking. Often free at low volume, paid as you grow.
• Maintenance. OS updates, new store requirements, security patches and bug fixes never stop. This is the cost that most often decides whether an app survives. Read why long-term app support matters.

Monthly cost checklist

Use this table every month. If you cannot fill in a line, that is the line to investigate.

Practical ways to cut running costs

• Right-size your infrastructure. Most early platforms need one or two well-run servers, not a sprawling cloud setup. Upgrade when monitoring shows you need it, not before.
• Choose managed services where failure is expensive (the database), and self-host where it is cheap and safe (for example, a routing engine once you have volume).
• Kill silent waste: forgotten test servers, unrestricted API keys, verbose logs nobody reads, and OTP sent on every app open.
• Set budget alerts everywhere: cloud, maps, SMS and email accounts.
• Own your accounts. Cloud, Firebase, SMS, WhatsApp, payment and store accounts should be registered to your company, with your vendor added as a user. If a vendor owns them, you cannot see the bills, and you cannot leave without a painful migration.
• Ask for a cost report, not just a feature report. A good development partner tells you which bill moved this month and why. If nobody can explain a jump in SMS or maps spend, assume something is wrong until proven otherwise.

Practical ways to cut team costs

Team cost is usually larger than the hosting bill. Ways to reduce it without losing control:

• Start from a proven white-label base. Paying to rebuild login, tracking and payments from scratch is rarely the best use of a limited budget. At Joldisoft, a white-label launch with configuration starts at $3,000, with MVP and custom builds when you need something the base cannot do (see pricing).
• Consider offshore or nearshore teams for development and support, with clear written scope, code in a repository you own, and regular demos.
• Automate the boring parts. CI/CD pipelines that run tests and deploy automatically save hours on every release and prevent costly mistakes.
• Use AI-assisted support carefully. An AI assistant can draft replies and answer common questions ("Where is my order?"), with humans handling refunds, safety issues and complaints.
• Buy a support plan, not panic. A predictable monthly maintenance agreement is cheaper than emergency fixes at night.

Hidden-cost launch checklist

• SMS geo-permissions limited to your operating countries
• OTP rate limits per number, device and IP, with resend cool-down
• Daily spend alerts on SMS, maps and cloud accounts
• WhatsApp or email OTP evaluated for your market, with SMS fallback
• Sessions last long enough that users rarely need a new code
• Push notifications split into notification vs data messages correctly
• Payment gateway fees compared, including international cards
• Storage lifecycle and backup retention defined
• Maintenance and support plan agreed before launch

The bottom line

The apps that survive are not the ones with the most features. They are the ones whose founders know every line on the monthly bill and why it is there. Push is free, so use it well. SMS is paid and attacked, so protect it. Everything else needs an owner and a monthly review. If you want help building a cost plan for your launch, see our pricing or contact us.