Android 17 now delays SMS access by three hours for any app that isn’t the intended recipient of the message, closing a gap that was previously exploited to intercept one-time passcodes. It’s a clear security win, but it also changes the mechanics of a step nearly every mobile signup funnel depends on: the OTP verification screen. Apps that read SMS codes through anything other than the platform’s own autofill or SMS Retriever APIs will now see those codes arrive far too late to be useful, and the user is left staring at a blank input box wondering if the text is coming at all.
Most teams instrumented their signup funnel around a simple “OTP sent → OTP verified” pair of events, which was enough when delivery was near-instant. That’s no longer sufficient. If verification is failing or stalling for a meaningful slice of users, the funnel event alone won’t tell you why — you need visibility into how the code is actually reaching the app, and how long it’s taking.
Data Points to Track
- OTP delivery method: whether the code was captured via Android’s SMS Retriever API/autofill (fast path) or requires manual entry (potentially delayed path)
- Time-to-verify: elapsed time between OTP send and successful verification, tracked as a distribution, not just an average
- Resend rate: how often users trigger a second or third OTP send within a single signup attempt, a strong proxy for delivery friction
- Verification abandonment point: whether users leave the funnel while waiting for the code, after a failed attempt, or after a resend
- App/device SMS-permission state: whether the app has the appropriate autofill integration active, segmented by Android version, to isolate Android 17 devices specifically
Setup Steps
- Migrate to the SMS Retriever API or Autofill Framework if you haven’t already — these remain fast under Android 17 because they’re scoped to the intended app, unlike manual SMS-reading approaches that now hit the delay.
- Fire a delivery-method event at the moment a code is captured, tagging whether it came through autofill or manual entry, so you can segment every downstream metric by path.
- Instrument a timer from OTP-send to OTP-verified, and log timeouts or abandonment separately from successful-but-slow verifications.
- Add a resend-triggered event with a running count per session, so spikes in resend behaviour surface as an early warning rather than a support ticket.
- Segment your funnel dashboard by Android version so degradation specific to Android 17 devices is visible immediately, rather than diluted into an aggregate conversion rate.
Actionable Insights
A growing gap between “fast path” and “manual path” verification times is the single clearest early-warning signal here — if manual-entry users are abandoning at a meaningfully higher rate, that’s lost signups the SMS Retriever migration can directly recover. Watch resend rate as a leading indicator: it tends to climb before abandonment does, giving you a window to react before the funnel number itself drops. Because this is a platform-level change rather than anything you did, segment strictly by Android version before drawing conclusions — a blended view will understate how sharp the effect is on Android 17 specifically, and overstate any “fix” that’s really just dilution from older-OS users.
Related Resources
Need help tracking this in your app?
Our team sets up analytics pipelines for mobile and web teams every day. Talk to us and get your first events flowing in under an hour.
Talk to an expert