All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp) Only the latest OTP is valid and an OTP can only be used for X hours.
I am wondering what would be the drawback if I send the same OTP for every user request in the said X hours?
So let us say X = 2, then once an OTP is sent, all further requests for OTP in the next 2 hours would send the same OTP. Any requests after the 2 hours will generate a new OTP.
I have an application where we use OTP. The reason I ask is that sometimes the OTP SMS is delayed, and so user requests for another OTP. Finally when the SMSs do arrive the user is unsure which OTP to use.