Should we fail if the OTP wasn't present in the response?