verify: pull out CheckOTPFormat as a separate function