diff --git a/backend/src/notifications/sms.service.ts b/backend/src/notifications/sms.service.ts
index 87fc933..007bfce 100644
--- a/backend/src/notifications/sms.service.ts
+++ b/backend/src/notifications/sms.service.ts
@@ -138,13 +138,15 @@ export class SmsService {
     const message = this.mizbanMessage(kind, code);
     const to = toLocalMobile(phoneE164); // 09XXXXXXXXX
 
+    // Field shapes per the API's validation: To is a string[] (many recipients)
+    // while Message is a single string shared by all of them.
     const payload = {
       Usertype: this.config.get<number>('sms.mizban.userType') ?? 2,
       Username: this.config.get<string>('sms.mizban.username'),
       Password: this.config.get<string>('sms.mizban.password'),
       From: this.config.get<string>('sms.mizban.from'),
       To: [to],
-      Message: [message],
+      Message: message,
       Api: this.config.get<number>('sms.mizban.api'),
     };
 
@@ -156,8 +158,18 @@ export class SmsService {
       });
       const raw = (await res.text()).trim();
 
+      // The API wraps its result in a JSON array, e.g. "[1008]" for an error or
+      // "[100002656565]" for a delivered message id. Unwrap to the bare code.
+      let codeStr = raw;
+      try {
+        const parsed = JSON.parse(raw);
+        codeStr = String(Array.isArray(parsed) ? parsed[0] : parsed);
+      } catch {
+        codeStr = raw.replace(/[[\]"\s]/g, '');
+      }
+
       // Success returns a long numeric message id; failures are codes 1001–1011.
-      const reason = SmsService.MIZBAN_ERRORS[raw.replace(/^"|"$/g, '')];
+      const reason = SmsService.MIZBAN_ERRORS[codeStr];
       if (!res.ok || reason) {
         this.logger.error(
           `MizbanSMS OTP send failed (${res.status}): ${reason ?? raw}`,