What's the industry standard for verifying phone number ownership? What's the industry standard for generating single-use SMS codes verifying phone number ownership? 

I'm currently evaluating two main alternatives, both based on sending a verification code to that phone number via SMS. How would one properly generate such code?


Obtain an OS-generated random GUID and somehow shorten it to a human-friendly code, e.g. 6-digit number.
Use a incremented, stored sequence and obfuscate it deterministically into a human-friendly code.


With option 1 my main concern is how to shorten a GUID to something human-friendly while still preserving good entropy.

Option 2 allows uniqueness if the maximum sequence value is significantly larger than the expected code count, but it's fully deterministic and that could allow attacks based on the knowledge of several subsequent codes.

The SMS code is only used to verify phone number ownership. It's not a 2-factor authentication scheme and it's hardly authentication at all, since anyone with a working phone number is authorized to access the service behind it. The only reason for it is to prevent people from putting numbers they don't own and potentially have our service spam unrelated, unaware people with text messages.

UPDATE

The original question did not reflect the actual problem, which is verifying that an anonymously supplied phone number in fact belongs to the actual supplier. 

Thanks for all the replies, I believe getting a few bytes from CSPRNG mod 10^n is the appropriate method.
I don't think there is any written 'industry standard', just as in any case when generating random numbers: Just use properly-seeded CSPRNG. Closest thing we have is TOTP/HOTP.

Both of your ideas are far more complex to get right from what TOTP/HOTP roughly does: Take CSPRNG, output 4bytes, truncate to 31bits, and take modulo 1000000 (Please note that TOTP/HOTP actually have bit more to it, refer to according rfc for details). This yields very small bias, which isn't a issue.

As SEJPM noted in his comment, SMS can be captured, and especially recently, some parties who used 'best recommendations' were hacked with SMS-reset of password. Therefore you should consider TOTP/HOTP, and SMS can be implemented as a variant of HOTP (which would allow you to check if one of previous tokens was reused).

So in short: neither 1 nor 2. Use properly seeded CSPRNG (/dev/urandom or CryptGenRandom can be used), then take 31-bits and modulo them to 1000000. Better yet, allow usage of HOTP/TOTP (which does basically same thing, without relying on channel security).