A common mistake is assuming any second factor is equally strong. SMS one-time passcodes can still be phished, forwarded, or intercepted, so they may satisfy a basic step-up requirement without offering durable resistance to fraud. Security teams should assess whether the method resists social engineering and whether it can be used at scale without adding friction or accessibility barriers.
Why This Matters for Security Teams
SMS one-time passcodes are often treated as a simple upgrade over passwords, but that framing misses the actual threat model. SMS is a second channel, not a strong proof of possession, and it remains vulnerable to phishing, SIM swap fraud, message forwarding, telecom interception, and device compromise. NIST’s guidance on digital identity, alongside NIST SP 800-53 Rev 5 Security and Privacy Controls, treats weaker authenticators very differently from resistant ones for a reason.
The operational mistake is assuming that satisfying a second-factor checkbox equals meaningful fraud resistance. In practice, attackers do not need to “break” SMS if they can convince a user to disclose the code, hijack the number, or route the code to another device. That means the control may reduce low-effort account takeover attempts, but it does not reliably stop targeted attacks, session theft, or recovery-path abuse. The Ultimate Guide to NHIs is relevant here because the same pattern appears in identity governance more broadly: security teams often confuse the presence of a control with actual assurance. In practice, many teams discover SMS weakness only after an account takeover or help-desk reset has already occurred.
How It Works in Practice
Security teams should evaluate SMS OTP as a step-up mechanism with limited resistance, not as a durable MFA factor. The real question is whether the factor resists social engineering and whether the environment can tolerate the operational risk of a telephony-based channel. For many organisations, the answer is no, especially for privileged access, financial workflows, and recovery flows.
Current best practice is to prefer phishing-resistant authenticators such as FIDO2/WebAuthn, device-bound passkeys, or cryptographic authenticators tied to the endpoint. Where SMS remains in use, it should usually be constrained to lower-risk journeys, with compensating controls such as risk-based authentication, anomaly detection, hardened account recovery, and tight session monitoring. Guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls supports layering controls around authentication events rather than relying on a single factor to carry the entire decision.
- Use SMS only where stronger authenticators are not yet feasible and the risk is explicitly accepted.
- Prioritise phishing-resistant methods for admins, finance, support, and recovery workflows.
- Monitor SIM swap indicators, anomalous device changes, and repeated OTP failures.
- Make account recovery at least as strong as the primary login path.
For identity operations, the lesson from Ultimate Guide to NHIs is that lifecycle controls matter as much as the initial factor choice. These controls tend to break down in high-volume consumer environments because telecom dependencies, device churn, and recovery exceptions create too many bypass paths.
Common Variations and Edge Cases
Tighter authentication often increases user friction and support cost, so organisations have to balance fraud resistance against accessibility, rollout speed, and help-desk burden. That tradeoff is real, but it does not make all second factors equivalent. For low-risk portals or transitional migrations, SMS may be an acceptable bridge if the alternative is no second factor at all.
There is no universal standard for using SMS safely across every context. Best practice is evolving toward risk-based, phishing-resistant authentication for higher assurance use cases, while reserving SMS for narrow exceptions with documented compensating controls. Accessibility also matters: some users cannot use app-based authenticators or hardware keys reliably, and security programs must plan for that without turning the exception into the default.
Security teams also get tripped up by recovery flows. If password reset, SIM replacement, or help-desk verification is weaker than the login factor, attackers will target the easier path. The broader identity lesson in Ultimate Guide to NHIs is that controls fail when privilege and recovery are easier to exploit than the front door. SMS is most defensible only when it is temporary, risk-scored, and surrounded by stronger detection and recovery controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-7 | Addresses authentication strength and user access protection. |
| NIST AI RMF | Risk management applies when deciding acceptable authenticator strength. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Weak credential handling patterns mirror poor identity lifecycle control. |
| OWASP Agentic AI Top 10 | LLM-06 | Phishing-resistant authentication is relevant to autonomous tool access governance. |
| CSA MAESTRO | AI.AUT-2 | Covers authentication and access control for AI-driven workflows. |
Require stronger auth before granting agents or operators sensitive tool access.
Related resources from NHI Mgmt Group
- What do security teams get wrong about multi-factor authentication and rainbow table attacks?
- What do security teams get wrong about where modern breaches actually start?
- What do security teams get wrong about point-in-time file monitoring?
- What do security teams get wrong about SMS verification risk?
