An SMS one-time passcode is a short-lived code sent by text message and used to confirm a login, onboarding step, or transaction. It is easy to deploy, but it can be exposed to forwarding, SIM swap, interception, and phishing, which makes it weaker than stronger device or network based authentication methods.
Expanded Definition
SMS one-time passcode, often shortened to SMS OTP, is a temporary code delivered through the mobile phone network and used as an additional check during authentication or transaction approval. In NHI and IAM practice, it is usually treated as a possession factor, but that label can overstate its strength because the phone number, the SIM, and the message channel are all separable attack surfaces. Standards bodies and security guidance increasingly distinguish between basic text-message codes and stronger phishing-resistant authenticators, including device-bound cryptographic methods described in the NIST Cybersecurity Framework 2.0.
Usage in the industry is still evolving because some teams describe SMS OTP as two-factor authentication while others reserve that term for stronger, non-interceptable factors. For NHI security, the key question is not whether the code is temporary, but whether the control meaningfully binds access to the intended user, device, or workflow. The most common misapplication is treating SMS OTP as phishing-resistant MFA, which occurs when organisations rely on it for privileged access, administrative recovery, or high-risk approvals.
Examples and Use Cases
Implementing SMS OTP rigorously often introduces usability and telecom-dependence constraints, requiring organisations to weigh quick deployment against weaker assurance and higher support burden.
- Low-risk consumer account sign-in where the goal is basic step-up verification rather than strong identity proofing.
- Transaction confirmation for routine actions, especially when the organisation wants a friction-light control for short-lived approvals.
- Fallback recovery path for a lost authenticator, though many teams now limit this because recovery flows are frequently targeted by attackers.
- Onboarding workflows where SMS OTP is used only as a transitional control before stronger methods are enrolled.
- Legacy environments that cannot yet support device-bound tokens or passkeys, making SMS OTP a temporary bridge rather than a preferred endpoint.
For governance context, NHI Mgmt Group notes that Ultimate Guide to NHIs reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, showing why weak human-authentication fallbacks can become part of a broader trust failure. Where stronger identity assurance is required, teams often compare SMS OTP with guidance from the NIST Cybersecurity Framework 2.0 and prefer controls that resist interception and relay attacks.
Why It Matters in NHI Security
SMS OTP matters in NHI security because humans often use it to approve actions that indirectly govern service accounts, API keys, agent access, and recovery workflows. If an attacker can capture or redirect a text message, they may not only enter a user account but also reach the controls used to create, approve, or reset non-human identities. That makes SMS OTP a governance issue, not just a login convenience. NHI Mgmt Group’s Ultimate Guide to NHIs shows that only 5.7% of organisations have full visibility into their service accounts, which means compromised human access can quickly cascade into unmanaged machine access.
In zero trust programs, SMS OTP is often retained for backward compatibility, but it should not be the control that protects privileged NHI administration or high-impact approvals. Stronger approaches usually combine phishing-resistant authentication, least privilege, and explicit session binding. In practice, the danger is that an SMS challenge can look like a safeguard while silently preserving an attacker’s path through SIM swap, forwarding, or social engineering. Organisations typically encounter the weakness of SMS OTP only after an account takeover or recovery abuse, at which point the authentication choice becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL2 | SMS OTP is commonly treated as AAL2 evidence, though it is not phishing-resistant. |
| NIST CSF 2.0 | PR.AC | Authentication and access control guidance covers weak factor choices like SMS OTP. |
| NIST Zero Trust (SP 800-207) | SP 800-207 | Zero Trust requires strong, continuously evaluated access signals beyond SMS codes. |
| OWASP Agentic AI Top 10 | A02 | Agentic and high-risk workflows need stronger authentication than interceptable SMS codes. |
| OWASP Non-Human Identity Top 10 | NHI-07 | Weak human recovery paths can expose service accounts and other NHIs to takeover. |
Require phishing-resistant authentication before agents or operators can approve sensitive actions.
Related resources from NHI Mgmt Group
- How should security teams use phone intelligence to decide whether to send an SMS one-time passcode?
- Why do SMS and email one-time passwords remain risky for enterprise access?
- Why do SMS and email one-time passcodes create governance risk?
- Why do organisations need to move away from SMS-based one-time passwords in regulated environments?
