Why do passwords and SMS one-time passcodes still leave financial accounts exposed to fraud?

Passwords remain vulnerable because they are reusable, widely harvested, and often paired with weak recovery or fallback flows. SMS and voice passcodes add another layer, but attackers can intercept them through smishing, vishing, and eavesdropping. In practice, these factors reduce friction without eliminating account takeover risk, especially when fraudsters already have stolen credentials.

Why Passwords and SMS Codes Still Fail Against Fraud

Password plus SMS one-time passcode flows still leave financial accounts exposed because they verify that someone knows a secret and can read a message, not that the person is the legitimate account holder. That distinction matters in fraud because attackers often enter through stolen credentials, recovered passwords, or manipulated support channels, then use the second factor as just another obstacle to bypass.

The practical weakness is that SMS is a transport channel, not a trust boundary. Fraudsters can redirect the message through SIM swap, intercept it with social engineering, or capture it after a device compromise. Meanwhile, passwords remain highly reusable across sites, so a single exposure elsewhere can become the first step in account takeover. NIST’s digital identity guidance treats out-of-band verification carefully because channel weakness and recovery design can undermine the value of the factor itself, and NIST SP 800-63 Digital Identity Guidelines explains why authenticator choice and lifecycle matter more than adding friction alone. In the NHI domain, NHIMG notes that the Ultimate Guide to NHIs shows how weak credential handling turns access controls into a durability problem, not just an authentication problem.

Financial fraud teams usually discover this only after the login looked “successful” on paper, even though the attacker had already manipulated the path that delivered the code.

How the Attack Path Works in Practice

Most fraud starts with credential stuffing, phishing, malware, or a support-driven recovery path. Once the password is known or reset, the SMS code becomes the remaining gate. If the organisation treats that gate as sufficient proof of legitimacy, the attacker only needs to defeat the delivery channel or exploit a weaker fallback. This is why SMS-based MFA often reduces casual abuse but does not reliably stop targeted fraud.

In practice, the attacker’s advantage comes from sequencing. They do not need to break encryption; they need to exploit the human and operational edges around the factor. A SIM swap moves the phone number to a new device. Smishing persuades the user to reveal the code. Vishing pressures a help desk or payment support workflow into approving a reset. Device compromise can surface the code from notifications or messages. Each path attacks the assumption that possession of a phone number equals possession of the account owner.

Use the password to reach the authentication flow, then target the weakest second-factor path.
Exploit recovery, support, or number-port processes when direct code interception is harder.
Move from login to fraud quickly, before risk engines, geovelocity checks, or step-up verification intervene.

NIST SP 800-63 Digital Identity Guidelines is useful here because it distinguishes between verifier assurance and the actual strength of the authenticator, while The 52 NHI breaches Report is a reminder that weak secrets and weak lifecycle controls repeatedly become the real entry point. These controls tend to break down when a financial app trusts SMS delivery more than device integrity, because the user’s phone number is not the same thing as a hardened authentication factor.

Common Variations and Edge Cases

Tighter authentication often increases support burden and user friction, so organisations have to balance fraud resistance against abandonment, recovery failures, and accessibility. SMS may still be used as a transitional or fallback method for lower-risk journeys, but current guidance suggests it should not be the primary control for high-value financial actions.

The edge cases matter. A password plus SMS flow can be acceptable for low-risk account access if transaction approval uses stronger step-up controls, but it becomes weak when the same mechanism authorises wire changes, payee additions, or password resets. Some banks also inherit risk from account recovery design: if a forgotten-password flow relies on SMS, the second factor can be bypassed indirectly. The real test is not whether the login asks for two steps, but whether those steps resist phishing, SIM swap, and support-channel abuse under adversarial pressure.

There is no universal standard for this yet, but practitioners increasingly treat SMS OTP as a convenience factor rather than a fraud-grade assurance method. Where account takeover would create direct financial loss, stronger phishing-resistant methods and transaction-specific verification provide materially better protection than repeating the same phone-number assumption twice.

Risk and Threat Considerations

The material risk is account takeover leading to unauthorised transfers, profile changes, payout redirection, or recovery-lockout abuse. Passwords and SMS passcodes create a layered flow, but both can be undermined by credential theft, number-port attacks, message interception, and social engineering of support processes.

Failure mechanism: The defender assumes the second factor proves legitimate presence, while the attacker targets the weakest adjacent control such as password reuse, SIM swap, smishing, or account recovery. Once the attacker can control either the login secret or the delivery channel, the fraud path often becomes an access-orchestration problem rather than a cryptographic break.

Impact: The account can be accessed without the true owner, payment details can be changed, and recovery settings can be rewritten to lock the victim out. At scale, the same weakness creates repeatable fraud exposure across customer populations that reuse passwords and rely on carrier-delivered codes.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	AAL — Authentication Assurance Levels	SMS OTP and password strength depend on the assurance level of the authenticator and recovery path.
Recommendation — Select phishing-resistant authenticators for high-value financial actions.
NIST CSF 2.0	PR.AA-01 — Identity Management, Authentication, and Access Control	The topic is about weak account authentication and access assurance.
Recommendation — Harden authentication and recovery flows for customer financial accounts.
CIS Controls v8	5.3 — Account Management	Passwords and OTPs fail when account lifecycle and recovery are weak.
Recommendation — Review account recovery and disable weak authentication fallback paths.
MITRE ATT&CK	T1110 — Brute Force	Credential stuffing and password reuse commonly start the fraud chain.
	T1566 — Phishing	Smishing and vishing are core ways attackers capture passwords and OTPs.
Recommendation — Detect and block repeated login attempts and credential-stuffing patterns. Train users and monitor for phishing attempts that harvest credentials and codes.

Practitioner Guidance

What to prioritise: Treat SMS OTP as a step-up signal for low-risk friction, not as the final control for financial authority. For payment changes, payee creation, password resets, and account recovery, require a phishing-resistant method or a stronger risk-based challenge that is bound to the device and the transaction.

What to verify: Test the entire recovery chain, not just the login screen. If a help desk, carrier process, or forgotten-password flow can override the second factor, then the fraud control is weaker than the authentication diagram suggests.

Decision rule: If an attacker who knows the password can still reach high-value actions by exploiting the phone number, the design is not fraud-resistant enough for financial use. Escalate that flow for redesign before focusing on incremental user messaging or warning banners.

Practitioner takeaway: The real question is not whether a second factor exists, but whether it remains effective after an attacker targets the human, recovery, and delivery paths around it.