Why do SMS one-time passcodes often fail against true name fraud?

SMS one-time passcodes only prove control of a phone number, not that the number is still bound to the right person. In true name fraud, a criminal can attach a victim’s identity data to a different phone number or repurpose an existing number. That breaks the trust assumption behind OTPs and makes possession-based authentication too easy to bypass.

Why SMS OTPs break the trust model in true name fraud

SMS one-time passcodes are designed to confirm control of a phone number at a moment in time. True name fraud attacks a different assumption: that the number remains tied to the rightful person. Once an attacker can redirect, replace, or repurpose that number, the OTP still works as designed, but it no longer authenticates the real customer.

The weakness is not the code itself, it is the identity binding behind the code. A possession factor only tells you that someone can receive a message on a line, not whether the line is still governed by the correct account holder, especially after SIM swap, number recycling, account takeover, or fraudster-controlled onboarding.

That is why SMS OTP often fails as a control in fraud cases that rely on identity substitution. The attacker does not need to defeat the telecom channel in a cryptographic sense, they only need to create a mismatch between the verified phone number and the actual person or identity record the business believes it is protecting.

Number control can be transferred faster than many organisations update their customer records.
Phone-number possession is not the same as customer continuity, especially after reassignment or re-registration.
Fraud controls that treat a phone number as a stable identity anchor are vulnerable to false reassurance.

The practical implication is that SMS OTP is best understood as a weak signal of current delivery access, not a strong proof of identity continuity. In true name fraud, the message can reach the attacker just as reliably as the victim, so the authentication event becomes decoupled from the person the business intended to verify.

What actually fails: the binding between identity data and the channel

True name fraud succeeds when a fraudster can present stolen or synthetic identity data and then attach it to a phone number under their control. At that point, the SMS challenge is answering the wrong question. It proves that the device or line can receive a code, but not that the asserted identity is legitimate or that the original subscriber still controls the account.

There are several common failure modes. A number may be ported or swapped to a new SIM, reassigned after inactivity, enrolled on a new device through social engineering, or linked to a fraudulent account during onboarding. In each case, the authentication channel remains intact while the identity binding silently breaks.

For practitioners, this is a channel-assurance problem more than a code-generation problem. If the business uses SMS as a step-up factor, it should treat the factor as one input into a broader risk decision, not as a durable proof of the person behind the transaction.

NHI Mgmt Group research shows how often identity material remains exposed or poorly governed in adjacent trust chains, including that only 5.7% of organisations have full visibility into their service accounts. The broader lesson is that weak visibility and weak lifecycle control make it easier for bad bindings to persist unnoticed.

Safer verification patterns for fraud-prone flows

When the business impact of impersonation is meaningful, SMS should not be the final trust decision. Stronger controls look for evidence that is harder to substitute, such as device binding, phishing-resistant authentication, transaction-specific confirmation, step-up based on behavioural or contextual risk, and manual review for high-impact account changes.

For true name fraud, the most useful control question is whether the verification step binds the decision to the right account history, not just to a reachable handset. If the answer is no, then the control should be treated as low assurance and paired with additional checks before money movement, account recovery, SIM changes, beneficiary updates, or profile edits.

Practically, organisations should also watch for reuse of the same contact number across multiple identities, rapid changes to profile details, and authentication success immediately after a number change. Those patterns often matter more than the raw success or failure of the OTP challenge itself.

For a broader control lens on identity and access risk, OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework 2.0 both support the same operational principle: assurance depends on lifecycle visibility, not just a successful authentication event. For channel-specific control design, OWASP Cheat Sheet Series remains a useful implementation reference.

Risk and Threat Considerations

SMS OTP creates a false sense of assurance when organisations equate “reached the phone” with “verified the person.” In fraud scenarios, that gap can enable account takeover, unauthorised profile changes, and high-value transaction approval without the victim ever seeing a meaningful warning.

Failure mechanism: the attacker compromises or replaces the phone-number binding, then uses the legitimate SMS channel to satisfy a possession check that no longer reflects the true account holder.

Impact: authentication succeeds while the wrong person is trusted, which can lead to financial loss, recovery hijacking, and persistent account compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA — Identity Management, Authentication and Access Control	SMS OTP failure is an authentication assurance problem.
Recommendation — Strengthen assurance for fraud-sensitive flows with higher-confidence authentication and binding checks.
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Management	The answer depends on the weakness of possession-based trust and binding control.
	NHI-05 — Lifecycle and Offboarding	True name fraud exploits stale or reassigned trust relationships over time.
Recommendation — Treat phone-number possession as low assurance and add stronger binding for high-risk actions. Verify that bindings are updated or retired when contact details change or are recycled.

Practitioner Guidance

What to prioritise: treat SMS OTP as a low-assurance factor for fraud-sensitive journeys, especially account recovery, SIM-change workflows, password resets, beneficiary edits, and payment release. If those journeys can materially change customer funds or credentials, require a stronger binding than phone-number possession.

What to verify: confirm that your fraud controls can detect number changes, recent SIM swaps, recycled numbers, and impossible travel or device changes before the OTP is treated as sufficient. If the only evidence is successful code entry, the control is too thin for true name fraud.

Practitioner takeaway: the core error is trusting a reachable phone number as if it were stable identity proof; the safer design is to verify continuity, context, and account history before allowing the OTP to carry decision authority.