AI fraud is breaking legacy identity controls and SMS OTP

At a glance

What this is: This analysis argues that AI has made legacy knowledge-based identity checks and SMS OTP too easy to spoof, and that device-verified possession factors are now the more resilient authentication layer.

Why it matters: IAM, fraud, and identity teams need to reassess where user verification still depends on human judgment, because AI now scales the exact attacks that exploit passwords, OTPs, voice, and document checks.

By the numbers:

• Over 80% of phishing attacks now target mobile devices, according to IDlayr.
• More than 60% of internet traffic now comes from mobile devices, according to IDlayr.
• Phishing volumes increased 400% in early 2025, according to IDlayr.
• The entire SMS OTP relay flow can take under 90 seconds, according to IDlayr.

Context

AI-enabled fraud has changed the assumptions behind identity verification. Passwords, PINs, SMS OTPs, voice checks, selfie checks and document checks are now easy to imitate, relay or automate at scale, which means the control problem is no longer only about user behaviour but about whether the factor itself can still resist machine-generated deception.

For identity programmes, the practical question is whether authentication still depends on a secret the user can be tricked into revealing. If the answer is yes, AI has already lowered the cost of abuse enough that the factor is operating on borrowed time. The article’s central claim is that possession-based verification, tied to a physical device or SIM and checked silently at the network layer, changes that equation.

This is not just a fraud-team issue. It affects IAM, customer identity, workforce identity, recovery flows and any programme that still treats SMS OTP or knowledge-based checks as a durable step-up factor.

Key questions

Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?

A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.

Q: Why do possession factors resist AI fraud better than passwords or voice checks?

A: Possession factors rely on a physical object the attacker cannot remotely fabricate, such as a device or SIM. AI can imitate knowledge, speech and documents at scale, but it cannot manufacture physical custody. That makes possession-based verification structurally harder to social engineer and more suitable for phishing-resistant authentication.

Q: How should teams redesign account recovery for deepfake and voice-cloning risk?

A: They should remove recovery paths that depend on human recognition of a caller, spoken answers or a one-time code alone. Recovery needs a stronger binding to the user’s device or network identity, otherwise the help desk becomes the easiest path into the account. The key is to govern recovery as a high-risk authentication event, not a service convenience.

Q: When is SMS OTP still acceptable, and when should it be retired?

A: It may still be tolerable for low-risk, low-impact interactions, but it should be retired where account takeover, payment fraud or recovery abuse would matter. If the attacker can impersonate the user, relay the code, or pressure support staff, SMS OTP is no longer a dependable control for that journey.

Technical breakdown

Why knowledge factors fail under AI fraud

Knowledge factors are credentials or answers the user is expected to know, such as passwords, PINs, OTPs and security questions. AI changes the economics of abuse by making phishing, voice cloning and deepfake content cheap enough to industrialise. That matters because these factors are not verified by ownership of a device or network link, only by the user successfully reproducing information under pressure. Once an attacker can convincingly imitate the prompt, the factor collapses. Practical implication: treat knowledge factors as exposure points, not resilient trust anchors, when AI-assisted social engineering is in play.

Practical implication: move away from user-recalled secrets as the primary trust mechanism for high-risk authentication flows.

Why SMS OTP is especially vulnerable to relay attacks

SMS OTP depends on a human receiving a code, recognising the request as legitimate and entering it on the correct site or app. Real-time phishing relay kits remove that trust path by capturing the code and forwarding it to the real service before expiry. Because the code is still valid and the user is still acting, the attacker does not need to break cryptography, only the human decision chain. The weakness is structural: SMS is not bound tightly enough to the intended session, device or transaction. Practical implication: any authentication design that allows a code to be read aloud, typed or relayed is exposed to AI-driven interception.

Practical implication: phase out SMS OTP for sensitive access and recovery flows where relay attacks can complete before expiry.

What possession-based authentication changes

Possession-based authentication verifies something the user physically holds, such as a device or SIM, instead of something they know or can speak. In the article’s model, the check happens at the device or network layer, silently and in real time, which removes the user from the attack surface. That is why the control is structurally more resilient: an attacker can replicate text, voice and documents, but cannot remotely manufacture physical possession. The design also changes trust boundaries by anchoring identity to a specific object rather than a conversational challenge. Practical implication: prefer possession factors when you need phishing resistance rather than just second-factor convenience.

Practical implication: anchor high-risk authentication to a device-bound or carrier-verified possession check instead of a human-mediated code entry.

Threat narrative

Attacker objective: The attacker wants to defeat human-mediated authentication and obtain enough trust to impersonate the user, take over the account or authorise fraud.

1. Entry occurs when the attacker uses AI-generated phishing, voice cloning or deepfake documents to start the impersonation flow against a user or support channel.
2. Credential_harvested follows when the victim reveals a password, PIN or SMS OTP, or when the attacker relays the one-time code to the real service in real time.
3. Escalation happens when the attacker uses the captured factor to bypass legacy identity checks and complete account takeover or fraudulent access.
4. Impact is account compromise, fraudulent transaction approval or identity abuse that the user can no longer easily distinguish from a legitimate authentication event.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI fraud is not just accelerating old attacks, it is collapsing the assumptions behind knowledge-based identity. Passwords, PINs, OTPs and security questions were designed for a world where humans had time to judge legitimacy and attackers could not cheaply impersonate tone, language or context. That assumption no longer holds when AI can scale convincing deception and replay it in real time. The implication is that identity programmes must stop treating user knowledge as a stable trust layer.

SMS OTP has become a relayable secret rather than an authentication factor. The article shows that once a code can be read, forwarded or intercepted within a short attack window, the control is reduced to a human judgement test. That is a poor fit for AI-assisted phishing because the attacker does not need to break the channel, only to occupy it briefly. Practitioners should treat relayability itself as the design flaw.

Possession factors are now the clearest boundary between human-mimicked identity and machine-resistant identity. A physical device or SIM verified at the network layer changes the trust model because the attacker cannot socially engineer raw possession in the same way they can social-engineer knowledge. This is the right direction for high-risk consumer journeys, recovery paths and fraud-sensitive actions. Identity governance should distinguish convenience factors from structurally resilient factors.

Mobile identity is becoming the default trust anchor, which raises the governance bar for recovery and transaction approval. As more user interactions move onto phones, the device is no longer just an endpoint but part of the identity chain itself. That means the organisation must govern binding, re-binding and recovery with the same seriousness it once reserved for passwords and tokens. Programmes that ignore mobile trust will keep inheriting AI fraud risk through the back door.

Credential theft is no longer the only problem; trust extraction is the new abuse pattern. AI-assisted fraud now targets the moment a user, support agent or system decides to believe the attacker. That shifts the security question from whether a secret can be stolen to whether the identity process can be socially or procedurally overridden. The right conclusion is to reduce every authentication step that depends on persuasion rather than possession.

What this signals

Possession-based identity is becoming a governance requirement, not an optional hardening step. As AI reduces the cost of impersonation, programmes that still rely on codes, voice or knowledge checks are extending trust into the most easily manipulated part of the journey. The practical shift is to treat device-bound verification as the baseline for fraud-sensitive access.

Mobile trust now sits inside the identity model itself. When the phone becomes the primary channel for payments, messaging and recovery, the device is no longer just an endpoint. Identity teams need to govern binding, rebinding and recovery with explicit policy instead of assuming the user will notice fraud in time.

Human judgment is no longer a control surface you can depend on. AI-assisted attacks succeed because they turn the authentication moment into a persuasion problem. That means the strongest programmes will remove user action wherever the business can tolerate it and reserve human mediation for low-risk, low-friction cases only.

For practitioners

• Replace SMS OTP on high-risk journeys Prioritise login, recovery and payment flows where the code can be relayed or socially engineered, then remove SMS as the default step-up option.
• Bind authentication to device possession Use device-bound or carrier-verified checks for actions that need phishing resistance, especially where the user should not have to read or enter a code.
• Reduce human-mediated recovery paths Review help desk, account recovery and SIM-change processes so they do not depend on a caller, a code or a voice check that AI can imitate.
• Separate knowledge and possession in policy Document which journeys still rely on passwords, PINs or OTPs and which require a true possession factor, then enforce the distinction in authentication policy.
• Test fraud flows against relay attacks Simulate real-time phishing relay and deepfake-assisted social engineering to see which identity controls fail before the attacker’s window closes.

Key takeaways

• AI-driven fraud is now strong enough to break authentication designs that depend on users spotting deception in time.
• SMS OTP and knowledge-based checks remain easy to relay, imitate or socially engineer, which makes them weak anchors for high-risk identity journeys.
• Device-bound possession factors change the trust model by replacing human-mediated secrets with a physical verification step that AI cannot fake remotely.

Key terms

• Possession factor: An authentication factor that depends on control of a device or physical token. It is stronger when the secret cannot be exported or reused easily, because an attacker must obtain the item itself instead of only the stored credential value.
• Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Deepfake-Enabled Fraud: Deepfake-enabled fraud uses synthetic media, voice, or face manipulation to impersonate real people and bypass weak verification steps. It raises the bar for identity and fraud teams because traditional checks may not reliably detect fabricated presence, especially in high-volume digital onboarding and support channels.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.