India and the UAE are phasing out SMS OTP for auth

At a glance

What this is: This analysis covers the phase-out of SMS OTP in India and the UAE and shows how regulators are steering banks toward stronger, transaction-bound authentication methods.

Why it matters: It matters because IAM teams serving financial and regulated environments need to replace intercepted, replayable OTP flows with factors that survive phishing, SIM swaps, and channel compromise.

Context

SMS OTP has become a weak link in financial authentication because it treats possession of a phone number as strong proof of identity. The article argues that regulators in India and the UAE are now rewriting those assumptions, forcing banks to use additional checks that are harder to intercept or reuse.

For IAM and CIAM programmes, this is less about removing one factor and more about changing the assurance model behind transaction approval. The practical question is whether authentication remains bound to the session, the device, and the specific action being approved, rather than to a text message that can be diverted or spoofed.

Key questions

Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?

A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.

Q: Why do SIM swaps make SMS OTP a poor choice for financial authentication?

A: A SIM swap moves the victim’s number onto a device the attacker controls, which means OTPs arrive on the wrong handset. Because the code is still valid inside the live login or transaction flow, the attacker can complete authentication without ever knowing the user’s password or PIN.

Q: How should banks implement phishing-resistant authentication without breaking recovery flows?

A: Banks should remove passwords from the primary path and then harden enrollment, reset, and recovery with the same assurance level. If the recovery process still relies on SMS, help desk shortcuts, or weak identity checks, attackers will target that path instead of the login screen. The control is only effective when the weakest fallback is also phishing resistant.

Q: What is the difference between SMS OTP and phishing-resistant passkeys for authentication security?

A: SMS OTP relies on a code that can be intercepted, forwarded, or socially engineered from the user, so it still depends on user judgment under pressure. Phishing-resistant passkeys bind authentication to the legitimate site and device, which makes credential replay and fake-login interception much harder. For most organisations, that difference is decisive for reducing phishing success.

Technical breakdown

Why SMS OTP breaks as an authentication factor

SMS OTP depends on a channel that was never designed to be a high-assurance proof of possession. SIM swapping lets an attacker move a phone number to a device they control, while SS7 interception and SMS spoofing let messages be read or manipulated in transit. Because the factor is both reusable and visible outside the protected app session, it creates a broad interception window. In practice, the problem is not only theft but also the structural weakness of using a carrier channel as a trust anchor for financial approval.

Practical implication: treat SMS OTP as a weak fallback, not a primary control, in regulated authentication journeys.

What transaction-bound authentication changes for banks

India’s new model requires two different ways to verify the user for each digital payment, with at least one dynamic factor tied to the specific transaction. That shifts the control from general login assurance to transaction assurance. Banks can also add risk-based checks such as device, location, and behavioural signals, then step up to alternate channels when activity looks anomalous. The design goal is not just stronger login security, but binding authorisation to the exact payment being approved so a stolen factor cannot be replayed elsewhere.

Practical implication: design approval flows so every high-risk action carries its own challenge and cannot be satisfied by a reusable OTP alone.

Why passkeys, biometrics, and app approvals replace message-based OTP

Phishing-resistant methods keep the secret or approval inside the device or authenticated app rather than sending it over an interceptable channel. Passkeys use public-private key pairs so the private key never leaves the device, while app-based approvals and biometrics keep verification inside a controlled runtime. That matters because the identity proof is no longer something an attacker can copy out of a text message. The deeper shift is from distributed trust across telecom and messaging infrastructure to local trust anchored in the device and the application boundary.

Practical implication: prioritise device-bound and app-bound factors for payments, admin access, and high-value consumer journeys.

Threat narrative

Attacker objective: The attacker’s objective is to complete fraudulent authentication and approve transactions or account access using a compromised OTP channel.

1. Entry begins when the attacker diverts or intercepts the victim’s SMS OTP channel through SIM swap, carrier manipulation, or message spoofing.
2. Credential access occurs when the attacker captures the OTP and uses it as a one-time proof of possession in a live authentication flow.
3. Impact follows when the stolen OTP is used to authorise a payment or account action that appears legitimate to the relying bank or app.

Breaches seen in the wild

• Dropbox GitHub breach 2022: Phishing posing as CircleCI gave an attacker Dropbox staff GitHub access; 130 repositories with developer API keys were copied. Keys were rotated.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS OTP exposes a channel trust problem, not just a factor choice problem: The issue is not that one-time passwords are inherently obsolete, but that they are delivered through a channel attackers can divert, spoof, or intercept. Once the trust anchor sits outside the authenticated app session, the control is vulnerable to telecom-layer compromise. Practitioners should read this as a signal that authentication assurance must move closer to the device and transaction boundary.

Transaction-bound verification is the more important design change than factor diversity: India’s rule is not simply asking banks to add another factor, it is requiring one factor to be dynamic and specific to the payment being approved. That is a governance shift from reusable authentication to action-scoped authorisation. The implication is that programmes built around generic step-up prompts will increasingly fail regulatory and fraud expectations.

Phishing-resistant authentication is becoming the new baseline for regulated consumer identity: Passkeys, biometrics, and in-app approval flows are displacing SMS because they keep proof of possession or user presence inside a controlled runtime. This is especially relevant where account takeover and payment fraud intersect with CIAM, transaction risk scoring, and customer assurance. Banks that still depend on text-message OTPs are carrying avoidable exposure across both security and customer experience.

Channel-dependent authentication is now a liability in financial identity governance: When the channel that carries the second factor is also the attack surface, the identity programme inherits telecom failure modes it does not control. That creates a governance gap between authentication policy and actual assurance. The practical conclusion is that banks need assurance models that assume message interception is normal, not exceptional.

SMS OTP phase-out is a regulatory indicator of where identity assurance is headed: India’s transition path and the UAE’s hard deadline both show that regulators now expect banks to reduce reliance on replayable, interceptable factors. For practitioners, this is a cue to re-evaluate which journeys still depend on shared channels rather than device-bound proof. The next control standard is less about convenience and more about verifiable resistance to phishing and SIM-swap abuse.

What this signals

Channel-dependent authentication is becoming a governance smell: When the factor is delivered outside the protected application boundary, the identity programme inherits risks from telecom and messaging infrastructure that it does not control. Financial institutions should assume that replayable codes will continue to be targeted and shift assurance toward device-bound verification.

Transaction-bound proof is the real policy shift: The important change is not simply adopting a new factor, but making verification specific to the action being approved. That moves banks away from reusable login proof and toward authorisation that is harder to reuse across contexts.

Passkeys and app approvals reduce dependence on interceptable channels: For consumer banking journeys, the next control priority is to anchor approval in the device or application rather than in a text message. That changes both fraud resistance and the operational burden of recovery, fallback, and customer support.

For practitioners

• Prioritise device-bound authentication for high-risk journeys Move payment approval, admin access, and recovery flows toward passkeys, app-based approval, or hardware-backed factors that do not rely on SMS delivery.
• Add transaction-specific verification steps Require a dynamic factor tied to the exact transaction, then reject reusable approval patterns that can satisfy multiple actions.
• Use risk-based step-up signals Incorporate device, location, and behavioural signals so anomalous activity triggers stronger verification before completion.
• Keep SMS OTP as a fallback only Retain SMS only for narrow contingency use cases with clear customer communication, not as the default authentication path.

Key takeaways

• SMS OTP is being phased out because it cannot provide reliable assurance against interception, SIM swaps, or message spoofing in regulated financial flows.
• The article shows that regulators in India and the UAE are pushing banks toward dynamic, transaction-specific verification rather than reusable text-message codes.
• For practitioners, the practical response is to move high-value journeys toward device-bound or app-bound authentication and treat SMS only as a limited fallback.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Transaction-Bound Verification: A verification method tied to one specific action rather than a general login. It ensures the approval applies only to the exact payment or account change being requested, which limits code reuse and makes stolen factors far less useful outside their original context.
• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.
• Device-Bound Factor: An authenticator that only works on the enrolled device and cannot be freely copied to another phone or browser. For consumer identity programmes, device binding raises assurance because the factor stays coupled to the hardware and local user interaction rather than a transport channel.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.