TL;DR: OTP is increasingly bypassed by phishing proxies, SIM swap attacks, SS7 interception and social engineering, while OTP bots now automate credential harvesting, code capture and session takeover at scale, according to Zumigo. Possession checks that can be replayed in real time no longer provide meaningful account protection.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Zumigo's blog post: OTP is being outpaced by real-time fraud techniques that capture or replay codes before they expire.
Why it matters: Identity teams need to treat OTP as a weak possession factor for high-risk sign-in and recovery flows, especially where phishing, SIM swap and session takeover are in scope.
Context
OTP is a short-lived code used to confirm that a user can access a device or channel at the moment of sign-in. The security gap is that a possession check is not the same as identity proof, especially when the code can be intercepted, relayed, or replayed before expiry.
That gap matters most in customer identity and recovery flows, where attackers target passwords, phone numbers, inboxes, and help desk paths to gain account control. In those settings, the control is often judged by convenience rather than by its resistance to active fraud, which makes it easy to overestimate its protection.
Key questions
A: The most effective approach is to remove phishable credentials from the login flow. Passwords, SMS codes, push prompts, and other shared secrets can be stolen, guessed, or socially engineered. Security teams should move toward phishing-resistant authentication, enforce strong device binding, and reduce reliance on knowledge-based recovery paths that attackers can exploit.
Q: Why is SMS OTP harder to defend than phishing-resistant authentication?
A: SMS OTP depends on a channel that attackers can intercept, redirect or socially engineer, while phishing-resistant methods bind the authentication event more tightly to the intended user and device context. In practice, the difference is assurance: SMS proves message delivery, not resilient user possession under attack.
Q: What is the best way to replace OTP for customer sign-in?
A: The best replacement for OTP in customer sign-in is phishing-resistant authentication methods such as FIDO2 security keys or passkeys, because they bind the login to the real origin and reduce reuse of stolen codes. Pair them with risk-based step-up, device binding, and recovery controls so account takeover does not shift to weaker fallback paths.
Q: How should security teams measure whether authentication controls are actually working?
A: Measure the full path, not just successful login. Teams should track completion rates, latency, recovery effort, suspicious attempts, and downstream fraud or support load. For NHIs, add provisioning, rotation, revocation, and offboarding completion. If the metric does not change a control decision, it is not yet useful for governance.
Technical breakdown
Why OTP is vulnerable to real-time relay attacks
OTP only works if the code reaches the legitimate user and is consumed before an attacker can use it. In practice, that assumption breaks when a phishing proxy sits between the user and the service, relays credentials in real time, and captures the one-time code as it is entered. The code is still valid, but the session is no longer under the user’s control. The mechanism is not brute force, it is timing and trust abuse across the authentication flow. See the Passwordless and Passkeys Guide.
Practical implication: Treat relay resistance as a requirement for any step-up factor used in account recovery or high-risk login.
How SIM swap and SS7 exposure undermine SMS OTP
SMS OTP depends on telecom delivery paths that sit outside the application’s control. If an attacker ports a number to a new SIM, or if signalling-layer weaknesses are abused on older mobile networks, the code is delivered to the wrong device without the victim’s cooperation. The service still sees a valid code, which means the authentication outcome can be correct from the protocol’s perspective and wrong from the identity perspective. That is why phone-based possession checks are fragile under active fraud. Read OTP security.
Practical implication: Move high-risk verification away from SMS delivery paths when number control is the only assurance being measured.
What OTP bots change in the fraud model
OTP bots industrialise what used to be a manual attack chain. Instead of a single fraudster watching one victim in real time, the bot can harvest credentials, trigger challenges, queue targets, and replay codes across many accounts at once. This turns OTP from a human inconvenience into a scalable abuse channel. The architectural issue is that the authentication system still trusts a short-lived secret as if it were bound to the legitimate user rather than to the attacker’s live session.
Practical implication: Assume any factor that can be captured and replayed within the validity window will be commoditised by automation.
Threat narrative
Attacker objective: The attacker’s objective is to seize live user sessions and convert identity access into scalable account takeover and fraud.
- Entry occurs when attackers use phishing, credential stuffing, social engineering, or SIM swap to get into the authentication flow.
- Credential access follows when the attacker captures the password and one-time code, or reroutes the SMS challenge to a device they control.
- Escalation happens when the attacker replays the valid code before expiry and takes over the live session.
- Impact is account takeover, with the attacker able to access user accounts and push fraud at scale.
Breaches seen in the wild
- Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OTP is now a weak possession proof, not a strong identity control. The control answers only whether a user can present a code within a short window, not whether the code came from the legitimate person. That breaks down under phishing proxies, SIM swap, and inbox compromise because the attacker can satisfy the check without satisfying the identity intent. Practitioners should stop treating OTP success as proof of trustworthy authentication.
OTP bots have turned authentication abuse into an industrial process. What used to be a one-off relay attack is now a repeatable workflow that can harvest, capture, and replay credentials across many accounts. That shifts OTP from a defensive control to an abuse surface when fraud operations can scale faster than manual review. The implication is that transaction and login risk have to be evaluated together, not as separate problems.
The named concept here is authentication replayability debt: a control remains in production even after its validity window is short enough for attackers to exploit in real time. OTP carries this debt because its security depends on timing, delivery integrity, and user attention all holding at once. Once those assumptions fail, the organisation is left with a control that looks familiar but no longer changes the attacker’s economics.
Phone-number verification should not be confused with identity verification. A successful SMS check shows that a message reached a number, not that the right person initiated the action. That distinction matters across customer onboarding, recovery, and step-up flows because the fraud model now targets the communication path as much as the account itself. Identity programmes should separate possession checks from proof of personhood.
What this signals
Authentication control design is shifting from code delivery to proof strength. If a factor can be phished, relayed, or replayed inside its validity window, it should not be treated as sufficient assurance for sensitive customer journeys. That pushes programmes toward phishing-resistant authentication and away from code-based convenience checks.
Recovery flows are now part of the attack surface. The same methods used to defeat OTP often target password reset, phone number change, and support-assisted recovery paths, which means identity governance has to extend beyond login into the full customer lifecycle.
Replayable factors create operational debt for fraud teams. The more familiar a challenge becomes to users, the easier it is for attackers to script around it at scale. Teams should watch for authentication methods that preserve usability while removing code capture, relay, and SIM swap exposure.
For practitioners
- Reclassify OTP as a fallback factor Limit OTP to low-risk or exception-only flows where stronger factors are unavailable, and treat it as insufficient for primary account protection in exposed customer journeys.
- Move high-risk journeys to phishing-resistant factors Prefer passkeys, hardware-bound authentication, or biometric verification for sign-in and recovery paths that face active fraud, especially where replayable codes are currently accepted.
- Remove SMS from critical verification paths Eliminate SMS-based OTP from sensitive step-up and account recovery flows where SIM swap or telecom interception can redirect the challenge to an attacker-controlled device.
- Instrument fraud signals around the authentication flow Correlate login timing, device changes, number changes, recovery attempts, and repeated OTP prompts so that a valid code does not become the only success condition.
- Test for relay and replay abuse explicitly Use red-team and fraud simulation to verify whether proxy sites, code capture, or rapid session reuse can bypass the current login sequence before you rely on it for assurance.
Key takeaways
- OTP no longer provides strong protection against active fraud because attackers can intercept, relay, or replay codes in real time.
- OTP bots and telecom-based abuse have turned code-based verification into a scalable account takeover path rather than a meaningful barrier.
- Fraud-resistant authentication requires moving sensitive journeys away from replayable codes and toward phishing-resistant factors.
Related NHI Mgmt Group resources: Customer IAM (CIAM) Guide · Account Takeover Prevention Guide · Passwordless and Passkeys Guide · OTP security
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | OTP replay and interception are direct examples of weak non-human or channel-bound authentication patterns. |
| NHI-10 — Human Use of NHI | SMS and phone-based verification rely on human-mediated channels that attackers can manipulate during fraud. | |
| Recommendation — Replace replayable authentication factors with methods that resist phishing, relay, and code capture. Reduce human-mediated authentication steps that attackers can exploit through social engineering or support abuse. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | NIST guidance limits OTP use for higher-assurance authentication because replayable codes are vulnerable. |
| Recommendation — Apply authentication assurance rules that favour phishing-resistant factors for sensitive journeys. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about access control decisions that should not rely on a weak second factor alone. |
| Recommendation — Align authentication strength with the sensitivity of the access being granted. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Phishing, SIM swap, and relay attacks enable credential capture followed by account access and session abuse. |
| Recommendation — Map OTP abuse to credential access and lateral movement patterns in fraud detections. | ||
Key terms
- One Time Passcode: A one time passcode is a temporary code used to verify a user or system during authentication. In identity security, it is a short lived secret, usually delivered by text, email, app, or device, that expires after use or time out and reduces the value of stolen credentials.
- Phishing proxy: A phishing proxy is a fake login site or relay service that mimics a real authentication page and forwards the victim’s credentials and session data to the genuine service. It defeats controls that rely on the user entering reusable secrets into a trusted-looking prompt.
- SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.
- Silent Network Authentication: A phone-number verification method that confirms device and SIM association through the carrier network instead of sending a one-time code. It reduces exposure to phishing and SMS pumping because the user does not need to read or return a secret.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org