SMS-based 2FA is failing as fraud exploits OTP trust

At a glance

What this is: Prove Identity argues that SMS-based 2FA no longer provides reliable possession assurance because attackers can intercept or socially engineer one-time codes at scale.

Why it matters: Identity teams need to treat SMS OTP as a weak recovery path rather than a primary authenticator, especially where fraud, account takeover, and regulated access are in scope.

Context

SMS one-time passwords became popular because they were easy to deploy and familiar to users, not because they were designed as a strong authentication factor. The governance problem is that many identity programmes still treat message delivery as evidence of possession, even though telecommunications routing, carrier processes, and user manipulation all sit outside the organisation's control. This is a human identity and fraud issue first, with clear knock-on effects for IAM policy and recovery design.

The article's core claim is that the industry has outgrown a code sent over an insecure channel. That matters to IAM, PAM, and fraud teams because step-up authentication, account recovery, and high-risk transaction approval all depend on how confidently a second factor proves presence or possession. For organisations with regulated customer access, the operational question is no longer whether SMS is convenient, but whether it is defensible as a control.

Key questions

Q: What breaks when SMS OTP is still treated as a strong second factor?

A: The assurance model breaks because a text message proves delivery, not durable possession. Once attackers can port numbers, intercept routing, or socially engineer code disclosure, SMS no longer gives you a reliable control for account recovery, step-up authentication, or high-risk transactions.

Q: Why do SMS-based verification flows create fraud and cost risk?

A: Because each verification message has a direct delivery cost, attackers can turn authentication into a billing attack by forcing large numbers of messages to premium-rate destinations. The risk grows when organisations assume SMS is only a security control. In practice, it is also a financial exposure channel that can be weaponised at scale.

Q: How should organisations replace SMS OTP without creating user friction?

A: Move high-risk access to phishing-resistant MFA, then keep one accessible alternative that does not depend on an interceptable delivery channel. Use FIDO-based methods for primary journeys, add device trust where context matters, and reserve weaker factors only for tightly controlled fallback paths. The goal is not more prompts. It is less exploitable authentication.

Q: What should security teams do with SMS as a recovery method?

A: Treat SMS recovery as a weak exception, not a default path. If you keep it temporarily, constrain it to low-risk cases, add strict support controls, and monitor for repeated recovery attempts that indicate fraud or account takeover activity.

Technical breakdown

Why SMS OTP is a weak possession factor

SMS OTP was never a cryptographic possession control. It is a delivery mechanism that assumes control of a phone number equals control of the user, but the number can be ported, redirected, intercepted, or socially engineered away from the rightful owner. That creates a trust gap between the identity assertion and the actual authenticator. In practice, the code proves only that a message reached a telecom path, not that the intended user possessed a protected device at the moment of authentication.

Practical implication: Treat SMS OTP as an inadequate proof of possession for high-risk workflows and reduce its role in primary authentication and recovery.

How SIM swapping and social engineering defeat OTP

SIM swapping attacks exploit carrier support processes, while direct social engineering exploits user trust and the habit of reading codes aloud. In both cases, the attacker does not need to break the underlying application, only the human or carrier process around the OTP. This is why SMS fraud scales: the attacker targets the weakest administrative and behavioural control point, then reuses the stolen code inside an otherwise legitimate login or transaction flow.

Practical implication: Move high-risk verification away from knowledge of a one-time code and toward device-bound or cryptographic authentication signals.

Why device-bound keys change the authentication model

Device-bound credentials such as cryptographic keys tied to hardware, secure SIM functions, or passkey-style authenticators shift the trust anchor from the messaging network to a verifiable device relationship. That does not eliminate recovery or lifecycle issues, but it does make interception and replay materially harder than with SMS. The architectural change is important: authentication becomes deterministic possession of a bound factor, rather than probabilistic trust in message delivery.

Practical implication: Prioritise authenticator designs that bind access to a device or key lifecycle you can govern, audit, and revoke.

Threat narrative

Attacker objective: To impersonate the user and complete account access or fraudulent transactions without triggering the intended second factor.

1. Entry begins with breach-derived credentials, SIM swap reconnaissance, or a fake support interaction that gives the attacker leverage over the victim's authentication flow.
2. Credential access occurs when the fraudster intercepts the OTP through carrier redirection or convinces the user to disclose it during a spoofed verification call.
3. Escalation follows when the attacker uses the captured code to complete login, account recovery, or transaction approval as the legitimate user.
4. Impact is account takeover, fraudulent transaction authorisation, or abuse of the victim's identity in regulated services.

Breaches seen in the wild

• Dropbox GitHub breach 2022: Phishing posing as CircleCI gave an attacker Dropbox staff GitHub access; 130 repositories with developer API keys were copied. Keys were rotated.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS OTP has become a trust gap, not a trust signal. The control was acceptable when the main threat was password reuse, but it does not withstand modern fraud operations that can reach into carrier workflows or manipulate users directly. For identity programmes, that means the factor's convenience now masks a structural assurance problem, especially where step-up decisions protect money, regulated access, or recovery.

Authentication should bind to the device and key lifecycle, not to the phone number. A phone number is a routing artefact, while a cryptographic key or device-bound authenticator can be governed as an actual possession factor. This is the most important governance shift in the article: organisations need to stop treating message delivery as proof and start treating authenticator lifecycle as a control surface.

SMS recovery paths create a second trust failure even when primary authentication improves. Many organisations weaken stronger controls by allowing SMS to remain the fallback for resets, device changes, or high-risk support cases. That creates a standing exception that attackers routinely target. Practitioners should view recovery design as part of the authentication model, not as an administrative afterthought.

Device-bound possession is the right named concept for this transition. It describes a model where the possession claim is anchored in a physical device and a cryptographic key rather than an interceptable text message. That framing is useful because it helps security and identity teams separate user convenience from control integrity, which is the real governance decision here.

NIST SP 800-63B remains the clearest external benchmark for the direction of travel. The article aligns with the long-running standards position that SMS OTP is not a strong authenticator for higher-assurance use cases. Teams should use that guidance to justify deprecation decisions, especially where fraud exposure or regulated authentication is a material concern.

What this signals

Device-bound possession is the practical replacement for SMS OTP. Identity teams should expect the industry to keep moving toward authenticators that can be tied to a device, a secure key, and a recoverable lifecycle. That changes governance from code delivery to authenticator assurance, which is a much better fit for modern fraud pressure.

Recovery is now part of the attack surface. The weakest path in many authentication programmes is not the login ceremony but the reset and support flow that lets attackers pivot around stronger controls. Teams that keep SMS in recovery are preserving the very bypass route fraudsters want.

NIST SP 800-63B gives practitioners a defensible external reference point for phasing SMS out of higher-assurance workflows. That matters when identity leaders need to justify change to product, support, and compliance teams without relying on vendor preference alone.

For practitioners

• Deprecate SMS as a primary factor Remove SMS OTP from primary authentication and reserve it, if at all, for low-risk transitional use cases with explicit exception handling.
• Redesign recovery flows around stronger authenticators Replace SMS-based reset and account recovery paths with device-bound or cryptographic alternatives so the fallback does not become the weakest entry point.
• Bind step-up authentication to possession you can govern Use device-bound keys, passkeys, or similar authenticators where the possession claim can be tied to lifecycle controls, revocation, and assurance checks.
• Train support teams against OTP social engineering Update helpdesk and customer support scripts so staff do not accept or trigger OTP disclosure as an identity verification method.
• Measure where SMS still sits in high-risk flows Inventory login, transaction, and recovery paths that still depend on SMS OTP so you can prioritise the highest-risk removals first.

Key takeaways

• SMS OTP is losing its value as a possession factor because the channel can be intercepted, redirected, or socially engineered.
• The article shows that the real weakness is the trust model around the code, not just the code format itself.
• Identity teams should move high-risk authentication and recovery toward device-bound, cryptographic factors that can be governed through lifecycle controls.

Key terms

• Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
• Device-bound authentication: Authentication that only works on a specific device or trusted local context. It reduces replay risk because the secret is not useful from elsewhere, which is materially different from centrally stored credentials that can be stolen and reused remotely.
• Sim Swapping: An attack in which a fraudster convinces a carrier to move a victim's phone number to a SIM card or device they control. Once successful, the attacker can receive calls and texts intended for the victim, including OTPs used in account access or recovery.
• Possession factor: An authentication factor that depends on control of a device or physical token. It is stronger when the secret cannot be exported or reused easily, because an attacker must obtain the item itself instead of only the stored credential value.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, to strengthen governance across identity programmes.