SMS-based account takeover risk is still outpacing OTP trust

At a glance

What this is: This is a Prove Identity analysis of how SMS one-time passwords can be diverted through SIM swaps, call forwarding, and device changes, turning OTP delivery into an account takeover path.

Why it matters: It matters because identity teams still rely on phone-number trust at the exact moment fraudsters can alter that trust, so OTP risk has to be evaluated as a live signal, not a static authentication control.

Context

SMS one-time passwords are still widely used because they are easy to deploy, but ease of deployment does not make them reliable under fraud pressure. When the trust decision is tied to a phone number, attackers can target the telephony path rather than the password or session itself.

Prove Identity argues that account takeover fraud now depends on real-time changes in SIM, device, and call-forwarding state. That shifts the identity problem from authentication alone to transaction-level trust evaluation, which is where many existing OTP flows are weakest.

The article frames this as a consumer and operational risk, not a theoretical edge case. For IAM and fraud teams, the issue is whether the organisation can still distinguish a legitimate OTP recipient from a number that has just become adversary-controlled.

Key questions

Q: What breaks when SMS OTPs are trusted without phone-risk signals?

A: The control breaks at the delivery layer. A number can still receive an OTP while SIM swaps, device swaps, or call forwarding have already made that number hostile, so the code proves only that the message arrived, not that the rightful user received it.

Q: Why do SIM swaps and call forwarding increase account takeover risk?

A: Because they attack the delivery channel, not just the password. If an attacker can redirect SMS or voice OTPs, the code still appears valid while reaching the wrong device. That makes the account look authenticated even though the legitimate user never saw the challenge, which is why channel trust must be evaluated continuously.

Q: How do security teams know whether an SMS OTP replacement is actually working?

A: Measure the live journey, not the demo. Look at authentication success rate, latency, conversion uplift, fraud loss reduction, and the volume of fallback use. If those numbers improve in production without creating a new exception problem, the replacement is doing real control work.

Q: Should organisations still accept SMS and OTP for business access?

A: They should only do so where the business impact of takeover is low and where stronger options are not yet feasible. For anything that touches admin functions, sensitive data or internal applications, SMS and OTP are too easy to intercept or socially engineer to serve as a durable baseline.

Technical breakdown

Why OTP trust fails when phone numbers become mutable

An OTP only helps if the delivery path is trustworthy at the moment of use. In SMS-based account takeover, the phone number is no longer a stable proxy for the person because attackers can manipulate carrier state, forwarding settings, or physical SIM possession. That means the authentication event and the identity signal can diverge. The technical weakness is not the code itself, but the assumption that message delivery proves account ownership. Once that assumption is false, SMS becomes an unreliable factor for high-risk actions.

Practical implication: treat phone-number state as an input to risk scoring, not as proof of identity.

How telephony signals expose account takeover risk

The article points to three signals that matter operationally: SIM and device velocity, SIM tenure, and call-forwarding status. High SIM or device change frequency can indicate churn consistent with takeover attempts. Low tenure suggests a recent reassignment that may not reflect established trust. Call forwarding can redirect voice OTPs without touching the application layer at all. These signals are valuable because they sit in the telephony layer, where the fraud often begins, and they can be evaluated in real time before a high-risk transaction is authorised.

Practical implication: ingest carrier and phone-intelligence signals at decision time for password resets, money movement, and number changes.

Why real-time decisioning beats static OTP policy

Static OTP policy assumes the same control works regardless of context, but account takeover fraud is situational. A phone number can look legitimate at enrolment and compromised during a later high-risk event. Real-time decisioning uses the current trust state of the number to decide whether OTP delivery should proceed, be stepped up, or be blocked. That is a more accurate model than treating every OTP request as equally safe. The goal is not to remove every SMS path immediately, but to stop trusting it blindly when the surrounding signal set looks abnormal.

Practical implication: bind OTP delivery rules to event risk, not to a fixed allow-or-deny rule for all transactions.

Threat narrative

Attacker objective: The attacker wants to hijack the account by capturing the OTP at the point of verification and using it to pass authentication.

1. Entry occurs when attackers obtain access to a victim's number through SIM swapping, device swapping, or call forwarding abuse.
2. Credential access follows when the attacker intercepts SMS or voice OTPs that were meant to validate the legitimate account holder.
3. Impact occurs when the stolen OTP is used to complete account takeover and authorise fraud or unauthorised account actions.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OTP trust is a conditional control, not an identity guarantee: SMS delivery only works when the receiving number still represents the legitimate user at decision time. Prove Identity's analysis shows that assumption is fragile because telephony state can change faster than the authentication flow. The practical conclusion is that OTP should be treated as a risk signal with context, not as proof of possession.

Real-time phone intelligence is a trust-layer control: SIM tenure, device velocity, and call-forwarding status are governance signals, not just fraud telemetry. They tell practitioners whether the delivery path itself has become suspect before the OTP is even issued. For identity programmes, that moves control from post-event investigation to pre-authorisation screening.

Account takeover exposes a boundary problem between IAM and fraud operations: Traditional IAM treats authentication as a discrete login event, while ATOs exploit the live condition of the communication channel. That boundary is where many programmes still over-trust the phone number and under-govern the transaction. Practitioners need one decision model that spans identity, telecom risk, and step-up authentication.

Dynamic trust scoring is the named concept practitioners should track: the relevant control question is whether the organisation evaluates phone-number trust continuously enough to detect SIM swaps, forwarding abuse, and device churn before an OTP is accepted. That is the difference between a usable signal and a stale assumption. Teams should design for trust drift, not just credential theft.

OTP friction and fraud loss should be governed together: the article shows that accessibility and convenience can coexist with abuse when voice and SMS channels are too broadly trusted. The governance challenge is to preserve legitimate use cases while narrowing the attack surface exposed by weak telephony assurance. Security leaders should align fraud, IAM, and customer-experience ownership around that trade-off.

What this signals

OTP trust has to be governed as a dynamic risk condition: the decisive question is no longer whether SMS can deliver a code, but whether the phone number is trustworthy at the exact moment the code is used. That pushes teams toward live signals from carrier state, SIM history, and call-forwarding behaviour rather than static enrolment checks.

Account takeover control now sits at the intersection of IAM and fraud operations: IAM alone often stops at authentication success or failure, while fraud teams look for suspicious transaction behaviour. SMS-based takeover shows why those two views need a shared trust model for high-risk events.

Telephony trust drift is the real blind spot: numbers can look legitimate at onboarding and then become unsafe later without any visible change inside the application. Practitioners should therefore review where their programme still assumes the phone number is a durable possession signal.

For practitioners

• Measure phone-number trust before OTP issuance Use real-time carrier and phone-intelligence signals to assess SIM tenure, device changes, and call-forwarding status before sending an OTP for a high-risk event.
• Gate high-risk events on live telephony risk Apply stricter decisioning to password resets, money movement, and phone-number updates than to routine logins, because those events are prime takeover targets.
• Separate legitimate accessibility from abuse detection Allow voice OTP paths where needed for accessibility, but require stronger risk checks when forwarding settings or device churn indicate possible interception.
• Tune fraud and IAM thresholds together Align fraud operations and identity teams on the same trust signals so OTP policy, step-up prompts, and block decisions respond to the same live risk picture.

Key takeaways

• SMS-based account takeover works because attackers exploit the trust placed in the delivery path, not because they defeat the OTP code itself.
• Telephony signals such as SIM tenure, device changes, and call-forwarding status give teams a way to measure whether a number is still trustworthy at decision time.
• The practical response is to move OTP handling into a risk-based model that treats high-value events differently from routine authentication.

Key terms

• One-Time Password: A one-time password is a short-lived authentication code used once, then discarded. It usually supplements a primary password as a second factor, but its security depends heavily on how the code is generated, delivered, and recovered if the user loses access.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.
• Call forwarding abuse: Call forwarding abuse occurs when an attacker redirects voice or SMS-delivered verification traffic to another device. It matters because the authentication system may see a successful delivery even though the rightful user never receives the code or alert.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.