TL;DR: Regulators in more than 25 markets are moving banks away from SMS one-time passwords because shared, interceptable codes cannot withstand SIM swap, phishing, and device-linked fraud, according to IDlayr’s regulator-by-regulator guide. The shift makes phishing-resistant authentication, not OTP tuning, the new baseline for banking identity assurance.
At a glance
What this is: This is a regulator-by-regulator briefing showing that SMS OTP is being phased out, restricted, or narrowed across major banking markets as phishing-resistant authentication becomes the new baseline.
Why it matters: IAM and banking teams need to treat SMS OTP as a shrinking option, because policy, fraud liability, and authentication design are now moving toward device-bound and cryptographic factors.
By the numbers:
- More than 25 regulators worldwide have now moved toward phishing-resistant authentication.
Context
Banks are being pushed away from SMS one-time passwords because the channel is outside the institution’s control and the code can be intercepted through SIM swap, SS7 abuse, phishing, smishing, and adversary-in-the-middle attacks. In banking identity programmes, that turns a familiar second factor into a weak link rather than a reliable proofing step.
The core governance issue is not whether OTP works in isolation, but whether a banking programme can still trust a shared secret delivered over a telecoms channel when regulators increasingly expect phishing-resistant authentication. For IAM teams, the question is now how quickly banking flows can move to device-bound, cryptographic, or biometric alternatives without breaking customer access.
Key questions
Q: How should banks replace SMS OTP for high-risk transactions?
A: Banks should move high-risk actions to step-up authentication that is bound to the transaction, not the login. That usually means in-app approval, software tokens, device biometrics, or other stronger second factors, plus beneficiary confirmation for payment events. The goal is to make the approval decision harder to intercept, replay, or socially engineer.
Q: Why do SMS OTPs create higher fraud and recovery risk than device-bound authentication?
A: SMS OTPs only prove control of a phone number, and that signal is easier to spoof, intercept, or divert than a cryptographic credential tied to a device. They also depend on telecom and third-party infrastructure, which expands the attack surface and complicates accountability when fraud occurs. Device-bound authentication keeps credentials local and is harder to redirect.
Q: Where do SMS OTP controls fail in practice for banking programmes?
A: They fail in high-risk flows where the attacker can intercept, replay, or socially engineer the code before it is consumed. That is why regulators are pushing banks toward device-bound and phishing-resistant methods for transactions and account changes, not just login screens.
Q: How should IAM teams decide when phishing-resistant authentication is needed?
A: Use phishing-resistant methods wherever account compromise would create material business or operational impact, especially for remote access, privileged users, and high-value applications. If a login path can unlock lateral movement, administrative action, or sensitive data, it deserves stronger authentication than phishable MFA.
Technical breakdown
Why SMS OTP fails as a banking authenticator
SMS OTP is a possession factor only in theory. In practice, the bank does not control the delivery path, so the code can be copied, redirected, or harvested through SIM swap, port-out fraud, SS7 interception, and phishing. That makes it vulnerable to adversary-in-the-middle attacks, where the user enters a real code into a fake session and the attacker relays it immediately. The weakness is structural: the channel is shared infrastructure, not a bank-controlled authenticator. Practical implication: treat SMS OTP as a transitional control, not a durable assurance method, for high-risk banking flows.
Practical implication: Move sensitive banking journeys away from SMS-delivered codes and reserve them only where regulations still allow limited use.
What regulators are actually changing in banking authentication
The regulatory pattern is uneven but clear. Some markets are issuing full phase-outs for SMS OTP, while others are restricting it to lower-risk or narrower use cases, such as login only or confirmation of a mobile number. A few jurisdictions, including India, still permit OTP as part of two-factor authentication but are widening the acceptable set of factors. The important distinction is between a ban, a restriction, and an expanded option set. Practical implication: map each banking journey to the specific rule in force, not to a generic global policy assumption.
Practical implication: Build jurisdiction-by-jurisdiction authentication policy so regional banking flows follow the correct regulatory threshold.
Why device-bound and phishing-resistant factors are replacing OTP
The replacement control is not just a stronger code. Regulators are pushing toward authentication that is cryptographically tied to the device or app session, because that reduces interception, replay, and account takeover risk. App-based approval, biometrics, passkeys, and device-bound credentials change the trust model from shared knowledge to verifiable possession with tighter binding to the real user and device. In banking, that shift matters because authentication must survive SIM swap, phishing, and mobile number compromise. Practical implication: evaluate replacement methods by whether they resist interception, not by whether they simply add another step.
Practical implication: Prioritise device-bound and phishing-resistant factors for transactions, logins, and account changes with fraud exposure.
Threat narrative
Attacker objective: The attacker wants to authorise banking access or transactions using a code the bank treats as a second factor but cannot actually protect.
- Entry occurs when an attacker obtains an SMS OTP through SIM swap, SS7 interception, or phishing that captures the code in real time.
- Credential use follows immediately because the attacker relays the intercepted code into the banking session before the user understands the fraud.
- Impact is account takeover or fraudulent transaction authorisation, often with the bank carrying greater liability when OTP is the failed control.
Breaches seen in the wild
- Dropbox GitHub breach 2022: Phishing posing as CircleCI gave an attacker Dropbox staff GitHub access; 130 repositories with developer API keys were copied. Keys were rotated.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SMS OTP is no longer a stable banking identity assumption: The industry spent years treating a texted code as a reasonable second factor because the delivery channel looked familiar and low-friction. That assumption fails once SIM swap, SS7 abuse, phishing, and adversary-in-the-middle attacks are part of the threat model. The implication is that banking assurance has to move from shared secrets to stronger possession binding.
Regulatory fragmentation is now an authentication design problem: Some markets are banning SMS OTP, others are restricting it to narrower flows, and others still allow it under two-factor rules. That means global banks cannot run one uniform OTP policy and assume compliance. The implication is that authentication governance now needs jurisdiction-aware control mapping, not a single enterprise default.
Device binding has become the practical replacement concept: The article points to app-based approvals, biometrics, passkeys, and device-bound credentials because they reduce interception risk and change what an attacker must compromise. The important shift is not the brand of factor but the binding of authentication to a device and session the bank can trust. Practitioners should judge replacements by their resistance to relay and replay.
Fraud liability is moving from customer misuse narratives to bank control design: The UAE example shows institutions being made responsible for fraud linked to OTP authentication. That is a governance change, not just an authentication update. The implication is that banks must treat SMS OTP retirement as an accountability issue tied to control choice, not merely a user-experience migration.
Banking authentication is converging on phishing-resistant assurance: The common thread across more than 25 regulators is not uniform wording but the same control direction. Shared, interceptable codes are being displaced by factors that survive mobile number compromise and phishing. Practitioners should expect the next baseline to be defined by resistance to interception, not by message delivery speed.
What this signals
SMS OTP retirement is now a governance programme, not a point control decision: Banks operating across regions have to design for different regulatory thresholds, because some markets are banning texted codes outright while others are limiting them to specific low-risk uses. That pushes authentication policy out of the security exception queue and into formal lifecycle governance.
Device-bound authentication is becoming the durable baseline: The practical direction of travel is away from shared secrets and toward factors that are cryptographically tied to a real device or app session. For banking teams, that means the replacement decision should be measured by relay resistance and account takeover resilience, not by rollout convenience.
Authentication migration will increasingly be judged by liability outcomes: When regulators shift fraud responsibility onto institutions, the question changes from whether SMS OTP is still usable to whether it is defensible. Teams should align customer journeys, fraud operations, and IAM controls around the same standard: phishing-resistant assurance where the money moves.
For practitioners
- Map every banking flow by regulatory status Classify login, transfer, card, and account-change journeys by jurisdiction and identify where SMS OTP is banned, restricted, or still permitted as part of MFA.
- Prioritise phishing-resistant replacements for high-risk journeys Move high-risk transactions and account changes to device-bound approvals, passkeys, biometrics, or other authenticators that do not rely on a text message.
- Separate mobile-number confirmation from transaction authorisation Where a regulator still allows SMS OTP, limit it to confirming control of a registered number and remove it from approval of payments or profile changes.
- Review liability language in authentication policy Align fraud response, customer support, and IAM control ownership to the markets where institutions are now carrying OTP-related fraud responsibility.
Key takeaways
- SMS OTP is losing its place as a dependable banking factor because regulators now view interceptable codes as too weak for many customer journeys.
- The article shows a broad market shift, with more than 25 regulators moving toward phishing-resistant authentication and several jurisdictions imposing hard deadlines or scope limits.
- Banks should redesign authentication around device-bound and phishing-resistant methods, especially for payments, account changes, and other fraud-sensitive flows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS OTP is being displaced because it remains an insecure banking authenticator under modern attack methods. |
| NHI-10 — Human Use of NHI | Banking OTP flows still rely on human interaction with a machine-delivered code, which attackers exploit. | |
| Recommendation — Replace SMS OTP with phishing-resistant authenticators for any flow where interception or relay would matter. Reduce dependence on human-entered codes for high-risk banking actions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centres on retiring and replacing weak authenticators in banking environments. |
| Recommendation — Govern authenticator lifecycles so SMS OTP is phased out where policy or risk requires stronger proofing. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Authentication strength directly affects how banking entitlements and transaction authorisations are granted. |
| Recommendation — Align authorisation steps with stronger authentication methods for sensitive banking workflows. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The threat described is attacker capture of the OTP credential during authentication. |
| Recommendation — Hunt for phishing, SIM swap, and relay patterns that expose one-time authentication codes. | ||
Key terms
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Device-bound Credential: A device-bound credential is a key or token that can only be used from an approved device or authenticator. In practice, it reduces replay and theft risk, but it also raises the stakes of enrollment, attestation, and revocation because the credential can act repeatedly until invalidated.
- Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
- Dynamic Linking: A transaction integrity control that binds authentication to the payment amount and payee. If either changes, the authentication code is no longer valid, which helps stop substitution attacks and prevents a legitimate approval from being reused for a different transfer.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org