SMS OTP bans are reshaping banking authentication worldwide

At a glance

What this is: This is a regulator-by-regulator briefing showing that SMS OTP is being restricted, phased out, or replaced across major banking markets, with the strongest moves in the UAE, Singapore, Malaysia and the Philippines.

Why it matters: It matters because identity teams now have to replace an inherited authentication pattern with phishing-resistant, device-bound controls that satisfy local rules, reduce SIM-swap exposure, and preserve user experience across channels.

By the numbers:

• More than 25 regulators worldwide have now moved toward phishing-resistant authentication.

Context

SMS OTP is a shared-secret authentication pattern delivered over a telecommunications channel the bank does not control. That makes it vulnerable to SIM swap, phishing, smishing and adversary-in-the-middle attacks, which is why banking regulators are moving away from it.

The governance problem is not simply that SMS OTP is weaker than newer methods. The real issue is that regulated institutions are being asked to prove possession with something that can be intercepted, replayed or redirected outside the bank's control, while still meeting local authentication rules.

For banking identity teams, this is now an authentication migration problem, not a point-in-time policy debate. The article maps how different regulators are using bans, scope restrictions, liability shifts and device-bound alternatives to force the transition.

Key questions

Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?

A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.

Q: Why are regulators limiting SMS OTP instead of treating it as acceptable MFA?

A: Because SMS OTP proves access to a phone number, not durable possession of a secure authenticator. Regulators are reacting to SIM swap, phishing and adversary-in-the-middle abuse, which make the factor easy to capture or replay. The practical result is a move toward device-bound, phishing-resistant authentication for higher-risk banking actions.

Q: How should banks prioritise SMS OTP replacement across markets?

A: Start with the jurisdictions that have explicit bans, hard deadlines or liability shifts, then move to flows that authorise money movement, account changes and recovery. A global bank should not wait for a single enterprise standard, because the regulatory posture is already different by market and by transaction type.

Q: What is the difference between SMS OTP and phishing-resistant passkeys for authentication security?

A: SMS OTP relies on a code that can be intercepted, forwarded, or socially engineered from the user, so it still depends on user judgment under pressure. Phishing-resistant passkeys bind authentication to the legitimate site and device, which makes credential replay and fake-login interception much harder. For most organisations, that difference is decisive for reducing phishing success.

Technical breakdown

Why SMS OTP fails as a banking possession factor

SMS OTP depends on a phone number and a mobile network path that sit outside the bank's trust boundary. That creates exposure to SIM swap, SS7 interception, phishing, smishing and adversary-in-the-middle attacks, where the code can be captured before it reaches the real user or while it is being relayed. In practice, the problem is not the code length but the transport and the shared-secret model. Regulators are increasingly treating that architecture as too easy to intercept for higher-risk banking actions.

Practical implication: Treat SMS OTP as a legacy possession signal that may be acceptable only where local rules still permit it, not as a durable control basis.

How regulators are separating login from high-risk banking actions

The article shows that many regulators are not applying one universal rule. Singapore removed OTPs for login only for customers who activated a digital token, while Malaysia and the Philippines focus on high-risk actions such as transfers, account changes and opening activities. Vietnam adds biometrics above value thresholds, and India keeps OTP available while requiring stronger two-factor authentication choices. The control pattern is increasingly risk-based rather than channel-based: the more sensitive the action, the less acceptable an interceptable OTP becomes.

Practical implication: Map authentication controls to transaction risk, not just to user sign-in, so your policy matches the actual regulatory boundary.

Why device binding and phishing-resistant authentication are replacing shared secrets

The direction of travel is toward cryptographic, device-bound and phishing-resistant factors that are harder to intercept or replay than SMS OTP. In the article's framing, regulators want proof of identity to move off a shared secret sent over a channel the institution does not control and onto a factor that can survive SIM swap, porting and phishing pressure. This is not only a security shift. It is also a liability and assurance shift, because some regimes now hold institutions responsible when OTP-based fraud succeeds.

Practical implication: Prioritise device-bound and phishing-resistant methods where fraud liability or regulatory exposure makes SMS OTP untenable.

NHI Mgmt Group analysis

SMS OTP is no longer a control, it is a transitional liability. Once regulators begin shifting fraud responsibility back onto institutions, the authentication method itself becomes part of the risk register. That is especially true when the factor travels over a network the organisation does not own and cannot secure end to end. Practitioners should treat OTP retirement as a governance programme, not a feature swap.

Banking authentication is moving from channel trust to device trust. The common thread across the markets in this article is not a single regulatory model but a shared conclusion that the phone number is too unstable to anchor assurance. This aligns with phishing-resistant authentication patterns and with NIST's move to restrict SMS/PSTN OTP rather than pretend it remains equivalent to stronger authenticators. Identity teams need to re-baseline assurance around the device, not the message.

Risk-based authentication is replacing universal OTP policy. Some regimes ban SMS OTP outright, others narrow it to lower-risk flows, and others keep it available while tightening the surrounding factors. That means global banks cannot build one static control standard and assume it survives jurisdictional differences. The programme implication is clear: authentication architecture now has to be policy-aware by market, not just technically consistent.

SMS OTP exposes an identity blast radius problem. A single weak second factor can remain embedded across login, recovery and transaction flows long after teams think the migration is complete. The important question is not whether OTP exists somewhere in the estate, but where it still authorises high-value actions. Teams need a map of every flow that depends on interceptable delivery before they can claim governance over it.

Device-bound authentication is becoming the baseline assumption for regulated banking. The article's market set suggests the future control expectation is not simply stronger MFA, but a factor that is resistant to interception, replay and portability abuse. That shifts the practitioner burden from choosing an OTP replacement to proving the replacement fits both fraud and compliance requirements.

What this signals

SMS OTP is becoming a governance exception, not a default control. Global banking teams should assume that any remaining OTP dependency will need explicit justification by market, flow and risk tier. The migration work is now as much about policy ownership and exception management as it is about technology replacement.

Identity teams need a jurisdiction map, not a single MFA standard. The article shows a split between outright bans, flow-specific restrictions and principle-based tightening. That means architecture decisions must be paired with regulatory scoping, otherwise the control will be compliant in one market and obsolete in another.

For practitioners

• Inventory every SMS OTP dependency Identify where SMS OTP still protects login, step-up authentication, recovery, card payments and high-risk transactions, then rank each use by regulatory exposure and fraud consequence.
• Separate low-risk and high-risk flows Do not apply one authentication rule to every banking action. Create different requirements for login, account recovery, transfers, beneficiary changes and device enrolment.
• Move high-risk flows to phishing-resistant methods Replace SMS OTP first where the regulator has already narrowed or banned it, using device-bound or cryptographic methods for transfers and account changes.
• Align authentication policy to jurisdiction Maintain a market-by-market control matrix so local mandates, liability shifts and deadline-driven migrations are visible to product, risk and compliance owners.
• Test recovery paths as well as sign-in Review password reset, device replacement and account recovery workflows separately, because OTP often survives there long after it has been removed from primary login.

Key takeaways

• SMS OTP is being phased out or narrowed because regulators no longer trust it as a durable possession factor for banking.
• The strongest action is to map where OTP still authorises high-risk flows and remove it there first.
• Global authentication programmes now need market-specific policy, device-bound replacement methods and clear liability ownership.

Key terms

• SMS One-Time Passcode: An SMS one-time passcode is a short-lived code sent by text message and used to confirm a login, onboarding step, or transaction. It is easy to deploy, but it can be exposed to forwarding, SIM swap, interception, and phishing, which makes it weaker than stronger device or network based authentication methods.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Device binding: A control that links an authenticator or key pair to a specific endpoint so the same secret cannot be copied and reused elsewhere. It strengthens assurance, but the binding step itself becomes a high-value target if attackers can intercept the enrollment process.
• Payment liability shift: Payment liability shift is the transfer of financial responsibility for a fraudulent or disputed transaction away from one party and onto another. In ecommerce, it determines who absorbs the loss after an order is approved, making it a governance and risk-allocation control, not just a payments feature.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.