SMS OTP is failing consumer identity assurance in modern MFA

At a glance

What this is: This is a Prove Identity blog post arguing that SMS OTP and other legacy MFA patterns no longer provide adequate consumer identity assurance because fraud now exploits the gaps between one-time checks.

Why it matters: It matters because consumer IAM teams still balancing security and conversion need to treat authentication as an ongoing assurance problem, not a single-step challenge problem.

Context

Consumer identity assurance is the confidence that the person returning to an account is still the same person who enrolled, even as devices, sessions, and channels change. The article argues that SMS OTPs were designed for a simpler threat model and now fail against fraud techniques that adapt across channels and session boundaries.

The governance gap is not limited to authentication strength. It also includes lifecycle continuity, device change handling, and fraud-aware step-up decisions, all of which sit at the intersection of consumer IAM and identity fraud prevention. In that model, static codes create friction without maintaining durable trust.

The article’s framing is typical for consumer-facing identity programmes that have outgrown password-plus-code security and now need stronger assurance signals.

Key questions

Q: Why do SMS OTPs fail as a primary consumer authentication method?

A: SMS OTPs fail because they verify message delivery at a moment in time, not durable identity assurance. Attackers can intercept, redirect, or socially engineer the code, and the user’s account may still be taken over after the code is accepted. Consumer IAM needs stronger binding to device, possession, and session context.

Q: When should organisations move from one-time MFA checks to continuous assurance?

A: They should move when account value, fraud exposure, or channel switching makes single-step authentication too easy to bypass. Continuous assurance is most useful when users change devices, numbers, or networks and when attackers can exploit recovery or re-binding flows. It reduces the gap between authentication and misuse.

Q: What are the signs that legacy MFA is no longer protecting consumer accounts?

A: Common signs include rising account takeover, repeated SIM swap abuse, recovery abuse, and users who can pass MFA but still lose accounts shortly after login. Another signal is high friction without a corresponding drop in fraud. That combination shows the control is inconveniencing users more than it is protecting them.

Q: How should teams compare passkeys and SMS OTP in consumer IAM?

A: Passkeys reduce phishing exposure, but they do not replace identity governance around enrollment, recovery, and device re-binding. SMS OTP is weaker at the channel level, while passkeys can still leave blind spots if the surrounding process is abused. The right comparison is lifecycle assurance, not just factor strength.

Technical breakdown

Why SMS OTP lacks durable assurance

SMS OTP is a one-time shared-secret workflow delivered over a channel that was never designed to provide end-to-end confidentiality or strong binding to a user session. The code verifies possession of a message path at a point in time, but it does not prove durable account ownership, device continuity, or resistance to interception and redirection. That makes it weak against phishing, SIM swap, and replay-adjacent abuse. In practice, the control checks a moment, not a relationship. For consumer identity, that distinction matters because fraud often lands after the code is accepted, not before it is sent.

Practical implication: Treat SMS OTP as a legacy fallback signal, not as the primary control for consumer identity assurance.

Why passkey-only deployments can still leave blind spots

Passkeys improve phishing resistance, but they do not automatically eliminate fraud if the surrounding identity workflow still allows account binding abuse, social engineering, or poor recovery logic. The article’s example shows that a legitimate-looking passkey event can still be manipulated when attackers trick users into approving or creating a synchronized credential under fraudulent conditions. That is an identity governance problem, not a protocol problem. Strong authentication can still fail when the programme assumes the credential alone is enough to establish trust. Consumer IAM needs to evaluate the full enrollment, recovery, and re-binding path, not just the login ceremony.

Practical implication: Review passkey rollout together with enrollment and recovery flows, because authentication strength is only part of the assurance model.

What continuous identity assurance changes in consumer IAM

Continuous identity assurance shifts the control point from a single authentication event to an ongoing evaluation of signals such as device continuity, possession checks, and fraud context across the session lifecycle. That is the right response to modern consumer attacks because the user’s trust state changes when phones, numbers, carriers, and channels change. Static MFA treats those changes as exceptions; continuous assurance treats them as expected events that must be re-validated. In consumer IAM, this is the difference between proving access once and preserving trust as conditions evolve.

Practical implication: Design consumer access flows to re-evaluate trust when device, channel, or risk context changes rather than waiting for a fresh login.

Threat narrative

Attacker objective: The attacker wants to obtain account access that looks legitimate long enough to steal value, redirect activity, or establish persistent control.

1. Entry occurs when an attacker uses phishing, SIM swap, or other channel manipulation to intercept or influence the one-time authentication flow.
2. Credential access happens when the SMS OTP or synchronized credential is accepted as proof of identity despite weak binding to the real user.
3. Impact follows when the attacker uses that temporary trust to take over the consumer account or complete fraudulent activity before the challenge is re-evaluated.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS OTP has become a control for channel access, not identity assurance. The article correctly shows that one-time codes can be intercepted, redirected, or socially engineered. That means the control now measures delivery of a message, not trust in the claimant. For consumer IAM, the implication is that assurance must move beyond the code itself and toward persistent proof of the returning user.

Legacy MFA fails when it assumes identity is stable between challenges. That assumption was workable when sessions were shorter, fraud was cruder, and recovery paths were simpler. Modern account takeover breaks that premise because the attacker often waits for the code, then acts after the code succeeds. The implication is that consumer identity governance must treat authentication as a lifecycle, not an event.

Continuous assurance is the right governance model for consumer identity risk. The article’s strongest point is not that SMS is weak, but that static, one-time checks cannot keep up with changing devices, channels, and fraud conditions. Persistent trust requires the programme to validate possession, context, and re-binding conditions over time. Practitioners should read this as a governance shift, not a feature request.

Cross-channel recognition will matter more than single-factor strength. Consumer programmes increasingly fail at the seams between onboarding, device change, and returning-session recognition. A stronger factor that only works in one moment still leaves the rest of the lifecycle exposed. The implication is that IAM teams should judge authentication by how well it preserves assurance across journeys, not by how hard a single login prompt is to bypass.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Consumer identity assurance now has to be measured across the whole journey. If a programme only evaluates login success, it misses the real attack surface: onboarding, device change, recovery, and session continuity. That is where fraud adapts, and that is where governance needs to move.

Legacy MFA creates a false sense of closure. A code accepted once does not mean trust is preserved for the rest of the session. Consumer IAM teams should treat authentication as an ongoing assurance state that can be lost as conditions change.

For practitioners

• Retire SMS OTP from primary assurance paths Keep SMS codes only as fallback recovery or low-risk step-up signals, and remove them from flows where account takeover would cause material harm.
• Re-map authentication to lifecycle events Trigger stronger identity checks when a user changes device, number, carrier, or channel so that trust is re-established at the moment risk changes.
• Test recovery paths against fraud Review account recovery, device re-binding, and passkey enrollment for SIM swap, phishing, and social-engineering abuse before expanding deployment.
• Use continuous risk signals in step-up policy Combine possession checks, device recognition, and anomaly scoring so step-up is driven by current context rather than by a fixed login rule.

Key takeaways

• SMS OTP is no longer a dependable primary assurance method for consumer identity because it can be intercepted, redirected, or bypassed through fraud on adjacent channels.
• The article’s central evidence is that one-time checks can still support account takeover when recovery, device change, or passkey enrolment flows are weak.
• Consumer IAM teams should shift from static MFA thinking to continuous assurance that re-evaluates trust when user context changes.

Key terms

• Customer identity assurance: Customer identity assurance is the confidence a business has that a digital customer is real, reachable, and behaving within expected bounds. It combines proofing, authentication, behavioural context, and recovery controls so the programme can reduce fraud without treating every user as suspicious.
• Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
• Continuous authentication: A model where access is re-evaluated after the initial login instead of being trusted for the full session. It uses live signals such as posture, telemetry, and policy to detect when a session should be stepped up, constrained, or revoked.
• Passkey Synchronization Risk: Passkey synchronization risk is the chance that a legitimate-looking synced credential is created or approved under fraudulent conditions. It matters because stronger cryptography does not eliminate social engineering, recovery abuse, or weak enrollment controls around the credential lifecycle.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.