TL;DR: Regulators in the UAE, Singapore, Malaysia, the Philippines, India, the EU, the United States, Vietnam, and Saudi Arabia are moving banking away from SMS one-time passwords toward phishing-resistant, device-bound authentication, according to IDlayr. The practical consequence is that identity teams must plan for jurisdiction-specific decommissioning of interceptable factors, not treat SMS OTP as a stable second factor.
At a glance
What this is: This is a regulator-by-regulator briefing on how banking markets are restricting SMS OTP, with the strongest moves targeting high-risk flows, login, or full phase-out.
Why it matters: It matters because IAM, IGA and fraud teams have to replace a familiar second factor with controls that survive SIM swap, phishing and jurisdiction-specific compliance deadlines.
Context
SMS one-time passwords are a human-facing authentication control that still depends on a shared secret delivered over a telecom channel. In banking, that model is under pressure because the channel is outside the bank's control and is routinely targeted through SIM swap, port-out fraud, smishing and adversary-in-the-middle attacks.
The governance problem is not just technical weakness, but regulatory divergence. Some jurisdictions are banning SMS OTP outright for financial use, while others are narrowing it to lower-risk or non-authorising uses, which means identity teams need market-by-market policy, not a single global rollout assumption.
Key questions
Q: How should security teams reduce risk from SMS OTP fraud in mobile banking?
A: Security teams should move high-risk transactions away from SMS OTP and toward phishing-resistant authentication such as passkeys, biometrics, or device-bound methods. They should also add device intelligence so that a valid OTP is not the only signal used to decide trust. If the device is unknown, tampered with, or behaving inconsistently, step-up should apply before the session is accepted.
Q: Why does SMS OTP create more risk than many teams assume?
A: Because the trust boundary sits in the telecom and messaging path, not in the user’s device alone. Phishing relay, SIM swap, port-out fraud, recycled numbers, and SS7 interception can all break the model without stealing the user’s password. For regulated journeys, that makes SMS OTP a weak assurance factor rather than a stable control.
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.
Q: How should IAM teams handle differences between global SMS OTP rules?
A: They should treat SMS OTP as a market-specific control, not a global standard. The practical answer is to build country-by-country policy logic, align each flow to local regulatory treatment and retire the factor where a jurisdiction has narrowed or banned it.
Technical breakdown
Why SMS OTP breaks as a possession factor in banking
SMS OTP only appears to prove possession because the code reaches a device the user holds. In practice, the factor is mediated by a telecom path that can be rerouted, duplicated or socially engineered, so it is not device-bound and not inherently phishing resistant. Regulators are responding to the gap between the intended assurance level and the actual attack surface. For IAM teams, the issue is not whether the code is convenient, but whether it still qualifies as a trustworthy possession factor for regulated transactions.
Practical implication: Treat SMS OTP as a legacy factor with shrinking assurance value, especially for high-risk banking actions.
How regulatory scope differs between login, transaction and account-change controls
The article shows that bans are rarely uniform. Singapore removed OTP from login for digital-token users, Malaysia and the Philippines target high-risk activities and critical account changes, Vietnam overlays biometrics on higher-value transfers, and India still allows SMS OTP while mandating stronger 2FA. That difference matters because the control objective changes by flow: authentication for access, authorisation for transactions, and step-up for sensitive lifecycle events are not interchangeable. Institutions that collapse them into one control standard will misread compliance scope.
Practical implication: Map each authentication factor to the specific banking flow it is allowed to protect and retire it where the regulator narrows that scope.
Device binding and phishing-resistant authentication replace shared-secret delivery
The replacement pattern is consistent across markets: move away from a shared secret sent over a channel the institution does not control, and toward cryptographic, device-bound or biometric methods that resist interception and replay. That does not automatically mean one product category is enough. It means the assurance must come from binding the factor to a registered device or a hardware-backed or app-based proof that cannot be phished through a text message relay. The architectural question is whether the bank can prove the user is on the expected device at the moment of approval.
Practical implication: Prioritise authentication methods that bind approval to a known device and do not depend on a retrievable text message.
Threat narrative
Attacker objective: The attacker wants to defeat step-up authentication and use the bank's own OTP dependency to approve fraudulent access or transactions.
- Entry begins when an attacker diverts or intercepts the SMS channel through SIM swap, port-out abuse, phishing or a smishing flow that captures the one-time code.
- Credential access occurs when the attacker uses the stolen OTP to satisfy the second factor and complete login or authorise a protected action.
- Impact follows when the attacker performs account takeover, payment fraud or sensitive account changes before the victim or bank can intervene.
Breaches seen in the wild
- Dropbox GitHub breach 2022: Phishing posing as CircleCI gave an attacker Dropbox staff GitHub access; 130 repositories with developer API keys were copied. Keys were rotated.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SMS OTP is no longer a stable second factor for regulated banking. The article shows a market-wide shift away from a shared secret delivered over an uncontrolled channel and toward factors that are harder to intercept. That is not a cosmetic change in authentication UX. It is a reclassification of what regulators will accept as sufficient assurance for banking access and transaction approval. For IAM leaders, the practical conclusion is that SMS OTP should be treated as an exit path, not a long-term control anchor.
Jurisdiction-specific decommissioning is now the real governance problem. Some markets have banned SMS OTP for financial use, others have narrowed it to login, high-risk transactions or non-authorising checks, and others still permit it under tighter conditions. That means global identity programmes need policy routing by market, use case and risk tier. A single enterprise standard for MFA is no longer enough when regulatory treatment varies by transaction type and country.
Shared-secret delivery has become the wrong design assumption. SMS OTP was built on the assumption that a code delivered to a phone is a reliable proxy for possession. That assumption fails when the delivery path can be intercepted, rerouted or socially engineered, and when regulators increasingly prefer device-bound or biometric proof instead. Device-bound authentication is now the more durable concept because it shifts assurance from channel delivery to registered-device proof.
Authentication governance is moving from factor availability to factor admissibility. Banking teams are no longer deciding only which factors are technically possible, but which ones regulators will still tolerate in specific flows. That changes IAM roadmaps, fraud controls and customer migration sequencing at the same time. The implication is that policy, product architecture and customer comms must be planned as one governance stream, not three separate projects.
What this signals
Regulatory admissibility is becoming the deciding factor: banking programmes now need to know not only whether SMS OTP works, but whether it is still allowed in a given flow and jurisdiction. That changes the IAM roadmap from universal MFA selection to policy-driven factor retirement.
Banks should expect migration pressure to land unevenly across login, transaction approval and account lifecycle events. The right control is no longer a single second factor for every use case, but a governed step-up model that can absorb market-specific restrictions without breaking customer journeys.
For practitioners
- Inventory SMS OTP by banking flow Separate login, transaction approval, account change and recovery use cases, then mark where SMS OTP is still acting as a primary control versus a legacy fallback.
- Build a jurisdiction-by-jurisdiction retirement plan Map each regulated market to its effective deadline, permitted use cases and liability posture, then sequence migration by the strictest constraints first.
- Prioritise device-bound replacement factors Select methods that bind approval to a registered device or hardware-backed proof, and test them against SIM swap, porting and phishing scenarios.
- Rewrite customer journeys for step-up authentication Rework login and transaction flows so customers understand why a factor is being replaced and what they must have enrolled before the cutoff.
- Separate authentication policy from fraud policy Ensure fraud teams, IAM architects and regional compliance owners share a common control map, so one market's rule change does not break another market's login flow.
Key takeaways
- SMS OTP is being pushed out of banking because regulators no longer view a texted code as a reliable possession factor in high-risk flows.
- The article shows a split market response, from outright bans to narrower restrictions on login, transactions or account changes.
- IAM teams need jurisdiction-aware retirement plans and device-bound replacements, or they will keep a weak factor alive where it is no longer admissible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS OTP is treated as insecure because it is interceptable and not device-bound. |
| NHI-10 — Human Use of NHI | The article focuses on a human-facing factor used to approve banking actions through a non-human channel. | |
| Recommendation — Replace interceptable OTP flows with authentication methods that resist phishing, SIM swap and replay. Separate human login journeys from machine or channel-mediated approval paths when evaluating assurance. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article tracks how SMS OTP is treated under digital identity authentication guidance. |
| Recommendation — Use SP 800-63B authentication guidance to retire restricted factors where assurance no longer matches risk. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Authentication choices directly affect who can approve access and financial actions. |
| Recommendation — Align authorisation steps to authentication strength so high-risk transactions do not rely on weak factors. | ||
| MITRE ATT&CK | TA0006;TA0001 — Credential Access; Initial Access | The article names phishing, smishing and SIM swap as ways to obtain OTP codes. |
| Recommendation — Map OTP interception scenarios to credential-access and initial-access tactics in your fraud detection model. | ||
Key terms
- SMS One-Time Passcode: An SMS one-time passcode is a short-lived code sent by text message and used to confirm a login, onboarding step, or transaction. It is easy to deploy, but it can be exposed to forwarding, SIM swap, interception, and phishing, which makes it weaker than stronger device or network based authentication methods.
- Device-bound authentication: Authentication that only works on a specific device or trusted local context. It reduces replay risk because the secret is not useful from elsewhere, which is materially different from centrally stored credentials that can be stolen and reused remotely.
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Step-up Authentication: Step-up authentication is an additional verification step triggered when a session becomes higher risk or a user attempts a sensitive action. It is used to reduce exposure without forcing extra friction across every interaction, which makes it useful for runtime access governance.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org