Notifications
Clear all
Topic starter
11/07/2026 8:36 pm
TL;DR: Account takeover fraud remains a major consumer and enterprise risk because attackers can exploit SIM swaps, call forwarding, and device changes to intercept one-time passwords, according to Prove Identity. The underlying issue is that OTP delivery still assumes the receiving phone number is trustworthy at decision time, which is no longer a safe assumption.
NHIMG editorial — based on content published by Prove Identity: How to Fight Account Takeover Fraud with Trust Score+™
By the numbers:
- In 2022 alone, account takeovers hit 22% of US adults and represented nearly $288 billion in fraud.
- ATOs hit 22% of US adults and represented nearly $288 billion in fraud.
- Trust Score+ leverages phone number signals from the core telephony infrastructure, proprietary data sources, and Prove's 15+ years of phone data.
Questions worth separating out
Q: How should security teams reduce account takeover risk in OTP-based login flows?
A: Security teams should stop treating OTP delivery as proof that the right person is present.
Q: Why do SIM swaps and call forwarding increase account takeover risk?
A: Because they attack the delivery channel, not just the password.
Q: What do fraud teams get wrong about one-time passwords?
A: They often assume the OTP is the control, when the real control is the integrity of the path that delivers it.
Practitioner guidance
- Score phone trust at the moment of use Bind carrier and device signals to password resets, account recovery, and payment events so the decision reflects current telephony state rather than enrollment history.
- Treat SIM and call-forwarding changes as risk inputs Combine SIM velocity, SIM tenure, device swap history, and call-forwarding status into one decisioning model so telephony manipulation is visible before OTP delivery succeeds.
- Separate recovery policy from default authentication Use stronger checks for recovery and number-change workflows than for routine sign-in, because attackers often wait for the moment when the account can be re-bound.
What's in the full article
Prove Identity's full blog covers the operational detail this post intentionally leaves for the source:
- A detailed breakdown of SIM swap, call forwarding, and device swap scenarios that can defeat SMS or voice OTPs.
- The specific trust indicators Prove says its phone-number scoring uses, including SIM tenure and change velocity.
- Examples of high-risk events where transaction-level phone intelligence is applied, such as money movement and password changes.
- The vendor's implementation framing for combining carrier data with decisioning protocols in live fraud flows.
👉 Read Prove Identity's analysis of how Trust Score+ addresses account takeover fraud →
Account takeover fraud and OTP trust signals: what should teams change?
Explore further
11/07/2026 9:05 pm
OTP trust debt: SMS and voice-based one-time passwords create a false sense of assurance because the factor is treated as proof of presence when it is really proof of channel access. Once telephony routing can be altered, the authentication control is no longer anchored to the user. The practical conclusion is that organisations must stop treating phone delivery as a stable identity assertion.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why unmanaged identity paths persist across both machine and human-facing flows.
A question worth separating out:
Q: Who should own account takeover detection when phone signals are involved?
A: Ownership should be shared between IAM and fraud operations because the same event affects authentication assurance, recovery policy, and financial risk. A common decision path helps avoid siloed responses where one team approves access while another team sees the same number as compromised.
👉 Read our full editorial: SMS-based account takeover risk is still outpacing OTP trust
