Topic starter
11/07/2026 8:43 pm
TL;DR: AI has cut the cost of phishing, voice cloning, deepfake documents, and real-time relay attacks to near zero, making knowledge-based authentication and SMS OTP increasingly unreliable, according to IDlayr. Possession-based, device or network-verified controls now matter because they remove the human from the authentication step and reduce AI’s ability to social-engineer access.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “L'intelligenza artificiale ha cambiato le regole delle frodi: è ora di ripensare l'identità digitale”.
By the numbers:
- Phishing volumes increased 400% in early 2025, according to IDlayr.
- The entire SMS OTP relay flow can take under 90 seconds, according to IDlayr.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Q: Why do possession factors resist AI fraud better than passwords or voice checks?
A: Possession factors rely on a physical object the attacker cannot remotely fabricate, such as a device or SIM.
Q: How should teams redesign account recovery for deepfake and voice-cloning risk?
A: They should remove recovery paths that depend on human recognition of a caller, spoken answers or a one-time code alone.
Practitioner guidance
- Replace SMS OTP on high-risk journeys Prioritise login, recovery and payment flows where the code can be relayed or socially engineered, then remove SMS as the default step-up option.
- Bind authentication to device possession Use device-bound or carrier-verified checks for actions that need phishing resistance, especially where the user should not have to read or enter a code.
- Reduce human-mediated recovery paths Review help desk, account recovery and SIM-change processes so they do not depend on a caller, a code or a voice check that AI can imitate.
Bottom line: AI-driven fraud is now strong enough to break authentication designs that depend on users spotting deception in time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:12 pm
AI fraud is not just accelerating old attacks, it is collapsing the assumptions behind knowledge-based identity. Passwords, PINs, OTPs and security questions were designed for a world where humans had time to judge legitimacy and attackers could not cheaply impersonate tone, language or context. That assumption no longer holds when AI can scale convincing deception and replay it in real time. The implication is that identity programmes must stop treating user knowledge as a stable trust layer.
A question worth separating out:
Q: When is SMS OTP still acceptable, and when should it be retired?
A: It may still be tolerable for low-risk, low-impact interactions, but it should be retired where account takeover, payment fraud or recovery abuse would matter. If the attacker can impersonate the user, relay the code, or pressure support staff, SMS OTP is no longer a dependable control for that journey.
👉 Read our full editorial: AI fraud is breaking legacy identity controls and SMS OTP