Topic starter
11/08/2026 3:16 pm
TL;DR: Hong Kong’s Securities and Futures Commission now requires brokers and virtual asset platforms to stop using OTPs for client login and device binding, citing large-scale phishing and real-time relay attacks that bypass code delivery, according to Authsignal. The shift makes phishing-resistant authentication and recovery design the real control surface for IAM teams.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Hong Kong's SFC has told brokers and crypto platforms to drop OTP login”.
By the numbers:
- Phishing accounted for 57% of the total incidents HKCERT logged in 2025.
Key questions
Q: What breaks when OTP authentication can be replayed or reused during a phishing attack?
A: When an OTP can be replayed, a phisher can capture a legitimate authentication attempt and reuse it before the token expires.
Q: Why do OTP-based device binding flows create account takeover risk?
A: Device binding becomes risky when the first trusted device is registered with a phishable factor, because the attacker can install their own hardware as the trusted endpoint.
Q: How should brokers design recovery when passkeys replace SMS OTP?
A: Recovery should be treated as a separate high-assurance identity path, not a convenience fallback.
Practitioner guidance
- Replace OTPs in login flows Remove one-time passwords from customer login paths in regulated access journeys and move to phishing-resistant methods that bind authentication to the legitimate domain.
- Rebuild device binding around stronger verification Require an existing passkey, a live identity check, or an equivalent strong method before a new device becomes trusted, and treat device replacement as a high-risk event.
- Eliminate SMS fallback from recovery Audit every recovery route, including lost-device flows and customer-service reset paths, so an attacker cannot pivot from passkey adoption back to OTP-based trust.
Bottom line: OTP is no longer a reliable security boundary for regulated customer login when phishing kits can relay codes in real time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:29 pm
OTP login is no longer a durable trust mechanism for regulated customer access: The SFC’s intervention shows that code delivery has outlived its security value in phishing-heavy environments. Once an attacker can proxy a session in real time, the OTP proves only that a code was received, not that the legitimate client reached the legitimate site. For IAM teams, the control question has moved from delivery reliability to phishing resistance at the point of authentication.
A question worth separating out:
Q: Who should own authentication risk when regulators ban OTP login?
A: Ownership should sit with senior management, security, and IT together, because authentication is now a regulated control chain that affects client losses directly. The practical question is not who administers the product, but who is accountable for login, binding, recovery, and monitoring working as one governed process.
👉 Read our full editorial: Hong Kong SFC’s OTP ban shifts login risk to phishing-resistant auth