Topic starter
10/07/2026 9:12 pm
TL;DR: Banks are moving SMS OTP out of high-risk authentication across APAC and the Gulf, but the harder operational gap is onboarding, where phone verification, device binding, and recovery still need a stronger control path than a texted code, according to Authsignal. The migration is really about sequencing verification, passkey issuance, and fallback handling without breaking conversion or compliance.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Eliminating SMS OTP starts at onboarding”.
Key questions
Q: How should security teams replace SMS OTP in customer onboarding?
A: Security teams should replace SMS OTP in onboarding by separating phone verification from authentication.
Q: Why does SMS OTP create more risk than many teams assume?
A: Because the trust boundary sits in the telecom and messaging path, not in the user’s device alone.
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Practitioner guidance
- Map every SMS dependency in the customer journey Separate phone verification, login, transaction approval, device binding, and recovery into distinct flows so each can be replaced on its own timetable.
- Replace onboarding SMS with carrier-based checks where possible Use silent network authentication or number verification APIs as the primary path for confirming number control before account creation completes.
- Define fallback routing before the first OTP is removed Set rules for Wi-Fi, roaming, desktop, or low-coverage cases so the journey can move to a stronger alternative without reverting to SMS by habit.
Bottom line: The article shows that SMS OTP removal is an onboarding and lifecycle problem, not just a login or step-up problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:36 pm
Onboarding is now the control point that determines whether SMS OTP can be retired. The article is right to separate login from onboarding because the first moment of customer verification now carries the largest design burden. Regulators have narrowed the acceptable use of SMS OTP, but they have not eliminated the need to prove phone control and user presence at account creation. The implication is that authentication modernisation is really a front-door governance problem, not a single-factor replacement decision.
A question worth separating out:
Q: How should teams decide between carrier verification, WhatsApp OTP, and passkeys?
A: Use carrier verification as the primary number check where network conditions allow it, treat stronger messaging-app fallback as a contingency, and issue passkeys only after the customer has been anchored with liveness and identity proofing. The decision is sequential, not either-or.
👉 Read our full editorial: Eliminating SMS OTP starts at onboarding