Topic starter
10/07/2026 9:09 pm
TL;DR: Regulators in more than 25 markets are moving banks away from SMS one-time passwords because shared, interceptable codes cannot withstand SIM swap, phishing, and device-linked fraud, according to IDlayr’s regulator-by-regulator guide. The shift makes phishing-resistant authentication, not OTP tuning, the new baseline for banking identity assurance.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “The Global SMS OTP Ban: A Regulator-by-Regulator Guide”.
By the numbers:
- More than 25 regulators worldwide have now moved toward phishing-resistant authentication.
Key questions
Q: How should banks replace SMS OTP for high-risk transactions?
A: Banks should move high-risk actions to step-up authentication that is bound to the transaction, not the login.
Q: Why do SMS OTPs create higher fraud and recovery risk than device-bound authentication?
A: SMS OTPs only prove control of a phone number, and that signal is easier to spoof, intercept, or divert than a cryptographic credential tied to a device.
Q: Where do SMS OTP controls fail in practice for banking programmes?
A: They fail in high-risk flows where the attacker can intercept, replay, or socially engineer the code before it is consumed.
Practitioner guidance
- Map every banking flow by regulatory status Classify login, transfer, card, and account-change journeys by jurisdiction and identify where SMS OTP is banned, restricted, or still permitted as part of MFA.
- Prioritise phishing-resistant replacements for high-risk journeys Move high-risk transactions and account changes to device-bound approvals, passkeys, biometrics, or other authenticators that do not rely on a text message.
- Separate mobile-number confirmation from transaction authorisation Where a regulator still allows SMS OTP, limit it to confirming control of a registered number and remove it from approval of payments or profile changes.
Bottom line: SMS OTP is losing its place as a dependable banking factor because regulators now view interceptable codes as too weak for many customer journeys.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
SMS OTP is no longer a stable banking identity assumption: The industry spent years treating a texted code as a reasonable second factor because the delivery channel looked familiar and low-friction. That assumption fails once SIM swap, SS7 abuse, phishing, and adversary-in-the-middle attacks are part of the threat model. The implication is that banking assurance has to move from shared secrets to stronger possession binding.
A question worth separating out:
Q: How should IAM teams decide when phishing-resistant authentication is needed?
A: Use phishing-resistant methods wherever account compromise would create material business or operational impact, especially for remote access, privileged users, and high-value applications. If a login path can unlock lateral movement, administrative action, or sensitive data, it deserves stronger authentication than phishable MFA.
👉 Read our full editorial: SMS OTP bans are forcing a reset in banking authentication