Topic starter
10/07/2026 9:08 pm
TL;DR: Regulators in the UAE, Singapore, Malaysia, the Philippines, India, the EU, the United States, Vietnam, and Saudi Arabia are moving banking away from SMS one-time passwords toward phishing-resistant, device-bound authentication, according to IDlayr. The practical consequence is that identity teams must plan for jurisdiction-specific decommissioning of interceptable factors, not treat SMS OTP as a stable second factor.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “The Global SMS OTP Ban: A Regulator-by-Regulator Guide”.
Key questions
Q: How should security teams reduce risk from SMS OTP fraud in mobile banking?
A: Security teams should move high-risk transactions away from SMS OTP and toward phishing-resistant authentication such as passkeys, biometrics, or device-bound methods.
Q: Why does SMS OTP create more risk than many teams assume?
A: Because the trust boundary sits in the telecom and messaging path, not in the user’s device alone.
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Practitioner guidance
- Inventory SMS OTP by banking flow Separate login, transaction approval, account change and recovery use cases, then mark where SMS OTP is still acting as a primary control versus a legacy fallback.
- Build a jurisdiction-by-jurisdiction retirement plan Map each regulated market to its effective deadline, permitted use cases and liability posture, then sequence migration by the strictest constraints first.
- Prioritise device-bound replacement factors Select methods that bind approval to a registered device or hardware-backed proof, and test them against SIM swap, porting and phishing scenarios.
Bottom line: SMS OTP is being pushed out of banking because regulators no longer view a texted code as a reliable possession factor in high-risk flows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
SMS OTP is no longer a stable second factor for regulated banking. The article shows a market-wide shift away from a shared secret delivered over an uncontrolled channel and toward factors that are harder to intercept. That is not a cosmetic change in authentication UX. It is a reclassification of what regulators will accept as sufficient assurance for banking access and transaction approval. For IAM leaders, the practical conclusion is that SMS OTP should be treated as an exit path, not a long-term control anchor.
A question worth separating out:
Q: How should IAM teams handle differences between global SMS OTP rules?
A: They should treat SMS OTP as a market-specific control, not a global standard. The practical answer is to build country-by-country policy logic, align each flow to local regulatory treatment and retire the factor where a jurisdiction has narrowed or banned it.
👉 Read our full editorial: SMS OTP restrictions are tightening across global banking