Topic starter
10/07/2026 9:08 pm
TL;DR: Regulators in the UAE, Singapore, Malaysia, the Philippines, India, the EU, the United States, Vietnam and Saudi Arabia are moving banking away from SMS OTP, but with different mandates, deadlines and liability shifts, according to IDlayr. The security issue is no longer whether SMS OTP is convenient, but whether organisations can still rely on a channel they do not control.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “The Global SMS OTP Ban: A Regulator-by-Regulator Guide”.
By the numbers:
- More than 25 regulators worldwide have now moved toward phishing-resistant authentication.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Q: Why are regulators limiting SMS OTP instead of treating it as acceptable MFA?
A: Because SMS OTP proves access to a phone number, not durable possession of a secure authenticator.
Q: How should banks prioritise SMS OTP replacement across markets?
A: Start with the jurisdictions that have explicit bans, hard deadlines or liability shifts, then move to flows that authorise money movement, account changes and recovery.
Practitioner guidance
- Inventory every SMS OTP dependency Identify where SMS OTP still protects login, step-up authentication, recovery, card payments and high-risk transactions, then rank each use by regulatory exposure and fraud consequence.
- Separate low-risk and high-risk flows Do not apply one authentication rule to every banking action.
- Move high-risk flows to phishing-resistant methods Replace SMS OTP first where the regulator has already narrowed or banned it, using device-bound or cryptographic methods for transfers and account changes.
Bottom line: SMS OTP is being phased out or narrowed because regulators no longer trust it as a durable possession factor for banking.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:31 pm
SMS OTP is no longer a control, it is a transitional liability. Once regulators begin shifting fraud responsibility back onto institutions, the authentication method itself becomes part of the risk register. That is especially true when the factor travels over a network the organisation does not own and cannot secure end to end. Practitioners should treat OTP retirement as a governance programme, not a feature swap.
A question worth separating out:
Q: What is the difference between SMS OTP and phishing-resistant passkeys for authentication security?
A: SMS OTP relies on a code that can be intercepted, forwarded, or socially engineered from the user, so it still depends on user judgment under pressure. Phishing-resistant passkeys bind authentication to the legitimate site and device, which makes credential replay and fake-login interception much harder. For most organisations, that difference is decisive for reducing phishing success.
👉 Read our full editorial: SMS OTP bans are reshaping banking authentication worldwide