Topic starter
11/07/2026 8:35 pm
TL;DR: India and the UAE are moving away from SMS OTP as a primary authentication method, with India mandating two-factor transaction checks from April 2026 and the UAE requiring a full phase-out by March 2026, according to Authsignal. The shift reflects a broader move toward phishing-resistant authentication that reduces interception and SIM-swap exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “India and the UAE are phasing out SMS OTP”.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Q: Why do SIM swaps make SMS OTP a poor choice for financial authentication?
A: A SIM swap moves the victim’s number onto a device the attacker controls, which means OTPs arrive on the wrong handset.
Q: How should banks implement phishing-resistant authentication without breaking recovery flows?
A: Banks should remove passwords from the primary path and then harden enrollment, reset, and recovery with the same assurance level.
Practitioner guidance
- Prioritise device-bound authentication for high-risk journeys Move payment approval, admin access, and recovery flows toward passkeys, app-based approval, or hardware-backed factors that do not rely on SMS delivery.
- Add transaction-specific verification steps Require a dynamic factor tied to the exact transaction, then reject reusable approval patterns that can satisfy multiple actions.
- Use risk-based step-up signals Incorporate device, location, and behavioural signals so anomalous activity triggers stronger verification before completion.
Bottom line: SMS OTP is being phased out because it cannot provide reliable assurance against interception, SIM swaps, or message spoofing in regulated financial flows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:04 pm
SMS OTP exposes a channel trust problem, not just a factor choice problem: The issue is not that one-time passwords are inherently obsolete, but that they are delivered through a channel attackers can divert, spoof, or intercept. Once the trust anchor sits outside the authenticated app session, the control is vulnerable to telecom-layer compromise. Practitioners should read this as a signal that authentication assurance must move closer to the device and transaction boundary.
A question worth separating out:
Q: What is the difference between SMS OTP and phishing-resistant passkeys for authentication security?
A: SMS OTP relies on a code that can be intercepted, forwarded, or socially engineered from the user, so it still depends on user judgment under pressure. Phishing-resistant passkeys bind authentication to the legitimate site and device, which makes credential replay and fake-login interception much harder. For most organisations, that difference is decisive for reducing phishing success.
👉 Read our full editorial: India and the UAE are phasing out SMS OTP for auth