Should organisations replace passwords with OTPs everywhere?

Why This Matters for Security Teams

Replacing passwords with OTPs sounds like a simple upgrade, but security teams are really choosing between different assurance levels, failure modes, and operational burdens. OTPs can reduce password reuse and eliminate server-side password storage, yet they do not remove phishing risk, inbox compromise, SIM swap exposure, or device availability problems. That means the control may improve one part of the attack surface while leaving other paths open.

For organisations managing identities at scale, the broader issue is that authentication should match the risk of the action being protected, not just the convenience of the login flow. Guidance from the NIST Cybersecurity Framework 2.0 supports risk-based control selection, and NHI Mgmt Group’s research shows why that matters in practice: 79% of organisations have experienced secrets leaks, with 77% resulting in tangible damage, according to the Ultimate Guide to NHIs. In practice, many security teams discover OTP weaknesses only after phishing or account recovery abuse has already occurred, rather than through intentional design.

How It Works in Practice

OTP can be a useful step up from passwords in specific user journeys, but it is not a universal replacement. In practice, organisations should first identify the authentication purpose: low-risk consumer sign-in, workforce access, privileged admin access, or step-up verification for sensitive transactions. The right answer changes by context.

For example, OTP works reasonably well when the main objective is to reduce password reuse and simplify credential lifecycle management. It is weaker when the channel delivering the code is itself exposed. Email-based OTP depends on inbox security. SMS-based OTP depends on carrier controls and device possession. App-based OTP improves resilience, but it still does not prove that the user intended the action in a phishing-resistant way.

A practical decision model usually includes:

• Use OTP only where the acceptable assurance level is clear and documented.
• Avoid OTP as the sole factor for privileged access, administrative actions, or high-value transactions.
• Prefer phishing-resistant methods such as FIDO2 or passkeys when the risk justifies it.
• Apply step-up authentication for sensitive changes instead of forcing stronger auth everywhere.
• Map recovery flows separately, because account recovery often becomes the real weak point.

This aligns with the NIST view that authentication should be proportional to risk, not uniform across all users and actions. It also fits NHIMG’s broader guidance on identity hygiene and credential governance in the Ultimate Guide to NHIs, especially where secrets and access paths must be controlled throughout their lifecycle. These controls tend to break down when OTP is treated as a blanket password replacement across privileged workflows, because recovery, delivery, and phishing resistance become the limiting factors.

Common Variations and Edge Cases

Tighter authentication often increases friction, support load, and recovery complexity, so organisations have to balance usability against assurance. There is no universal standard for using OTP everywhere, and current guidance suggests that the decision should vary by threat model rather than policy preference.

One common edge case is workforce access to high-risk systems. OTP may still be acceptable as part of a layered control set, but it should not be the only protection for admin consoles, production access, or secret management platforms. Another edge case is customer-facing authentication in regions where SMS is the only realistic option. In those environments, OTP may be better than passwords alone, but it remains a compromise, not a best-in-class control.

Another frequent failure point is account recovery. If password reset or OTP reset flows are weaker than the login itself, attackers simply bypass the stronger control. The same applies to shared mailboxes, legacy phone numbers, and devices that are frequently replaced or reused. For that reason, password replacement strategies should be evaluated alongside lifecycle controls, not in isolation.

Security teams should also remember that authentication choice is different from identity governance. The Schneider Electric credentials breach is a useful reminder that identity compromise often spreads through weak control boundaries, not a single login weakness. In short, OTP can be part of the solution, but it is rarely the right answer everywhere.

Related resources from NHI Mgmt Group

• Should organisations replace passwords everywhere with passkeys immediately?
• Should organisations replace passwords with biometrics everywhere?
• What breaks when organisations rely on passwords and OTPs for high-risk access?
• Should regulated environments keep OTPs after adopting passkeys?