Because OTP proves a code was received, not that the user reached the legitimate site. A phisher can capture the code on a fake page and relay it to the real platform before it expires. That makes OTP vulnerable to proxy attacks even when delivery and expiry settings look reasonable.
Why This Matters for Security Teams
OTP flows remain common because they are easy to deploy, but in regulated financial services they create a false sense of step-up assurance. The code is a delivery check, not a possession proof tied to a legitimate session or trustworthy channel. That is why proxy phishing and real-time relay kits work: the attacker simply forwards the OTP to the genuine login sequence before expiry. Guidance from NIST SP 800-63 Digital Identity Guidelines continues to distinguish stronger authenticators from knowledge factors that are easy to intercept or replay.
For banks, insurers, trading platforms, and payment processors, the issue is not only account takeover. OTP weakness cascades into customer data exposure, fraudulent transfers, unauthorized beneficiary changes, and audit findings when firms claim MFA without resistance to phishing. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful here because the same control gap appears whenever authentication is treated as a checkbox instead of a threat-modeled control. In practice, many security teams encounter OTP abuse only after a successful session hijack has already triggered fraud review, rather than through intentional testing of the login path.
How It Works in Practice
OTP-based login fails because the control validates code possession, not the authenticity of the endpoint, browser, or page requesting it. A phishing site can mirror the login flow, harvest the username and password, then capture the OTP and relay it to the real service in seconds. If the platform does not bind authentication to the original channel or session, the attacker inherits the legitimate session and can move directly into account actions.
In regulated environments, the practical answer is to reduce reliance on reusable second factors and move toward phishing-resistant authentication. NIST’s identity guidance and security control catalog support stronger mechanisms such as FIDO2/WebAuthn, device-bound credentials, session risk scoring, and conditional access decisions at runtime. Financial services teams should also align login design with the broader control intent in the NIST Cybersecurity Framework 2.0 and the compensating-control discipline in NIST SP 800-53 Rev 5 Security and Privacy Controls.
- Prefer phishing-resistant authenticators over SMS or app-delivered OTP.
- Bind authentication to device, session, or transaction context where possible.
- Use step-up checks for high-risk actions, not just for initial login.
- Instrument fraud and IAM telemetry together so relay attempts are visible quickly.
NHIMG’s Top 10 NHI Issues is relevant because the same lifecycle discipline applies to credentials that are short-lived, exposed, or over-trusted. These controls tend to break down when legacy authentication is wired into core banking channels and customer support resets still rely on weak identity proofing, because the attacker only needs one successful relay to defeat the entire flow.
Common Variations and Edge Cases
Tighter login controls often increase friction, support overhead, and rollout cost, so institutions have to balance user experience against fraud loss and regulatory exposure. That tradeoff is real, especially where large retail populations, shared devices, and mobile network variability make stronger authenticators harder to deploy universally.
There is no universal standard for every customer segment yet. Current guidance suggests that OTP can still serve as a fallback in limited scenarios, but it should not be the primary control for privileged access, high-value payments, or transactions that trigger material risk. Some firms layer OTP with transaction signing, device binding, or behavioral checks, but those compensating controls only help if they are enforced consistently and monitored for bypass paths. NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is a practical reference for treating credentials as managed assets, not static conveniences.
For institutions operating under strict assurance expectations, the safest path is to phase out OTP wherever phishing resistance is required and reserve it for lower-risk recovery or transitional cases. That position is increasingly consistent with NIST SP 800-63 Digital Identity Guidelines, even though implementation maturity varies by platform and jurisdiction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Defines stronger authenticator assurance than OTP alone. | |
| NIST CSF 2.0 | PR.AA | Authentication assurance and access control are core to preventing OTP relay abuse. |
| NIST AI RMF | Risk-based decisions help evaluate authentication threats in context. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Long-lived or over-trusted credentials increase replay and takeover risk. |
Replace OTP-first login with phishing-resistant authenticators and higher-assurance identity proofing.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
