How to migrate a bank off SMS OTP

Before you start #

• A list of every customer-facing flow that authenticates or confirms an action
• Sign-in and step-up logs that record which authenticator was used
• An owner for the program in fraud or identity

Steps #

0 of 9 steps done

1. Mark step 1 done

   01 Inventory every flow that still sends a code

   List login, step-up, password reset, new payee, limit changes and contact-detail changes. For each, record the authenticator used today and monthly volume.

2. Mark step 2 done

   02 Write the NIST risk assessment and date it

   NIST SP 800-63B-4 asks organizations that keep a restricted authenticator to assess the risk of continuing to use it. Record the owner and a review date.^[1]

3. Mark step 3 done

   03 Tell customers the risks of SMS

   Add plain-language risk copy next to SMS wherever customers choose or use it, another restricted-authenticator condition.^[1]

4. Mark step 4 done

   04 Offer a phishing-resistant option and track adoption

   Ship passkeys for returning customers first. Measure the share of sign-ins completed with a passkey every week; that number drives the rest of the plan.^[2]

5. Mark step 5 done

   05 Move approvals into your app on registered devices

   For payments and payee changes, approval inside your own app on a device you registered is the replacement UAE and Singapore banks used.^[3]

6. Mark step 6 done

   06 Harden account recovery and new-payee setup first

   These are where SIM-swap and OTP-bot fraud cash out. Don’t let a passkey account fall back to SMS for recovery.

7. Mark step 7 done

   07 Add a SIM-change signal wherever SMS remains

   Before trusting an SMS code, check whether the number’s SIM changed recently, for example through a carrier SIM Swap API.^[4]

8. Mark step 8 done

   08 Put context in every remaining code message

   Say what the code approves and that the bank will never ask for it. This blunts OTP-bot calls while SMS is still in use.^[5]

9. Mark step 9 done

   09 Set a retirement date per flow and publish it internally

   Tie each date to an adoption threshold for the replacement. Review against the regulation tracker in case a market you serve moves first.

Progress is saved in this browser only.

Done when #

Every high-risk flow completes without an SMS code, SMS remains only as a documented fallback with its risk assessment current, and recovery never falls back to SMS for customers with a passkey.

Evidence #

1. [1]SP 800-63B-4: Authentication and Authenticator ManagementNIST Primary
2. [2]NIST cites phishing resistance of synced passkeys in digital identity guidelines updateFIDO Alliance Secondary
3. [3]UAE banks cancel OTPs, switching to in-app verificationThe Paypers Secondary
4. [4]CAMARA projectLinux Foundation Primary
5. [5]One-time passcodes are gateway for financial fraud attacksBankInfoSecurity, 2026-04-03 Secondary
6. [6]Banks in Singapore to strengthen resilience against phishing scamsMonetary Authority of Singapore, 2024-07-09 Primary

Related questions #

Changelog #