# How to migrate a bank off SMS OTP

> **In brief:** A sequenced plan for retiring SMS one-time passcodes flow by flow: inventory, meet NIST’s restricted-authenticator conditions in the meantime, ship phishing-resistant replacements, harden recovery, then switch SMS off with a date.

- URL: https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

- For: Banks and credit unions
- Time: Multiple quarters; the first four steps fit in one.

## Before you start

- A list of every customer-facing flow that authenticates or confirms an action
- Sign-in and step-up logs that record which authenticator was used
- An owner for the program in fraud or identity

## Steps

1. [ ] **Inventory every flow that still sends a code.** List login, step-up, password reset, new payee, limit changes and contact-detail changes. For each, record the authenticator used today and monthly volume.
2. [ ] **Write the NIST risk assessment and date it.** NIST SP 800-63B-4 asks organizations that keep a restricted authenticator to assess the risk of continuing to use it. Record the owner and a review date.[^1]
3. [ ] **Tell customers the risks of SMS.** Add plain-language risk copy next to SMS wherever customers choose or use it, another restricted-authenticator condition.[^1]
4. [ ] **Offer a phishing-resistant option and track adoption.** Ship passkeys for returning customers first. Measure the share of sign-ins completed with a passkey every week; that number drives the rest of the plan.[^2]
5. [ ] **Move approvals into your app on registered devices.** For payments and payee changes, approval inside your own app on a device you registered is the replacement UAE and Singapore banks used.[^3]
6. [ ] **Harden account recovery and new-payee setup first.** These are where SIM-swap and OTP-bot fraud cash out. Don’t let a passkey account fall back to SMS for recovery.
7. [ ] **Add a SIM-change signal wherever SMS remains.** Before trusting an SMS code, check whether the number’s SIM changed recently, for example through a carrier SIM Swap API.[^4]
8. [ ] **Put context in every remaining code message.** Say what the code approves and that the bank will never ask for it. This blunts OTP-bot calls while SMS is still in use.[^5]
9. [ ] **Set a retirement date per flow and publish it internally.** Tie each date to an adoption threshold for the replacement. Review against the regulation tracker in case a market you serve moves first.

## Done when

Every high-risk flow completes without an SMS code, SMS remains only as a documented fallback with its risk assessment current, and recovery never falls back to SMS for customers with a passkey.

## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^2]: NIST cites phishing resistance of synced passkeys in digital identity guidelines update. FIDO Alliance. https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/ (secondary)
[^3]: UAE banks cancel OTPs, switching to in-app verification. The Paypers. https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification (secondary)
[^4]: CAMARA project. Linux Foundation. https://camaraproject.org/
[^5]: One-time passcodes are gateway for financial fraud attacks. BankInfoSecurity, 2026-04-03. https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341 (secondary)
[^6]: Banks in Singapore to strengthen resilience against phishing scams. Monetary Authority of Singapore, 2024-07-09. https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams

## Related questions

- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [What does “restricted authenticator” mean in NIST SP 800-63B-4?](https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/)
- [How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/)
- [How can banks defend against SIM swap fraud?](https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/)

## Cite

Cleartext. “How to migrate a bank off SMS OTP” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/

## Changelog

- 2026-09-24: First published.