Question Regulation
Is SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Is SMS OTP still allowed under NIST SP 800-63-4? Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant. Source: https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/ (Cleartext, verified 2026-09-24)
Why SMS survived Revision 4 #
NIST’s Digital Identity Guidelines are the reference US federal agencies must follow, and the one banks, auditors and examiners reach for when they argue about authentication. Revision 4, finalized in 2025, is split into three volumes: identity proofing (63A), authentication (63B) and federation (63C).[3]
For SMS, the headline is continuity. Codes sent over the phone network stay on the list of allowed authenticators, in the “restricted” category, rather than being removed.[1] Restricted means permitted with obligations attached. See what “restricted” requires.
What changed around it #
The bigger change is the alternative. Revision 4 explicitly accommodates synced passkeys, the kind stored in Apple, Google or password-manager accounts, and treats them as phishing-resistant.[2] That makes the first restricted-authenticator condition, offering a non-restricted option, much easier to meet for consumer services.
What “restricted” does not mean #
It is not a ban and not a deprecation date. It is a signal: NIST asks organizations to keep a migration plan in case a future revision removes the authenticator.[1] Treat SMS as a fallback you are planning to retire, not as a destination.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
If SMS is part of login or step-up, document the four restricted-authenticator conditions: the alternative you offer, the risk notice users see, a dated risk assessment and a migration plan. NIST isn’t binding on banks, but examiners and auditors often benchmark against it.
Fintechs & payment firms
Launch with passkeys next to SMS so SMS is never a customer’s only option. Track the share of sign-ins that still use SMS: that number is the core of your migration plan.
Developers & identity teams
Model SMS as one authenticator type among several rather than a hard-coded second factor. You will need to show an alternative at enrollment, show risk copy, and eventually switch SMS off flow by flow.
Follow-up questions #
- Does NIST 800-63-4 ban SMS OTP?
- No. It classifies SMS and voice codes as restricted: allowed, with conditions.
- Is voice OTP treated differently from SMS?
- No. Both are delivered over the phone network and both sit in the restricted category.
People also ask #
What does “restricted authenticator” mean in NIST SP 800-63B-4?
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.
Full answerDo US banks have to follow NIST SP 800-63?
Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.
Full answerAre synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerHas any US regulator banned SMS OTP?
No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.
Full answerWhich countries are banning SMS OTP for banking?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Is SMS OTP still allowed under NIST SP 800-63-4?” Last verified 2026-09-24 (rev. 2). https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/
Markdown link
[Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 2 | Re-verified against SP 800-63B-4; tightened the short answer. | |
| Rev. 1 | First published. |