# Is SMS OTP still allowed under NIST SP 800-63-4?

> **Short answer:** Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.

- URL: https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 2)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Why SMS survived Revision 4

NIST’s Digital Identity Guidelines are the reference US federal agencies must follow, and the one banks, auditors and examiners reach for when they argue about authentication. Revision 4, finalized in 2025, is split into three volumes: identity proofing (63A), authentication (63B) and federation (63C).[^3]

For SMS, the headline is continuity. Codes sent over the phone network stay on the list of allowed authenticators, in the “restricted” category, rather than being removed.[^1] Restricted means permitted with obligations attached. See [what “restricted” requires](https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/).

## What changed around it

The bigger change is the alternative. Revision 4 explicitly accommodates synced passkeys, the kind stored in Apple, Google or password-manager accounts, and treats them as phishing-resistant.[^2] That makes the first restricted-authenticator condition, offering a non-restricted option, much easier to meet for consumer services.

## What “restricted” does not mean

It is not a ban and not a deprecation date. It is a signal: NIST asks organizations to keep a migration plan in case a future revision removes the authenticator.[^1] Treat SMS as a fallback you are planning to retire, not as a destination.

## What this means for you

### Banks & credit unions

If SMS is part of login or step-up, document the four restricted-authenticator conditions: the alternative you offer, the risk notice users see, a dated risk assessment and a migration plan. NIST isn’t binding on banks, but examiners and auditors often benchmark against it.

### Fintechs & payment firms

Launch with passkeys next to SMS so SMS is never a customer’s only option. Track the share of sign-ins that still use SMS: that number is the core of your migration plan.

### Developers & identity teams

Model SMS as one authenticator type among several rather than a hard-coded second factor. You will need to show an alternative at enrollment, show risk copy, and eventually switch SMS off flow by flow.

## Follow-up questions

**Does NIST 800-63-4 ban SMS OTP?**

No. It classifies SMS and voice codes as restricted: allowed, with conditions.

**Is voice OTP treated differently from SMS?**

No. Both are delivered over the phone network and both sit in the restricted category.


## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^2]: NIST cites phishing resistance of synced passkeys in digital identity guidelines update. FIDO Alliance. https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/ (secondary)
[^3]: SP 800-63-4: Digital Identity Guidelines. NIST. https://pages.nist.gov/800-63-4/

## Related questions

- [What does “restricted authenticator” mean in NIST SP 800-63B-4?](https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/)
- [Do US banks have to follow NIST SP 800-63?](https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/)
- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [Has any US regulator banned SMS OTP?](https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/)
- [Which countries are banning SMS OTP for banking?](https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/)

## Cite

Cleartext. “Is SMS OTP still allowed under NIST SP 800-63-4?” Last verified 2026-09-24 (rev. 2). https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/

## Changelog

- 2026-09-24: Re-verified against SP 800-63B-4; tightened the short answer.
- 2026-09-22: First published.