Topic Concept
SMS one-time passcodes
Codes sent by text message to confirm a login or payment. NIST classifies them as restricted authenticators, and several central banks have ordered banks off them.
Also called: SMS OTP, text message codes, SMS 2FA
Questions (12) #
- Did the UAE ban SMS OTP for banking?Regulation
Yes, in effect.
- Has any US regulator banned SMS OTP?Regulation
No.
- How can banks defend against SIM swap fraud?Identity
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes.
- How do banks stop OTP bots?Fraud
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out.
- Is email OTP safer than SMS OTP?Identity
Not meaningfully.
- Is SMS OTP still allowed under NIST SP 800-63-4?Regulation
Yes, with conditions.
- What does “restricted authenticator” mean in NIST SP 800-63B-4?Regulation
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes.
- What is a SIM swap attack?Identity
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account.
- What is an OTP bot?Fraud
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
- What is BSP Circular 1213?Regulation
BSP Circular No.
- What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?Identity
MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes.
- Which countries are banning SMS OTP for banking?Regulation
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022.
Comparisons (3) #
Checklists (3) #
Glossary #
- One-time passcode (OTP)
- A short code that is valid for one login or transaction, delivered by SMS, voice call or email, or generated by an authenticator app. Whoever holds the code within its validity window can use it.