SMS OTP is better than a password alone, but it is not a strong second factor: codes can be stolen through SIM swap, SS7 interception, malware and, most often, phishing. Several banking regulators have moved away from SMS OTP for high-risk actions, while SMS remains widely used for phone number verification and low-risk logins.
Is SMS OTP secure?
SMS OTP is moderately secure. It stops attacks that rely only on a stolen password, and it is easy for every user. But it relies on the phone network and the user's phone number, not on a device the user controls cryptographically. NIST's digital identity guideline SP 800-63B classes SMS and voice codes as a "restricted" authenticator: organizations may use them, but must assess the risk and offer a stronger alternative. In December 2024, the US agency CISA advised highly targeted individuals not to use SMS as a second factor at all.
What are the security risks of SMS 2FA?
- SIM swap. A criminal convinces or bribes a mobile operator to move the victim's number to a new SIM. From then on, all OTP codes go to the attacker. Operators reduce this with stronger identity checks and port-out PINs, and some apps check whether a SIM was swapped recently before sending sensitive codes.
- SS7 and signalling attacks. SS7 is the decades-old signalling network between operators. With illegitimate access to it, an attacker can redirect SMS to another network. Operators deploy signalling firewalls, but protection varies between networks.
- Phishing and real-time relay. The most common attack: a fake site or caller tricks the user into typing or reading out the code, and the attacker uses it within seconds. SMS OTP gives no protection here because the user hands the code over.
- Malware. On a compromised handset, malicious apps with SMS or notification access can read codes.
- Number recycling. Operators reassign numbers that were abandoned, so codes can reach a new owner if your user database is out of date.
- Grey routes. Codes sent over unauthorised routes pass through parties you do not know. See grey SMS route risks.
Are regulators phasing out SMS OTP for banking?
Yes, in several markets, mainly for online banking logins and transactions rather than for all uses. Confirmed examples as of October 2026:
| Country | What changed |
|---|---|
| Singapore | Following the Monetary Authority of Singapore's measures, major retail banks stopped using SMS OTP for login for customers with a digital token, from July 2024. |
| Malaysia | Bank Negara Malaysia told banks in September 2022 to migrate from SMS OTP to more secure authentication for online banking actions such as transfers and account changes. |
| United Arab Emirates | The Central Bank of the UAE directed financial institutions to move customer transaction authentication away from SMS and email OTP, with a deadline of 31 March 2026. |
| India | The Reserve Bank of India's authentication directions, in force from 1 April 2026, keep two-factor authentication but allow more factors (device tokens, biometrics, passphrases) besides SMS OTP. This widens the options rather than banning SMS. |
These rules target banks and payment providers. Most other businesses still use SMS OTP, but the direction of travel is clear for high-value actions.
SMS 2FA vs authenticator app: which is safer?
An authenticator app (TOTP) is safer against SIM swap and SS7 because the code is generated on the device and never travels over the phone network. It is still vulnerable to phishing, since the user can type the code into a fake site. Passkeys and hardware security keys (FIDO2/WebAuthn) are phishing-resistant, because the browser only signs in to the real domain.
| Method | SIM swap | Network interception | Phishing | Ease for users |
|---|---|---|---|---|
| SMS OTP | Vulnerable | Vulnerable | Vulnerable | Very easy |
| Authenticator app (TOTP) | Resistant | Resistant | Vulnerable | Needs setup |
| Push approval in banking app | Resistant | Resistant | Partly (with number matching) | Easy |
| Passkey or security key | Resistant | Resistant | Resistant | Easy once set up |
How to make SMS OTP safer
If SMS OTP stays in your flow, which is common for signup and number verification, reduce the risk:
- Put the purpose and your brand in the message and tell users never to share the code. See OTP SMS best practices.
- Keep codes short-lived (a few minutes) and single-use, with attempt limits.
- Use direct or well-managed routes and a registered sender ID, so codes do not travel through unknown parties. See direct SMS routes.
- Check for recent SIM swap or number porting before high-risk actions, where your provider offers it. See number portability.
- Rate-limit requests to stop SMS pumping, which is a cost attack rather than an account attack but often hits the same form.
- Offer stronger factors (passkeys, app-based approval) and push users toward them for payments and account changes.
What are the alternatives to SMS OTP?
Passkeys, authenticator apps, in-app push approval, WhatsApp authentication messages and voice OTP are the main alternatives. Messaging alternatives share some weaknesses with SMS because they are tied to the phone number. See WhatsApp vs SMS for OTP and voice OTP.
For signup and verification flows that keep SMS, VoIPMatcher sources A2P SMS routes from its carriers and manages them. Request a secure OTP SMS route.
Frequently asked questions
Is SMS OTP being phased out?
For online banking in several countries, yes, at least for high-risk actions. Singapore, Malaysia and the UAE have pushed banks toward app-based and other stronger authentication, and India now allows more factors besides SMS OTP. For phone number verification and general app logins, SMS OTP remains widely used as of 2026.
Can someone intercept my OTP SMS?
It is possible but uncommon for ordinary users. The main ways are SIM swap, where a criminal takes over the phone number, abuse of the SS7 signalling network, and malware on the phone. Far more often, attackers simply trick the user into sharing the code through phishing calls, messages or fake websites.
Why do banks warn never to share an OTP?
Because the most common way criminals defeat SMS OTP is social engineering: they pose as the bank, a delivery company or support and ask for the code, then use it within seconds to log in or approve a payment. A genuine bank never needs you to read a code back to them.
What is the most secure alternative to SMS OTP?
Passkeys and hardware security keys based on FIDO2 and WebAuthn are the most secure common options, because they are resistant to phishing and are not tied to the phone network. In banking, in-app approval with device binding and biometrics is widely used. Authenticator apps are safer than SMS against SIM swap but can still be phished.
Does SIM swap affect WhatsApp and voice OTP too?
Yes. Any method that sends a code to a phone number can be exposed when the number is taken over, including voice OTP and, in many cases, WhatsApp re-registration on a new device. Methods tied to a device or a cryptographic key, such as passkeys and authenticator apps, are not affected by SIM swap.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.