SMS OTP is still useful, but modern phishing, SIM swapping, and stronger alternatives are changing where it belongs in the authentication stack.
SMS one-time passwords became popular because they’re simple, familiar, and work on almost any mobile phone. But the same design that made SMS OTP easy to deploy also creates weaknesses that are harder to ignore today.
The main problem is straightforward: an SMS code is a transferable secret. If an attacker can redirect the message, steal the code, or trick a user into entering it on a fake login page, the protection can fail. That’s why businesses handling sensitive accounts and transactions are increasingly moving toward phishing-resistant methods such as passkeys, device-bound authentication, and network-based verification. We cover one specific network-based alternative in more depth in our piece on silent network authentication.
Key Takeaways
- SMS OTP is still better than relying on a password alone, but it’s no longer strong enough for many high-risk logins and transactions.
- Modern phishing tools can capture an SMS code and use it immediately, even if the code expires in less than a minute.
- SIM swapping can redirect a victim’s phone number, and therefore future SMS codes, to an attacker-controlled SIM.
- SMS OTP also creates reliability and user-experience problems when codes are delayed, blocked, or never arrive.
- Passkeys and other phishing-resistant methods are stronger because there’s no code for the user to copy into a fake site.
- Businesses don’t have to eliminate SMS overnight. The practical approach is to move high-risk authentication away from SMS first and keep it only as a controlled fallback where needed.
Why SMS OTP Worked for So Long
SMS OTP solved an important problem: it gave businesses a simple way to add a second step beyond a password. Users didn’t need a special security key, an authenticator app, or a complicated setup process. A phone number was enough.
That made SMS verification easy to scale across consumer apps, banking, ecommerce, account recovery, and other services, and SMS-based verification genuinely can stop many automated attacks and bulk phishing attempts. So the issue isn’t that SMS OTP never worked. The issue is that the threat environment has changed.
Where SMS OTP Starts to Break Down
A common assumption is that an OTP is safe because it expires quickly. That helps against someone trying to guess the code later, but it doesn’t stop an attacker who steals it while the user is logging in. Modern phishing pages can imitate a legitimate sign-in screen, collect the username and password, then ask the victim for the SMS code. The attacker can relay that code to the real service within seconds. In that situation, a 60-second expiration window offers little protection because the attack is happening in real time.
SIM swapping breaks a different assumption: that the person receiving messages at a phone number is the legitimate user. In a SIM-swap attack, a criminal convinces or compromises a mobile provider into moving a victim’s phone number to a different SIM or eSIM. Once that happens, calls and text messages, including verification codes, can reach the attacker instead of the real customer. This is why a phone number shouldn’t be treated as the same thing as a verified identity. SMS can confirm where a message was routed, but that doesn’t always prove who’s holding the account.
SIM swapping and phishing are the clearest examples, but they’re not the only risks. SMS codes may also be exposed through malware, social engineering, or weaknesses in telecommunications networks. The average user doesn’t need to understand the underlying protocols to understand the core problem: if the code can be seen or redirected, it can potentially be used by someone else.
The Bigger Problem: SMS OTP Is Not Phishing-Resistant
Phishing-resistant authentication is designed so a user can’t simply hand the authentication secret to the wrong website. SMS OTP doesn’t meet that standard because the user receives a code and manually types it into a form.
Authenticator apps improve on SMS because the code is generated locally and isn’t sent through the mobile network, which removes risks such as SIM swapping and SMS interception. However, a manually entered authenticator code can still be stolen by a convincing phishing page. Passkeys are stronger because they don’t give the user a code to copy at all. The credential is tied to the legitimate website or service, making it much harder for a fake login page to reuse the authentication step.
SMS OTP Also Creates User Experience Problems
Security is only part of the problem. SMS verification also adds friction to the login or checkout process. The code may arrive late or after the login screen has timed out, carrier filtering can block legitimate verification messages, roaming and number-porting issues can disrupt delivery, users with poor indoor cellular coverage may have data access over Wi-Fi but still fail to receive the SMS, and copying a code from a message back into an app adds an extra step that can cause abandonment.
Authentication friction has real, measured business consequences too. FIDO Alliance’s own research found nearly 48% of consumers have abandoned an online purchase because of forgotten-password friction, and while that specific figure covers password friction broadly rather than SMS codes alone, it illustrates the same underlying point: authentication steps that are slow, confusing, or unreliable don’t just create security risk, they cost businesses real conversions.
Why Security Standards Are Moving Away From SMS
The direction from major security bodies is clear: SMS shouldn’t be the preferred authentication method for the most sensitive use cases. NIST classifies authentication over the public telephone network, including SMS, as a restricted authenticator in its current digital identity guidance, and CISA has encouraged organizations to move toward phishing-resistant MFA such as FIDO/WebAuthn for stronger protection.
That doesn’t mean every SMS login is immediately unsafe or noncompliant. It means businesses should treat SMS as a weaker factor and avoid making it the only barrier protecting high-value accounts, sensitive administrative access, or important financial actions.
What Is Replacing SMS OTP?
Passkeys replace typed passwords and OTP codes with a cryptographic credential stored on a trusted device or synced securely through a platform account. The user can often approve the login with Face ID, Touch ID, Windows Hello, or another device unlock method. The important security benefit is that the credential is tied to the legitimate service, so a fake website can’t simply ask the user to read out a six-digit code and reuse it.
Device-based authentication lets businesses use secure in-app approvals, device-bound credentials, biometrics, and other methods that connect authentication more closely to a trusted device, reducing reliance on a transferable code delivered over SMS.
Mobile networks are also developing ways to verify a phone number and SIM without sending a text message. With silent network authentication and related network APIs, the carrier can confirm that a device is using the expected mobile number and SIM in the background. For the user, the advantage is simple: there may be no code to wait for, copy, or accidentally give to a scammer. These methods aren’t a universal replacement for every login, but they show how mobile authentication is moving beyond SMS as the default verification channel.
Does This Mean SMS OTP Is Useless?
No. SMS OTP still has value, especially when the alternative is password-only authentication. It’s familiar, broadly available, and can stop many basic automated attacks.
The better way to think about SMS is as a lower-assurance or fallback method rather than the strongest option available. It becomes a poor fit when the consequences of account takeover are high. Businesses should be especially cautious about relying on SMS alone for account recovery and password resets, high-value financial transactions, administrative or privileged accounts, changes to sensitive account information, and access to systems containing valuable customer or business data.
What Businesses Should Do Now
Organizations don’t need to switch every user away from SMS in one move. A phased transition is usually more practical and avoids locking out customers who don’t yet have access to newer authentication methods.
Start with the highest-risk actions, moving account recovery, password changes, payments, beneficiary changes, and privileged access away from SMS first.
Introduce phishing-resistant options by offering passkeys or other FIDO/WebAuthn-based authentication where possible, especially for customers and employees with sensitive access.
Strengthen app-based authentication using device-bound approvals or secure in-app authentication rather than relying only on codes that users must manually type.
Use carrier signals where they add value, since network-based number verification and SIM-swap checks can help reduce reliance on SMS in mobile onboarding and fraud-sensitive workflows.
Keep a controlled fallback, since some customers will still need an accessible alternative, and SMS may remain useful as a fallback for lower-risk scenarios while stronger methods become the default.
Don’t forget account recovery: a strong passkey login can still be undermined if the account can be reset through a weak SMS-only recovery process.
Frequently Asked Questions
Is SMS OTP still safe to use at all?
It still has value, especially compared to a password alone, but it shouldn’t be the only protection for high-value accounts, financial transactions, or administrative access. Treat it as a lower-assurance fallback rather than a strong primary defense.
How does SIM swapping defeat SMS OTP?
A criminal convinces or compromises a mobile provider into moving a victim’s phone number to a different SIM. Once that happens, verification codes sent by text reach the attacker instead of the legitimate user, since SMS can only confirm where a message was routed, not who’s actually receiving it.
Why are passkeys considered phishing-resistant when SMS OTP isn’t?
Passkeys never give the user a code to type into a form, so there’s nothing for a fake login page to capture and reuse. SMS OTP requires the user to manually enter a code, which a real-time phishing page can intercept and relay before it expires.
Do NIST and CISA say businesses must stop using SMS OTP entirely?
No. NIST classifies SMS as a restricted authenticator rather than banning it outright, and CISA recommends moving toward phishing-resistant MFA for stronger protection. The practical guidance is to avoid relying on SMS alone for the most sensitive actions, not to eliminate it everywhere immediately.
What should businesses move away from SMS first?
Start with the highest-risk actions: account recovery, password resets, high-value financial transactions, privileged administrative access, and changes to sensitive account information.
Moving Beyond SMS OTP the Right Way at ClearSky
SMS OTP became the default because it was convenient and universally understood, not because it was designed for today’s phishing and account-takeover threats. The weakness is simple: the code can be transferred. If an attacker can redirect it, intercept it, or convince the user to enter it into a fake site, the second factor can fail. Passkeys, device-bound authentication, and network-based verification reduce that risk by removing or limiting the transferable secret.
For businesses protecting valuable accounts or sensitive transactions, the right move isn’t necessarily to turn SMS off tomorrow. It’s to stop treating SMS OTP as the strongest line of defense and begin moving high-risk authentication to methods built for the threats users face now. Talk to a ClearSky solutions engineer about strengthening mobile authentication and reducing your organization’s dependence on transferable SMS codes.
