SMS OTP is a one-time password delivered to a user’s phone by text message, used as a second authentication factor. It’s the most widely deployed form of MFA because nearly everyone has a phone that receives texts: but it’s also the weakest common form, and regulators and standards bodies increasingly discourage it for high-value accounts.

The convenience is undeniable, which is why it spread so far. The security problems are equally well documented.

Why SMS OTP is vulnerable

• SIM swapping, an attacker convinces (or bribes) a carrier to move the victim’s number to a SIM they control, then receives the codes. This is a common, effective attack against high-value targets.
• Interception, weaknesses in telecom signaling (such as SS7) can allow message interception.
• Phishing, like any OTP, the code can be captured on a fake site and relayed in real time.
• Delivery dependence, codes can be delayed or fail, harming both security and experience.

Why it’s still used

Despite the flaws, SMS OTP persists because it works on any phone, requires no app, and is familiar. For low-risk actions it raises the bar over a password alone. The mistake is treating it as strong protection for banking, payments, or account-recovery flows, where SIM-swap and phishing attacks specifically target it.

What’s replacing it

The direction is toward phishing-resistant authentication (passkeys and FIDO2) and risk-based approaches that don’t lean on a phone number as the anchor of trust. Where SMS remains for coverage reasons, pairing it with device intelligence and risk signals helps compensate for its weaknesses. But as a primary second factor for sensitive accounts, SMS OTP is on its way out, and treating account recovery as a place where it persists is a common blind spot.

Should you still use SMS OTP?

The honest answer is "sparingly, and with eyes open." SMS OTP still has a role: it reaches virtually every phone with no app to install, so for low-risk actions and as a coverage option for users who can’t use stronger methods, it beats a password alone. The mistake is relying on it where it’s specifically targeted, protecting high-value banking actions, or gating account recovery, which is exactly where SIM-swap and phishing attacks concentrate. A pragmatic policy: offer stronger, phishing-resistant methods as the default; keep SMS only as a fallback for edge cases; never let SMS be the sole guard on money movement or recovery; and back it with device and risk signals so a code arriving on a freshly swapped SIM raises a flag. Treated as a last-resort coverage option rather than a primary control, SMS OTP is defensible. Treated as real security for sensitive accounts, it’s a liability.

Frequently asked questions

Is SMS OTP secure?

It’s better than a password alone but vulnerable to SIM swapping, interception, and phishing, weak for high-value accounts.

What is SIM swapping?

An attack that transfers a victim’s phone number to the attacker’s SIM so they receive the SMS codes.

What should replace SMS OTP?

Phishing-resistant methods like passkeys, backed by risk-based authentication.

Is it ever OK to use SMS OTP?

As a last-resort coverage option for low-risk actions. But not as the sole guard on money movement or account recovery.

Related: SIM Swapping · One-Time Password (OTP) · Passkeys · Multi-Factor Authentication (MFA) · Account Recovery