What is SMS OTP?

SMS OTP, or SMS one-time password, is a short-lived authentication code sent to a user's mobile phone by text message. It is commonly used to confirm that a user has access to a device associated with a registered phone number during sign-in, account recovery, transaction approval, or another action requiring additional authentication.‍

SMS OTP is a form of out-of-band, possession-based authentication. The possession factor is the device controlled by the user, rather than the phone number itself. SMS OTP remains widely accessible because it does not require a separate authentication app, but it is not phishing-resistant and carries risks associated with the public switched telephone network (PSTN), SIM changes, and number porting. Under NIST SP 800-63B-4, PSTN-based out-of-band authentication is currently classified as a restricted authenticator. [1]

For most organizations, the more useful question is not whether SMS OTP is simply "good" or "bad," but where it still fits, where stronger methods are more appropriate, and how authentication can adapt as the customer, channel, and level of risk change.

SMS OTP at a glance

How does SMS OTP work?

A typical SMS OTP authentication flow works as follows:

1. A user attempts to sign in or perform an action requiring authentication.
2. The authentication service generates a random, short-lived authentication code.
3. The code is sent by SMS to a previously registered phone number.
4. The user receives the message and enters the code into the website or application.
5. The authentication service checks that the code is correct, still valid, and has not already been used.
6. If verification succeeds, the authentication process can continue.

The purpose of the SMS code is to establish evidence that the person completing the authentication flow has control of the out-of-band device associated with the registered phone number. It does not, by itself, establish the person's real-world identity. [1]

Under NIST SP 800-63B-4, SMS authentication codes used for out-of-band authentication must contain at least six decimal digits, or the equivalent amount of entropy, and can only be accepted once. The authentication must be completed within 10 minutes. If the code contains less than 64 bits of entropy, the verifier must also implement rate limiting for consecutive failed attempts. [1]

Is SMS OTP technically an OTP?

SMS OTP is the commonly used industry term, but NIST makes a more specific distinction between an OTP authenticator and an out-of-band authentication code.

Under NIST's terminology, an OTP is generated by an authenticator using a persistent secret and a nonce, such as a counter or the current time. An SMS authentication code, by comparison, is generated by the verifier and transmitted to an out-of-band device.

NIST formally refers to the transmitted code as an out-of-band secret. SMS OTP remains the more widely recognized industry term, while NIST categorizes the method itself as out-of-band authentication. [1]

This distinction becomes useful when comparing SMS OTP with methods such as TOTP, where the code is generated locally by an authenticator rather than sent by the service.

What is SMS OTP used for?

SMS OTP can be used when an organization needs evidence that a customer has access to a registered mobile device or phone number.

Common use cases include:

• Sign-in authentication: Confirming possession of a registered device during account access.
• Multi-factor authentication: Adding a possession factor alongside another authentication factor, such as a password.
• Step-up authentication: Requesting additional authentication when an action requires greater assurance.
• Transaction approval: Adding authentication before payments, transfers, profile changes, or other sensitive actions.
• Account recovery: Helping re-establish account access when another authenticator is unavailable.
• New-device registration: Adding assurance when an account is accessed from an unfamiliar device.

Whether SMS OTP is appropriate depends on the required level of assurance, the risks associated with the interaction, the consequences of authentication failure, and the alternative authentication methods available to the user.

Is SMS OTP the same as MFA?

Not necessarily.

Multi-factor authentication, or MFA, requires authentication using two or more different authentication factors. Authentication factors generally represent something the user knows, something the user has, or something the user is.

SMS-based out-of-band authentication represents a possession factor, or something the user has. If it is combined with an independent factor such as a password, the overall authentication process can constitute MFA. If access is granted using SMS authentication alone, the process remains single-factor authentication. [1]

Under NIST SP 800-63B-4, out-of-band authentication can form part of an authentication process at Authentication Assurance Level 2 (AAL2) in permitted combinations. NIST also requires verifiers operating at AAL2 to make at least one phishing-resistant authentication option available. [1]

How secure is SMS OTP?

SMS OTP can provide an additional authentication control, particularly compared with relying on a password alone. However, it has important security limitations.

SMS OTP is not phishing-resistant

SMS OTP requires the user to manually transfer an authentication code from one channel into another. A phishing site can potentially capture that code and relay it to the legitimate service while it is still valid.

NIST states that authentication methods involving the manual entry of authenticator output, including out-of-band and OTP authentication, cannot be considered phishing-resistant because the authentication output is not cryptographically bound to the specific authentication session. [1]

This is an important distinction between SMS OTP and cryptographic authentication methods such as passkeys.

SIM swaps and number porting can affect SMS authentication

SMS authentication also depends on control of the phone number continuing to correspond with the legitimate customer.

In a SIM swap, an attacker fraudulently causes a mobile provider to associate a victim's mobile service with a SIM controlled by the attacker. In port-out fraud, an attacker causes the victim's phone number to be transferred to another account or provider under their control.

The Federal Communications Commission has documented how both attacks can give an attacker control of a victim's phone number, allowing them to receive text messages and calls intended for the legitimate customer. [2]

NIST consequently recommends that verifiers consider indicators such as device swaps, SIM changes, number porting, and other abnormal behavior before using the PSTN to deliver an authentication code. [1]

SMS depends on the mobile network

Successful SMS authentication also depends on the customer being able to receive the message.

Mobile coverage, roaming conditions, carrier behavior, or other delivery issues can affect authentication availability. NIST specifically requires organizations implementing its guidance to make alternative authenticator types available because some users may be unable to use PSTN-based authentication in areas with limited telephone coverage. [1]

The wider security question is not only whether SMS has known weaknesses, but whether the authentication system can respond appropriately when context changes. A method that is acceptable for one interaction may not provide enough assurance for another, which is why authentication design increasingly depends on risk signals, step-up decisions, and access to multiple authentication methods.

Standards and regulatory considerations for SMS OTP

SMS OTP is treated differently across standards, regulatory frameworks, and jurisdictions, so organizations should consider the requirements that apply to their industry and market rather than relying on a single framework.

One important reference is NIST SP 800-63B-4, which classifies the use of the PSTN for out-of-band authentication as a restricted authenticator. [1]

Restricted does not mean prohibited.

NIST uses the classification for authenticator types that remain usable in certain circumstances but carry security risks requiring additional consideration. At the time SP 800-63B-4 was published, PSTN-based out-of-band authentication was the only authenticator specifically classified as restricted. [1]

For organizations applying NIST's Digital Identity Guidelines, accepting a restricted authenticator requires the organization to assess and accept the associated risks. NIST also requires the relevant credential service provider to:

• offer at least one unrestricted authenticator that can meet the required authentication assurance level;
• provide users with meaningful information about the security risks and available alternatives;
• account for the additional risks in its risk assessment; and
• maintain a migration plan in case the restricted authenticator becomes unacceptable in the future. [1]

The current NIST SP 800-63B-4 guidelines were finalized in July 2025 and supersede the previous version of SP 800-63B. [1]

The practical takeaway is flexibility. Standards, threats, and user expectations continue to evolve, so authentication strategies should make it possible to introduce or prioritize stronger methods without having to redesign the entire customer journey each time requirements change.

SMS OTP vs TOTP: What is the difference?

SMS OTP and TOTP both present the user with a short-lived code, but the way the code is created and delivered is different.

TOTP stands for Time-Based One-Time Password. It is defined by IETF RFC 6238 as an extension of the HMAC-based One-Time Password algorithm, using time as the moving factor used to generate the password. [3]

Because a TOTP is generated locally rather than delivered through the PSTN, it avoids risks that specifically relate to SMS delivery, SIM swaps, and number porting.

However, TOTP codes are still manually transferred by the user into the authentication experience. They can therefore be captured and relayed by a phishing site and are not considered phishing-resistant under NIST's definition. [1]

What are the alternatives to SMS OTP?

There is no single replacement for SMS OTP that is appropriate for every interaction. The right authentication method depends on what an organization needs to establish, the assurance required, the customer's device and channel, and the threats associated with the interaction.

Passkeys

Passkeys are FIDO authentication credentials that use public-key cryptography rather than asking the user to transfer a password or temporary code.

WebAuthn creates public-key credentials that are scoped to a specific relying party. During authentication, cryptographic proof is generated for that relying party rather than presenting a reusable password or manually entered authentication code. [4]

FIDO standards use public-key cryptography to provide phishing-resistant authentication, with passkeys acting as the cryptographic credentials used for authentication. [5]

For web-based authentication, passkeys are exercised through WebAuthn. The W3C published Web Authentication Level 3 as a Recommendation on August 25, 2026. [4]

TOTP authenticator apps

TOTP authenticator applications generate authentication codes locally rather than sending them over the mobile network.

This removes several risks specific to the PSTN and mobile phone number lifecycle. However, because the user still manually enters the generated code, TOTP does not provide phishing resistance. [1][3]

Carrier-based number verification

When the objective is specifically to establish possession of a mobile phone number, carrier-based number verification can offer another approach.

The GSMA Open Gateway Number Verification API enables an application to verify the phone number associated with the SIM or mobile network connection being used by the device. The specification describes both network-based and SIM-based authentication and enables phone possession to be verified without requiring the user to receive and manually enter an SMS OTP. [6]

It is important to distinguish phone number verification from user authentication. Confirming possession of a phone number can provide a useful possession signal, but it should not automatically be treated as equivalent to phishing-resistant authentication or every form of MFA.

When should organizations use SMS OTP?

SMS OTP can still be useful when accessibility, familiarity, and broad mobile reach are important, particularly when users have not enrolled another authentication method.

The decision should be based on the authentication journey and assurance required, rather than treating SMS OTP as either universally suitable or universally unsuitable.

Questions worth considering include:

• What action is the user attempting?
• What would happen if the authentication were compromised?
• Is SMS being used by itself or alongside another independent factor?
• Is a phishing-resistant authenticator available?
• Is there evidence of a recent SIM change, device change, or number port?
• Does the customer have another authentication method available?
• Is the interaction routine account access, account recovery, or a higher-risk transaction?
• What happens when the customer cannot receive the SMS?

The appropriate answer may change throughout the customer journey. Routine access, account recovery, profile changes, and high-value transactions do not necessarily require the same authentication approach.

A more effective model is to treat authentication as a set of methods that can be applied according to context. Passkeys may be appropriate for routine access, while a higher-risk action may justify step-up authentication or additional verification. The aim is to apply the right level of assurance at the right moment instead of adding the same level of friction to every interaction.

What should organizations consider when implementing SMS OTP?

Where SMS OTP remains part of an authentication journey, implementation decisions can reduce avoidable risk.

Keep authentication codes short-lived and single-use. Under NIST guidance, an out-of-band authentication must be completed within 10 minutes and each authentication code can only be accepted once. [1]

Apply rate limiting. Short numeric authentication codes have limited entropy. NIST requires rate limiting when an out-of-band authentication code contains less than 64 bits of entropy, and generating another code must not reset the failed-attempt count. [1]

Consider mobile risk signals. Recent SIM changes, device swaps, number porting, and other abnormal behavior can indicate that PSTN-based authentication should not be relied on for a particular interaction. [1]

Protect changes to registered phone numbers. Under NIST guidance, changing a pre-registered phone number is considered binding a new authenticator and needs to be protected accordingly. [1]

Provide alternative authentication methods. Customers may lose access to a phone number, be unable to receive messages, or require a stronger authenticator. Organizations applying NIST's guidance must provide an unrestricted alternative when using a restricted authenticator. [1]

Avoid designing every journey around one authentication method. Authentication requirements can vary according to the user, device, channel, transaction, and risk context. Supporting multiple authentication methods makes it possible to use greater assurance where it is needed without introducing unnecessary friction everywhere else.

Related authentication terms

One-time password (OTP): An authentication value designed for a single authentication event or limited period.

Out-of-band authentication: Authentication that uses a separate communication channel or device from the primary authentication interaction.

TOTP: A time-based one-time password generated using a shared key and time-based algorithm.

Multi-factor authentication (MFA): Authentication that requires evidence from more than one distinct authentication factor.

Step-up authentication: Additional authentication requested when an interaction requires greater assurance.

Adaptive authentication: Authentication in which contextual or risk information influences whether an additional challenge is required and which authentication method is used.

Phishing-resistant authentication: Authentication designed to prevent authentication data or valid authentication output from being captured and reused by an impostor verifier.

Passkey: A FIDO authentication credential based on public-key cryptography that can provide phishing-resistant authentication.

Number verification: Verification that establishes that a mobile number corresponds with the SIM or mobile connection being used.

Authentication methods rarely operate in isolation. As organizations introduce passkeys, adaptive MFA, number verification, digital credentials, and other methods, the challenge becomes deciding when each method should be used and how they work together across the customer journey. Building for that flexibility makes it easier to respond to changing threats, standards, and customer expectations without rebuilding authentication each time.

Frequently asked questions