.png)
SMS one-time passwords (OTPs) are no longer reliable for securing user accounts. Leading companies are replacing them with passkeys and encrypted messaging options like WhatsApp OTP to strengthen security, reduce costs, and maintain regulatory compliance.
SMS codes are vulnerable to hacking, expensive to send, frequently undelivered, and increasingly non-compliant with new regulations. Authorities in Singapore, India, Malaysia, and the United States are moving to eliminate SMS OTPs, and organizations like FINRA and the US Patent and Trademark Office will no longer accept them by 2025.
There are better alternatives available, and making the switch is simpler than many companies expect.
Need to move away from SMS OTP? We can help you make the switch without disrupting your current auth flow. Drop us a line.
Why are more companies replacing SMS OTP
More and more companies are ditching SMS OTP, and I don't blame them. What started as a decent security measure has turned into a liability with serious risks for both businesses and users.
Why is SMS OTP not safe?
SIM swapping is the biggest problem. Scammers can call your phone carrier, pretend to be you, and move your number to their phone. Just like that, they get all your text messages - including your security codes.
The networks that carry text messages use outdated technology (called SS7) that hackers have figured out how to exploit. They can intercept messages without ever touching your phone.
And here's a scary thought – text messages aren't encrypted. They're sent as plain text that can be captured by anyone who knows how to monitor network traffic.
Can OTPs be spoofed?
Yes. Attackers can make fraudulent messages appear to come from trusted sources like your bank. These spoofed messages can trick users into revealing their OTPs or clicking malicious links.
Man-in-the-middle attacks can intercept OTPs during transmission. And mobile malware can silently forward your SMS messages to attackers without you ever knowing.
What are the risks of SMS OTP?
The most immediate risk is account takeover, where attackers gain control of user accounts, potentially leading to fraud, identity theft, and data breaches. For businesses, successful attacks damage reputation and erode customer trust.
Another major risk is financial loss from SMS pumping fraud, where fraudsters generate huge volumes of SMS messages to premium-rate numbers, inflating charges for targeted businesses.
Is SMS OTP still compliant in 2025?
While SMS OTP might technically satisfy some baseline requirements in certain sectors, its compliance standing is diminishing fast. Many regulatory bodies are actively moving away from SMS as an acceptable authentication method:
- The US Patent and Trademark Office is phasing out SMS-based authentication by May 2025
- Microsoft is mandating stronger authentication for Microsoft 365 admin accounts starting February 2025
- Financial Industry Regulatory Authority (FINRA) is retiring SMS as an acceptable authentication option by July 2025
- Reserve Bank of India (RBI) is planning to completely eliminate SMS OTP-based authentication for digital payments.
- Singapore's Monetary Authority announced that major banks will phase out OTPs for account logins, moving towards digital tokens to enhance security against fraud.
- Bank Negara Malaysia (BNM) has already directed financial institutions to stop using SMS-based OTPs to combat the rise in financial scams.
The real cost of sticking with SMS OTP
Most organizations focus only on the per-message cost of SMS OTP. But the true price tag is much higher when you consider delivery failures, customer support overhead, and fraud losses.
Why SMS 2FA creates major costs/risks
The direct costs add up fast. Each text message costs money, especially international ones. For companies with millions of users, this becomes a massive expense.
When SMS codes don't arrive (because of network issues, wrong numbers, or spam filters), users call support for help. This creates a whole other cost centre that many businesses overlook.
The biggest hit to the bottom line comes from fraud. Twitter (now X) reportedly lost $60 million a year to SMS fraud alone. With global spending on SMS OTP over $1.6 billion yearly, there's a lot of money at stake.
Cost-per-message vs. Passkeys/WhatsApp
Let's talk money. The difference in cost between SMS and newer options is eye-opening:
- SMS OTP: Between 1 and 20 cents per message (plus verification fees)
- Passkeys: You pay once to integrate, then zero per login
- WhatsApp OTP: Typically half the cost of SMS
We've seen companies cut their authentication costs by up to 90% just by moving away from SMS. That adds up fast when you're sending millions of codes.
What are the best alternatives to SMS OTP?
There are several better options that offer improved security, better user experience, and cost savings.
Passkeys (FIDO2/WebAuthn)
Passkeys are the future of logging in. Instead of typing codes, you just use your device's built-in security – like your fingerprint or face scan.
Passkeys use advanced encryption that can't be phished or stolen. They completely eliminate the need for passwords and one-time codes.
.svg)
.png)
%20(1).png)
