No. 07Week of September 23, 2026This week’s briefing
Tradecraft

Buyer’s guide

SMS OTP alternatives: a buyer’s guide

The options for replacing text-message codes, how to evaluate them and what to ask vendors. We explain approaches; we don’t rank products.

By Reviewed by [REVIEWER NAME]Published 4 min read

For CISOs IAM engineers Product & payments Fraud & risk

Commercial-intent guideEditorial, not sponsoredNo scores, ratings or rankingsOwner interest disclosedMethodology

The short answer

What is the best alternative to SMS OTP?

There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.

If you read nothing else

  1. Evaluate by flow (sign-in, recovery, new payee), not by product.
  2. Ask every vendor how their method holds up in account recovery.
  3. Ask how the method is classified under NIST SP 800-63B-4, and get it in writing.
  4. We list vendors by approach, alphabetically, with no scores or rankings.

Start with the flow, not the product

SMS codes are used for several different jobs: signing in, stepping up a payment, adding a payee and recovering an account. An alternative that is excellent at one can be weak at another. Before you talk to vendors, list your flows and decide which ones must move first. Our field guide to moving off SMS OTP has a ready-made inventory.

The approaches

Tradecraft summary of NIST SP 800-63B-4 [1], FIDO Alliance [2] and carrier API documentation [5][6].
ApproachPhishing-resistant?NIST 800-63B-4What the user does
Passkeys (synced or device-bound)YesSynced: AAL2. Hardware keys: eligible for AAL3Unlocks the device
In-app approval on a registered deviceDepends on the implementation[EDITORIAL: confirm]Taps approve in the app
Carrier network checksNot on their own[EDITORIAL: confirm]Nothing; runs over mobile data
SIM-based cryptographic authentication[EDITORIAL: confirm][EDITORIAL: confirm classification]Usually one tap
Authenticator app codes (TOTP)NoAllowed at AAL2Types a code

Passkeys (FIDO2)

A passkey is a key pair bound to the site’s domain, so a look-alike phishing site gets nothing it could relay. NIST 800-63-4 accepts synced passkeys at AAL2.[1][2] The main new risk is the account that syncs them, and the main design problem is recovery.

In-app approval on a registered device

The customer confirms a sign-in or payment inside the organization’s own app, on a device already registered. This is what UAE banks moved customers to, and what Singapore banks use for customers with digital tokens.[3][4] The weak point is a customer talked into approving a request they didn’t start.

Carrier network checks

The CAMARA project defines common network APIs such as Number Verification and SIM Swap, and GSMA Open Gateway packages them commercially.[5][6] They confirm something about a SIM, not the person holding the phone, so they work best as a risk signal alongside another factor.

SIM-based cryptographic authentication

Keys held in the SIM sign the request, rather than the network simply vouching for the number. In the US, carriers began offering network-based checks through aggregators and vendors in 2026: in July, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon,[7] and in August, Glide Identityowner interest announced a beta of SIM-based cryptographic authentication across the same three carriers.[8] Coverage and NIST classification should be confirmed with each vendor. For a worked example of those questions put to one vendor, desk by desk, see our owner-affiliated Glide Identity vendor brief; run the same questions and pilot for every vendor you shortlist.

Authenticator app codes (TOTP)

Codes from an authenticator app remove the dependence on the phone number and are allowed at AAL2, but they are still codes: a customer can be persuaded to read one out.[1]

How to evaluate

Tradecraft’s evaluation criteria. See the methodology.
CriterionWhy it mattersHow to test it
Phishing resistanceDecides whether OTP bots and look-alike sites still workAsk how the credential is bound to your domain or channel
NIST classificationExaminers and auditors use it as a benchmarkAsk for the vendor’s written position against 800-63B-4
RecoveryWhere deployments get attackedWalk through a lost-phone scenario end to end
CoverageDevices, carriers and markets you serveAsk for coverage by country and platform
Fallback behaviorA weak fallback undoes a strong primaryAsk what happens when the method fails
AccessibilityEvery customer needs a usable, non-restricted optionTest with assistive technologies
Data and privacySome methods share data with carriers or third partiesAsk what data leaves your systems, and to whom
Regulatory fitRules differ by marketCheck against our regulations tracker
Commercial modelPer-transaction pricing changes the business caseAsk for pricing in writing [YOUR PROCUREMENT PROCESS]

Questions to ask every vendor

  1. How is your method classified under NIST SP 800-63B-4, and can you put that in writing?
  2. Is it phishing-resistant? What exactly binds the credential to our site or app?
  3. Walk us through account recovery when the customer loses their phone.
  4. What does the customer see when your method fails, and what do we fall back to?
  5. Which countries, carriers, devices and operating systems are covered today?
  6. What customer data leaves our systems, where does it go, and how long is it kept?
  7. Which independent assessments or certifications apply, and can we see them?
  8. What does it cost, and what drives the price up?

Vendor landscape

We list vendors by approach, in alphabetical order, with no scores, ratings or rankings. Inclusion criteria are in the methodology.

Landscape not yet populated. [EDITORIAL: populate from the inclusion criteria; list every qualifying vendor alphabetically.]
ApproachVendors (alphabetical)
Passkeys and FIDO2 platforms[VENDOR], [VENDOR], [VENDOR]
In-app approval and device binding[VENDOR], [VENDOR], [VENDOR]
Carrier network checks and aggregators[VENDOR], [VENDOR], [VENDOR]
SIM-based cryptographic authentication[VENDOR], [VENDOR]

Questions readers ask

What is the best alternative to SMS OTP?

It depends on the flow. Passkeys are the most standardized phishing-resistant option; in-app approval suits customers who already use your app; carrier checks are strongest as a risk signal. Most organizations combine them.

Is an authenticator app a good replacement for SMS?

It removes the dependence on the phone number, but the code can still be phished or read out to a caller. NIST allows it at AAL2; it is not phishing-resistant.

Is email OTP an alternative to SMS OTP?

Not a meaningful one. Email codes can be phished the same way, and the UAE and Philippine rules phase out both together.

Does Tradecraft rank or rate vendors?

No. We explain approaches and publish evaluation criteria. Vendors are listed by approach in alphabetical order, with no scores, and no vendor pays for inclusion.

Sources

  1. NIST SP 800-63B-4: Authentication and Authenticator Management
  2. FIDO Alliance NIST cites phishing resistance of synced passkeys in digital identity guidelines update
  3. The Paypers UAE banks cancel OTPs, switching to in-app verification
  4. Monetary Authority of Singapore Banks in Singapore to strengthen resilience against phishing scams (2024-07-09)
  5. Linux Foundation CAMARA project
  6. GSMA GSMA Open Gateway
  7. ID Tech Aduna and major U.S. carriers push network-based authentication as SMS code alternative
  8. Business Wire Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon (2026-08-03)

Changelog

  • : First edition. Vendor landscape not yet populated. Awaiting editorial verification.
  • : Linked the owner-affiliated Glide Identity vendor brief from the SIM-based section and the conflict-of-interest note.

Cite this

Tradecraft. “SMS OTP alternatives: a buyer’s guide.” Tradecraft, September 24, 2026. https://glide-tradecraft.pages.dev/buyers-guides/sms-otp-alternatives/

Read next

Field guide

Moving a bank off SMS OTP: the field guide

Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.

Explainer

Carrier-native authentication, explained: how a SIM can sign a login

Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.

Take the checklist

Terms in this piece