Checklist
SMS OTP flow inventory
Every place your organization still sends a code, ranked by where fraud cashes out.
Desk 06For Product & payments
The product & payments desk
Replacing codes without losing customers: what banks moved to, and how to explain it.
For product and payments teams at banks and fintechs.
What matters now
UAE banks replaced SMS and email codes mainly with verification inside their own mobile apps.
Dispatch: The UAE’s SMS OTP phase-out is done. What US banks can take from itSingapore’s major retail banks phased out OTP logins for customers with a digital token on their phone, from July 2024.
Dispatch: Singapore banks to phase out OTPs for customers with digital tokensIf a code is unavoidable, say what it approves and that the bank will never ask for it.
Field guide: Shutting down OTP bots: a fraud team’s field guide
Your reading path
Start at the top. Each step builds on the last.
Start here · Field guide
Moving a bank off SMS OTP: the field guide
Start here: which flows move first and who owns them.
Then · Field guide
Rolling out passkeys to retail banking customers
Enrollment moments, defaults and the one-sentence explanation.
Then · Dispatch
Singapore banks to phase out OTPs for customers with digital tokens
What customers saw when codes went away.
Then · Explainer
Why OTP bots keep working against bank customers
Why the code itself is the weakness.
Then · Buyer’s guide
SMS OTP alternatives: a buyer’s guide
The approaches, side by side, without rankings.
Checklists for this desk
Checklist
Passkey launch readiness
What to settle before offering passkeys to customers or staff.
Checklist
Questions for SMS OTP alternative vendors
Eight questions to put to every vendor, in writing.
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | UAE banks cancel OTPs, switching to in-app verification (The Paypers) |
| Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | No more SMS, email OTPs for high-risk financial transactions (GMA News) |
| India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | RBI mandates 2FA and new security rules for digital payments (Regulation Asia) |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | Malaysian banks stop using SMS for two-factor authentication (Commsrisk) |
| European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU) |
Quick answers
How should a bank move customers off SMS one-time passcodes?
Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
How can banks stop OTP bot attacks?
The durable fix is to remove the code the bot asks for, using passkeys, in-app approval on a registered device or network-based verification. While codes remain, say in every message what the code approves and that the bank will never ask for it, and treat a new-device sign-in during an inbound call as a strong fraud signal.
How should a bank roll out passkeys to its customers?
Decide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.
How should a bank respond to a suspected SIM swap?
Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No rankings; owner interest disclosed.
Buyer’s guide
SMS OTP alternatives: a buyer’s guide
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.
Buyer’s guide
SIM swap detection: a buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Owner-affiliated vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The Product & payments question set, then the pilot plan and who owns each step. No scores or recommendations.