SMS OTP

An SMS OTP is a one-time passcode delivered by text message. It proves, at best, that the requester can currently read messages sent to a phone number, a property that transfers to an attacker the moment the number is SIM-swapped, ported, intercepted at the signaling layer, or phished in real time. NIST classifies out-of-band authentication over the phone network as a restricted authenticator type.

The practical reading of the NIST position is that an SMS code is evidence about a phone number rather than about a person, and that evidence is only as good as the current binding between the number and the handset. Checking that binding is a separate question from delivering the code, and the two are usually asked in the wrong order.

Where an SMS code is still the only channel a population has, the carrier-state check in front of it is what keeps it meaningful.

The restricted classification is a statement about trajectory as much as about current strength. It obliges a party relying on the channel to assess the risk, to inform users, and to have a plan for moving off it, which is a different posture from treating it as an accepted control indefinitely.

In practice the channel persists because it reaches everyone, needs no enrollment, and works on any handset. Those are real properties and they are the reason a blanket removal is rarely available to a consumer service. The workable position is to keep the channel where it is the only one a population has, and to stop treating it as sufficient for the actions where loss concentrates.

What makes the residual use defensible is checking the binding before relying on it. A code sent to a line whose SIM changed forty minutes ago is a message to whoever now holds the number, so SIM swap detection and SIM tenure belong in front of the send rather than in a report about it afterwards.