SMS OTP is not banned. Three things that are changing

The code stays, as one factor

Headlines say the SMS one-time password is on its way out. The rules say something narrower. RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025, in force since 1 April 2026, ask for two factors on every digital payment, one of them created for the transaction, and keep SMS OTP as a valid factor; newer factors are encouraged and risk-based checks are allowed above the floor¹².

One: login is moving first

Where regulators have moved fastest, they started with the login. Singapore’s major retail banks moved customers with a digital token off one-time passwords for account login from July 2024, so a phished code no longer opens the account³.

Two: high-risk transactions need more

In the Philippines, BSP Circular No. 1213 asks for methods stronger than SMS and email OTP for high-risk transactions⁴. In the UAE, banks have been reported to move authentication for transactions and enrolment off SMS and email codes and into their own apps from 25 July 2025⁵. Both are known from news reporting; check the regulator’s own text before relying on them.

Three: the phone itself becomes the factor

Behind each of these rules is the same idea: the bank’s app, on the customer’s own phone and SIM, is a better factor than a code that can be read out on a call. That only holds if the phone and SIM are bound to the account and checked in every session. The guide to moving beyond SMS OTP sets out each rule with its date and status.

What none of them says

None of the rules names a vendor or a method a bank must buy, and none makes a stronger login enough on its own. A stronger factor still passes the real customer who is being coached, which is why the payee and the payment need their own checks.

Sources

Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing here is legal advice.

1. RBI (opens in a new tab), Sep 2025Press release: directions on authentication mechanisms for digital payment transactions
2. RBI (opens in a new tab), Sep 2025Authentication Mechanisms for Digital Payment Transactions Directions, 2025
3. BleepingComputer (opens in a new tab), 2024, press reportBanks in Singapore to phase out one-time passwords in 3 months
4. GMA News (opens in a new tab), 2025, press reportNo more SMS, email OTPs for high-risk financial transactions
5. Gulf News (opens in a new tab), 2025, press reportNew rule: UAE banks to stop sending OTPs via SMS and email from July 25