Beyond SMS OTP: what five regulators expect
Five regulators have each dated a move beyond the SMS one-time password, and none of them has banned it. This guide sets out what each rule says, what it does not, and the routes a bank app can use instead of a typed code.
In this guide
Why the code is the weak factor
A one-time code sent by SMS proves that someone could read a message on the registered number at that moment. That is less than it sounds. The code can be phished by a caller who asks for it, forwarded by malware that reads the inbox, or typed by the customer themselves while someone on a call tells them what to do. In a coached payment the code works exactly as designed, and the money still leaves.
Regulators have reached the same conclusion at different speeds. None of them has outlawed the code. Each has asked for something stronger in a particular place: at login, for high-risk transactions, or as the floor for every payment.
Five rules, dated
In force 1 April 2026
Two factors for every digital payment, one created for the transaction. SMS OTP remains a valid factor; newer factors are encouraged, and risk-based checks are allowed above the floor.12
From July 2024
Major retail banks moved customers with a digital token off one-time passwords for account login, so a phished code no longer opens the account.3
In place by July 2023
Migrate from SMS OTP to more secure authentication, confirm suspicious transactions, cool off first enrolment, and keep one registered device per account holder.4
Deadline June 2026
Stronger methods than SMS and email OTP for high-risk transactions, such as biometric, behavioural or passwordless authentication.5
From 25 July 2025
Banks move authentication for transactions and enrolment off SMS and email codes and into their own apps, with a full phase-out reported for March 2026.6
Four of the five are known from news reporting rather than the regulator’s text, and the market pages mark them as secondary until the text is read. The rule map carries each one with its status.
What none of them says
- “OTP is banned.” RBI keeps SMS OTP as a valid factor. Singapore’s move applies to login for digital token users, and BSP’s to high-risk transactions.
- “Use this product.” RBI’s directions are technology-neutral, and none of the five names a vendor or a method a bank must buy.
- “A better login is enough.” Every rule here is about the factor. A stronger factor still passes the real customer who is being coached, which is why the payee and the payment need their own checks.
The routes that replace a typed code
DeepID’s one-tap login tries the strongest route the phone and the network allow, and the next takes over when one cannot. The customer has nothing to type while the network can confirm the number.
- Network check: the carrier confirms the number over mobile data, even on Wi-Fi, with nothing for the customer to do.
- SIM check: the phone sends one text to DeepID from its own SIM, silently once permission is given.
- Aadhaar consent: the customer approves in the Aadhaar app.
- One-time code, typed or auto-filled, as the last fallback.
The bank chooses the steps for each attempt, and a single-use token is redeemed by the bank’s server with DeepID before anyone is signed in. Aadhaar consent is an Indian route; elsewhere the network check and the SIM check run before a code.
Binding underneath
The routes prove that the number is in this phone right now. Binding ties that phone and SIM to the account, so a payment from another SIM or another phone is not this customer’s. Malaysia’s one registered device per account holder and RBI’s possession factors both rest on it. The guide to SIM binding, device binding and silent network verification sets out what each proves.
Where DeepID fits
Silent network verification runs the routes above, SIM and device binding keeps the account on the customer’s own phone, and liveness and face match steps in where identity is in doubt. Every login returns one decision with its reasons to the app and the FRM. Which routes are live with which network is confirmed with your team before a pilot, and you can try one-tap login on your own number first. DeepID supports compliance and never guarantees it.
Sources
Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing in this guide is legal advice.
- RBI (opens in a new tab), Sep 2025Press release: directions on authentication mechanisms for digital payment transactions
- RBI (opens in a new tab), Sep 2025Authentication Mechanisms for Digital Payment Transactions Directions, 2025
- BleepingComputer (opens in a new tab), 2024, press reportBanks in Singapore to phase out one-time passwords in 3 months
- RinggitPlus (opens in a new tab), 2022, press reportBNM announces five additional safeguards against financial scams, including migrating from SMS OTP
- GMA News (opens in a new tab), 2025, press reportNo more SMS, email OTPs for high-risk financial transactions
- Gulf News (opens in a new tab), 2025, press reportNew rule: UAE banks to stop sending OTPs via SMS and email from July 25