One-Time Passcodes Are Gateway for Financial Fraud Attacks

Financial institutions have historically relied on one-time passcodes as a primary authentication control for their accountholders. But OTP verification is less reliable as fraudsters increasingly exploit SMS-based verification weaknesses to carry out account takeover and payment fraud schemes.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

A new report from threat intelligence firm Recorded Future reveals that attackers are intercepting OTPs to bypass authentication mechanisms, often as part of broader fraud campaigns.

The digitization of the banking industry has ushered in a rise in social engineering scams, with attackers impersonating banks and service providers to trick customers into sharing authentication codes in real time. This shift reflects an evolution in fraud tactics in which attackers no longer need to defeat security controls directly but instead exploit them during live interactions with victims.

Fraud is becoming increasingly structured and repeatable, pointing to the growing industrialization of fraud operations, the report said.

While Recorded Future researchers stopped short of declaring OTP obsolete, they warned that increasingly sophisticated and coordinated attacks are outpacing traditional fraud controls.

In many countries, OTP-based authentication is still widely used across digital banking and payments. Since the verification relies on real-time communication, successful exploits rely on socially engineering user behavior. Attackers can easily alter the sender information of an SMS message to make it appear legitimate and trick the victim into clicking on a malicious link. Researchers pointed out that users should always verify the authenticity of a message before clicking on any links in it.

Joe Toomey, head of security engineering at Coalition, said it’s time for organizations to reconsider relying on OTP-based authentication.

“I do not see any good explanation for businesses to use OTP. FIDO is the best and strongest solution that we have, and it requires some hardware support,” Toomey said, referring to a passwordless phishing-resistant authentication method.

OTP-based systems remain easy targets for attackers, particularly for smaller organizations, he said.

“You don’t have to be a Google or a Cisco to get hacked through OTP. It is pretty low-hanging fruit to carry out these attacks, and even small businesses can be affected,” he said.

While push fatigue attacks and SIM swapping remain common, one-time password session hijacking is now the most prevalent type of MFA bypass attack targeting Coalition’s policyholders, Toomey said.

“MDR and MFA are meaningful compensating controls. MFA helps with identity and access management, while MDR improves your ability to identify an adversary,” he said.

But those approaches don’t fully address the risks associated with SMS-based authentication. The grown of real-time payment systems, which compress to time available for detection, is another reason for concern for fraud management leaders.

Regulators in several markets have already begun to act on these risks, signaling a broader shift away from OTP-dependent authentication models.

The Reserve Bank of India in April announced updated digital payment authentication requirements that move beyond OTP-only verification, mandating multifactor approaches including device-based authentication and biometrics.

Singapore’s banking sector phased out SMS-based one-time passwords for account logins in October 2024, following a mandate from the Monetary Authority of Singapore and the Association of Banks in Singapore. Major retail banks replaced OTPs with app-based digital tokens to counter phishing attacks in which scammers impersonate financial institutions to hijack customer accounts. Last month, the United Arab Emirate phased out OTP verification in all banks.

Similarly, regulators in the Philippines are pushing financial institutions to reduce reliance on SMS-based authentication, while European regulations under PSD2 allow OTP use only under stricter conditions such as dynamic transaction linking and multi-factor requirements.

U.S. regulators, including the Federal Financial Institutions Examination Council and Consumer Financial Protection Bureau, view OTPs as a key part of multi-factor authentication under the Gramm-Leach-Bliley Act of 1999. But rising fraud such as SIM-swapping and social engineering may push regulators away from SMS-based OTPs toward more secure authentication methods.

The global regulatory response reflects a broader industry shift toward authentication models that combine multiple signals, including device identity, behavioral patterns and biometric verification.

While multifactor authentication is crucial for securing online accounts, SMS OTP is not the most secure form of MFA, said Rubaiyyaat Aakbar, head of IT and cybersecurity with an InsureTech startup in Singapore.

“Using WhatsApp OTP as a solution to address SMS OTP security issues could be a simple but effective solution as it offers end-to-end encryption and is cheaper than SMS,” he said. He added that single sign-on via social login is a good option for non-financial applications.

For financial institutions, the challenge lies in balancing security with user experience, particularly in markets in which OTP remains deeply embedded in customer journeys.

The report suggests that relying solely on traditional controls is no longer sufficient, as fraudsters continue to adapt and scale their operations.

As fraud becomes more industrialized and real-time in nature, authentication itself is emerging as a key battleground where widely used mechanisms such as OTP are increasingly being tested.

“Our authentication is a lot based on shared secrets like OTP. Hackers came up with pixel-perfect replica sites that you might be using as a consumer and they can trick you to hand over that OTP and the 30 seconds window is long enough for an account takeover,” said Jeremy Grant, managing director, managing director at Venable LLP.