The Six-Digit Code Is Becoming Illegal
For twenty years the six-digit SMS code has been the quiet workhorse of financial security. You enter your password, a code arrives by text, you type it back, you’re in. Banks built their fraud defenses on it. Regulators accepted it. Customers learned the ritual. It felt like security.
It is now being banned. Not deprecated, not discouraged, in a growing number of markets, actively prohibited for financial institutions. And the reason regulators are moving against it is worth understanding, because it’s not a fashion. It’s that the SMS code never actually did the job people believed it did.
Three regulators, three continents, one conclusion
Central banks that don’t coordinate with each other have, within a short span, reached the same verdict about SMS one-time passwords. In the UAE, the central bank has moved to prohibit SMS and email OTP for licensed financial institutions. In the Philippines, the BSP has restricted SMS OTP for higher-risk transactions. In India, the RBI has pushed toward requiring genuinely independent authentication factors, which a texted code struggles to satisfy.
Different wording, different scope, different enforcement, but the same underlying judgement: the SMS code is no longer an acceptable control on its own. When regulators who aren’t talking to each other independently arrive at the same place, it’s usually because they’re all looking at the same failure.
Why the code never really worked
The weakness is structural, not a matter of implementation. The code has to leave the bank’s systems and travel across a mobile network the bank doesn’t control, to a SIM the bank can’t see, in a device it can’t verify. Everything that goes wrong with OTP goes wrong in that journey.
A SIM swap sends the code to the attacker’s phone, correctly, to the “right” number, which is now the wrong person. SS7 and signalling weaknesses let a message be intercepted in transit without the customer noticing anything. And smishing doesn’t need to break anything technical at all: the customer is simply tricked into reading the code aloud or typing it into a fake page. The code was designed to be read and repeated, which is exactly what makes it phishable.
In every one of these, the bank that sent the code has no way of knowing it went wrong. From the bank’s side, the code was delivered and entered correctly, so the transaction looks authenticated. It wasn’t authenticated. It was entrusted to a channel nobody in the chain controls, with a countdown timer attached. That’s not authentication. It’s a hopeful handoff.
What’s replacing it
The direction regulators are pushing toward isn’t a better code, it’s a shift away from sending a secret at all. Instead of transmitting something that can be intercepted, the newer approaches verify, at the moment of the transaction, whether the conditions of a legitimate transaction actually hold.
Is this SIM the one the account expects, in the device it expects? Has the SIM changed recently? Does the behaviour of this transaction fit the customer it claims to be? These are questions you answer by checking signals, not by mailing a password into the void. There’s nothing to intercept, nothing to phish, because nothing secret is in transit.
That’s a genuinely different model of authentication, and it has a consequence most of the coverage misses: it’s a data problem before it’s a security product. Answering “does this transaction fit this customer” in real time means having the customer’s behavioural history queryable at the moment of the transaction. Which is the real subject of the companion to this piece.
Why this matters now, not eventually
It’s reasonable to ask how long before your regulator reaches the same conclusion. The honest answer is that the direction is set. Once several central banks have independently named SMS OTP a liability, the others aren’t deciding whether to follow, they’re deciding when.
For a bank or an MFS provider, that turns a slow-burn risk into a near-term one. If your strong-authentication story still rests on a code sent by SMS, it now rests on a control that regulators are actively moving against and that your own fraud data is probably already showing you that it’s failing. The question is no longer whether to move beyond it, but whether you move before the regulation forces you to, or after.