SMS and voice OTP: a postmortem on borrowed trust
An OTP sent by SMS is not protected by the strength of the code. It is protected by the assumption that the message reaches the intended handset, and that assumption rests on a signalling system with no authentication between operators.
Why do SMS one-time codes fail?
Not because the code is guessable — six digits with rate limiting is fine as arithmetic. They fail because every practical attack obtains the code through the delivery path, and in three of the four cases the victim controls nothing in that path.
- The entropy of the code is irrelevant. Every practical attack obtains the code rather than guessing it.
- Four independent delivery-layer attacks exist, and the code's owner controls none of the systems involved.
- A signature bound to the action removes the delivery channel from the design, which removes all four attacks at once.
Part of Privileged identity and account recovery
The arithmetic nobody attacks
A six-digit code with a five-minute validity and rate limiting is, as a guessing problem, fine. One in a million per attempt, with attempts capped.
No attacker guesses. Every documented technique obtains the code through the delivery path, where the arithmetic does not apply.
Four ways to obtain the code
| Attack | Mechanism | What the victim controls |
|---|---|---|
| SIM swap | Port the number to an attacker-controlled SIM via carrier support | Nothing — the carrier decides |
| Signalling interception | Redirect delivery using inter-carrier signalling access | Nothing — requires no victim interaction |
| Insider at the carrier | Retail or support staff execute the swap | Nothing |
| Real-time relay phishing | Victim reads the code to a convincing caller or site | Only vigilance, under pressure |
The pattern in the third column is the argument. In three of four cases the victim has no ability to prevent the attack, and in the fourth they are defending against a professional who chose the moment.
Why the signalling layer cannot simply be fixed
The core inter-carrier signalling protocols were designed when the participants were a small number of national monopolies who could reasonably trust one another. There is no cryptographic authentication between network elements because none was thought necessary.
Today the roaming ecosystem involves thousands of operators and intermediaries across every jurisdiction. Access to the signalling network is obtainable, and filtering deployed at operator boundaries is partial and inconsistent.
Newer generations improved this and did not remove it, because interoperability with older networks is a commercial requirement. The weakest participant in a roaming chain sets the effective security level.
The phishing property that matters most
An OTP is a bearer secret with no binding to context. Nothing in the code says which site requested it, or which transaction it authorises.
# What the user receives
"Your verification code is 419 882."
# What it does not say
# which site asked
# which action it authorises
# whether the requester is who they claim
# So a relay works perfectly:
victim → [attacker's site] → real site
code entered here code replayed hereCompare a bound assertion: the authenticator refuses to sign for an origin other than the registered one, and the signature covers the specific action. The relay has nothing to relay.
Ranking the alternatives honestly
| Method | Delivery-layer attacks | Phishing-resistant | Notes |
|---|---|---|---|
| SMS / voice OTP | All four above | No | Widely deployed; the baseline being replaced |
| Authenticator app (TOTP) | None — no delivery | No — relayable | A large improvement; still a bearer secret |
| Push approval | None | Partially — fatigue attacks work | Better with number matching and context display |
| Hardware-bound assertion | None | Yes — origin bound | Requires enrolment and a recovery story |
The second row is worth noting for organisations that cannot deploy hardware credentials everywhere. Moving from SMS to a TOTP application eliminates three of the four attacks for very little cost, and is a defensible interim step.
Where SMS legitimately remains
Two honest cases. As a notification channel — telling someone an action occurred, which is useful even if it cannot authorise anything. And as an account-recovery signal of last resort in consumer contexts where the alternative is permanent lockout for a large population.
What it should not be is the control on money movement, credential changes or administrative access. Those are exactly the actions the four attacks are used to reach.
A migration that does not strand users
- Stop adding SMS as an option for new high-value accounts today. This costs nothing and stops the problem growing.
- Move SMS from authorisation to notification for existing users — they still get the message, it just no longer authorises anything.
- Enrol a second factor that is not telephone-dependent, starting with accounts that can move money.
- Keep SMS in recovery only where removing it would lock out a population you cannot otherwise reach, and rate-limit what a recovered account can do immediately.
Why the signalling layer cannot simply be fixed
The core inter-carrier protocols were designed when participants were a handful of national monopolies who could reasonably trust one another, so there is no cryptographic authentication between network elements. Today the roaming ecosystem spans thousands of operators and intermediaries, and the weakest participant in a chain sets the effective security level.
| Method | Delivery attacks | Phishing-resistant |
|---|---|---|
| SMS or voice OTP | All four | No |
| Authenticator app (TOTP) | None | No — relayable |
| Push with number matching | None | Partly |
| Hardware-bound assertion | None | Yes — origin bound |
The second row is the practical move for organisations that cannot deploy hardware credentials everywhere. Moving from SMS to a TOTP application removes three of four attacks for almost nothing.
Objections and honest limits
“SMS is better than nothing.” For password-only accounts against credential stuffing, yes. It is inadequate as the control on money movement or administrative access, which is where it is most often relied on.
“Would a longer code help?” No. Nothing guesses the code. Every attack obtains it, and the length of what is obtained does not matter.
A migration that does not strand users
- Stop offering SMS to new high-value accounts today. Costs nothing, stops the problem growing.
- Move SMS from authorisation to notification. Users still get the message; it no longer authorises.
- Enrol a non-telephone factor, money-moving accounts first. Where the loss is.
- Keep SMS in recovery only where removal would strand a population. And rate-limit what a recovered account can do immediately.
Terms used here
- SIM swap
- Porting a number to an attacker-controlled SIM by deceiving carrier staff.
- Signalling interception
- Redirecting message delivery using inter-carrier signalling access, requiring no victim interaction.
- Bearer secret
- Something whose possession alone grants access — which is why a code carries no context about who requested it.
Frequently asked questions
Is SMS OTP better than nothing? Yes, for password-only accounts against credential stuffing. It is inadequate as the control on money movement or administrative access.
Does a longer code help? No. No practical attack guesses the code; every one obtains it through the delivery path.
Are authenticator apps enough? They remove SIM swap, signalling interception and carrier insiders — three of four attacks — for low cost. They remain relayable by real-time phishing.
When is SMS still appropriate? As a notification that an action occurred, and as last-resort recovery in consumer contexts where the alternative is mass lockout.
Where this fits in Manav
Manav requires a fresh assertion bound to the specific action, from a credential under the person's sole control and verified against a published key.
Sources and further reading
- NIST SP 800-63B — Authentication and authenticator management
- Published research on SS7 and Diameter signalling interception.
- FCC — protecting consumers from SIM swap and port-out fraud
- W3C Web Authentication: An API for accessing Public Key Credentials Level 3