{
  "slug": "sms-otp-is-not-authorization",
  "title": "The one time code is a delivery receipt, not a decision.",
  "summary": "SIM swap losses fell to about $17M in 2025. Per incident severity did not. Why an SMS code proves delivery and never intent, and what to require instead.",
  "lede": "SIM swap losses reported to the FBI fell to roughly $17 million in 2025, and that decline is real progress worth acknowledging. It is also the least interesting fact about the problem, because the codes that survived the cleanup are still guarding the endpoints where a single mistake is unrecoverable.",
  "date": "2026-09-23",
  "reading_time": "18 min read",
  "category": "Security",
  "tags": ["SIM swap", "SMS OTP", "account recovery", "MFA", "authorization", "phishing", "passkeys"],
  "image": "https://cdn.twc.sh/images/igcache/SMS%20OTP%20Not%20Authorization/1200_630/blog.jpg",
  "url": "/blog/sms-otp-is-not-authorization.html",
  "wordcount": 4730,
  "related": ["passkey-recovery-weakest-link", "passkeys-prove-login-not-transaction", "add-authenticator-takeover"],
  "schema": "Article"
}