SMS OTP security standards 2026: what NIST, PSD2, PCI DSS and central banks actually require

SMS one-time passwords are restricted, not banned, in the major standards in 2026. NIST SP 800-63B-4 (July 2025) classes SMS and voice codes as a "restricted" authenticator that is still allowed at AAL2 if the provider offers an alternative and explains the risk, but not at AAL3. Under PSD2, the European Banking Authority accepts an SMS OTP as a possession element. PCI DSS 4.0.1 requires replay-resistant, non-bypassable MFA without naming SMS. India's RBI explicitly kept SMS OTP from 1 April 2026. The real restrictions are narrower: banks in Singapore, Hong Kong, Malaysia, the UAE and the Philippines moved logins or high-risk transactions to app or device-bound authentication. Each requirement below links to its source.

The rules at a glance

NIST SP 800-63B-4: restricted, not banned

NIST published the final SP 800-63B-4 in July 2025, superseding 800-63-3. It treats one-time codes sent over the public telephone network (SMS or voice) as a **restricted authenticator** (section 3.2.9). A provider that uses one must offer at least one alternative that is not restricted, give users meaningful notice of the risks, account for them in its risk assessment and keep a migration plan; if the relying party judges the risk unacceptable, it must not be used.

• **Assurance levels:** out-of-band codes are allowed at AAL2, combined with a password or biometric, but not at AAL3, which requires phishing-resistant cryptographic authenticators. AAL2 verifiers must offer at least one phishing-resistant option.
• **Code rules:** at least 6 digits from an approved random generator, accepted only once, and valid for no more than 10 minutes; lock after no more than 100 consecutive failed attempts.
• **Risk signals:** before sending a code, verifiers should check for device swap, SIM change and number porting (a "should", not a "shall").
• **Email** shall not be used as an out-of-band authenticator.

For SIM-change and porting checks, see Number Verify and SIM Swap APIs and SIM swap fraud defence.

CISA: aimed at highly targeted people

CISA's Mobile Communications Best Practice Guidance of 18 December 2024 says: "Do not use SMS as a second factor for authentication," because SMS is not encrypted and "is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals". Its audience is senior government and political figures, and it recommends FIDO as the only phishing-resistant method. It is guidance, not a rule for consumer services.

EU: PSD2 accepts SMS OTP; PSD3 is not law yet

The regulatory technical standards on strong customer authentication (Delegated Regulation (EU) 2018/389), applying since 14 September 2019, set the bar for any one-time code used in payments:

• **Article 4:** the authentication code is accepted only once and cannot be forged; at most 5 consecutive failed attempts before a block; at most 5 minutes of inactivity after login.
• **Article 5 (dynamic linking):** the payer is shown the amount and payee, and the code is specific to them; any change invalidates it.
• **Article 7:** possession elements need measures against unauthorised use and replication.
• **Article 9:** elements must be independent; on a multi-purpose device such as a phone, separated secure execution and tamper detection are required.

The EBA confirmed in Q&A 2018_4039 that an SMS OTP can be a possession element if it is protected against replication, and its June 2019 opinion lists OTP via SMS as a valid possession element. PSD3 and the Payment Services Regulation reached political agreement in November 2025, but as of 22 October 2026 they are still awaiting final adoption and publication; we found no provision targeting SMS OTP in the agreed text.

PCI DSS 4.0.1: SMS is not named

PCI DSS 4.0.1 requires multi-factor authentication for all access into the cardholder data environment (requirement 8.4.2) and sets how MFA must work (8.5.1): resistant to replay, impossible to bypass without a documented, time-limited exception, using at least two different factor types, with every factor required to succeed. Both became mandatory on 31 March 2025. The standard does not prohibit SMS (reported wording; the standard itself is licence-gated); the PCI SSC's MFA information supplement only notes NIST's earlier caution about SMS.

Asia-Pacific regulators

• **Singapore:** MAS and the Association of Banks in Singapore announced on 9 July 2024 that major retail banks would phase out OTPs for login within three months for customers who have a digital token (MAS release). Customers with physical tokens were not affected.
• **Hong Kong (banks):** HKMA's circular of 14 April 2025 makes a bound device the default, instead of SMS OTP, for login and high-risk transactions, with targets in Q3 and Q4 2025. SMS OTP remains possible for customers without the app or who opt in (HKMA circular).
• **Hong Kong (brokers and virtual-asset platforms):** SFC circular 26EC35 of 9 July 2026 bars OTPs for client login and device binding, in favour of passkeys or bound devices, by 8 July 2027.
• **Malaysia:** Bank Negara Malaysia required financial institutions to migrate from SMS OTP to more secure authentication, announced on 26 September 2022 (BNM).
• **India:** the RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, require two factors with one dynamic from 1 April 2026; the RBI stated the framework "does not call for discontinuation of SMS based OTP" (RBI).
• **Philippines:** BSP Circular 1213, signed in May 2025, limits interceptable authentication such as SMS OTP for larger institutions, requires biometric, behavioural or passwordless methods for high-risk transactions and bars links and QR codes in SMS, with compliance due by June 2026 (BSP).

The Gulf

In the UAE, banks moved customers from SMS and email OTP to in-app authentication between 25 July 2025 and 31 March 2026, according to reports of the Central Bank's notice; no public CBUAE text was available. Non-bank senders in the UAE still use SMS OTP widely. See SMS OTP after the bank bans and the A2P messaging regulation timeline.

Common misconceptions

• **"NIST banned SMS."** No. SMS is a restricted authenticator, allowed at AAL2 under conditions and excluded only at AAL3.
• **"PSD2 forbids SMS OTP."** No. The EBA accepts it as a possession element; the hard requirements are dynamic linking and protection against replication.
• **"PCI DSS 4.0 bans SMS MFA."** No. It requires replay-resistant, non-bypassable MFA and does not name SMS.
• **"CISA told everyone to stop using SMS."** Overstated. The guidance targets highly targeted government and political individuals.
• **"PSD3 is already law."** Not as of 22 October 2026.
• **"India is phasing out SMS OTP."** No. The RBI explicitly did not require discontinuing it.
• **"Singapore banned SMS OTP."** Narrower: bank login, for customers with a digital token.

A checklist for SMS OTP that meets these standards

1. 1Generate codes of at least 6 digits from a cryptographically secure random generator; accept each once; expire them within 10 minutes (5 minutes is common for payments).
2. 2Limit attempts: PSD2 blocks after 5 consecutive failures; NIST allows at most 100 before lockout.
3. 3For payments in the EU, show the amount and payee in the message and bind the code to them (dynamic linking).
4. 4Check SIM-change and number-porting signals before sending a code to a high-risk session.
5. 5Offer at least one stronger alternative (app push, passkey, FIDO) and keep SMS as the fallback and recovery channel.
6. 6Keep OTP traffic transactional: no links or offers in the code message, which also keeps it outside marketing quiet hours and link blocks.
7. 7Send over direct, monitored operator routes protected by an SMS firewall, so codes are not intercepted, delayed or pumped.

BroadNet's OTP API delivers codes over 1,000+ direct operator connections with multichannel fallback; see multichannel OTP verification, from SMS OTP to passkeys and, for operators, SMS firewall and SS7 protection.

Frequently asked questions

Is SMS OTP still allowed in 2026?

Yes, in most standards. NIST SP 800-63B-4 classes it as restricted but allowed at AAL2, PSD2 accepts it as a possession element, PCI DSS does not prohibit it and India's RBI kept it. Some regulators, including Singapore's MAS, Hong Kong's HKMA and the Philippines' BSP, moved bank logins or high-risk transactions to stronger methods.

Did NIST ban SMS two-factor authentication?

No. NIST SP 800-63B-4 (July 2025) calls SMS and voice codes a restricted authenticator: providers must offer a non-restricted alternative, explain the risk and assess it. SMS is allowed at AAL2 but not at AAL3, which requires phishing-resistant authenticators.

Is SMS OTP PSD2 compliant?

It can be. The EBA's Q&A 2018_4039 accepts an SMS OTP as a possession element if it is protected against replication, and for payments the code must be dynamically linked to the amount and payee under Article 5 of the RTS on strong customer authentication.

Does PCI DSS 4.0 allow SMS for MFA?

PCI DSS 4.0.1 does not name or prohibit SMS. Requirements 8.4.2 and 8.5.1, mandatory since 31 March 2025, require MFA for all access into the cardholder data environment that resists replay, cannot be bypassed and uses at least two different factor types.

How long should an SMS OTP be valid?

No more than 10 minutes under NIST SP 800-63B-4, and each code may be used only once. Many payment flows use 5 minutes or less, in line with PSD2's inactivity limit.

Which countries restrict SMS OTP for banking?

Singapore (bank login, for customers with a digital token, from 2024), Hong Kong (bound devices by default for bank login and high-risk transactions in 2025; brokers by July 2027), Malaysia (migration required since 2022), the UAE (bank OTP moved in-app by March 2026, as reported) and the Philippines (high-risk transactions at large institutions, by June 2026).

Is PSD3 in force?

Not as of 22 October 2026. PSD3 and the Payment Services Regulation reached political agreement in November 2025 and are awaiting final adoption and publication in the Official Journal.

What is the most secure way to send an OTP by SMS?

Use single-use codes of at least 6 random digits that expire within minutes, limit attempts, check SIM-swap and porting signals for risky sessions, keep the message free of links, and deliver over direct operator routes protected by an SMS firewall, with a stronger method offered alongside.