Authentication Infrastructure · Global Policy & Engineering13 min readAmbiSecure

The Global Shift Away from SMS OTP: Why Hardware-Backed Authentication Is Becoming the Standard

Overview

Across financial services, telecom, digital identity, and cybersecurity ecosystems, the phased elimination of SMS-delivered one-time passwords as a primary authentication factor is accelerating. The shift is no longer confined to security best-practice commentary — it is being written into regulator mandates, central-bank circulars, agency advisories, and the product roadmaps of the largest identity platforms. SMS OTP is moving from "convenient multi-factor authentication" to "legacy mechanism increasingly incompatible with modern digital trust architectures".

This article traces the global direction across four jurisdictions, summarises the technology stack that is replacing it, and outlines why a SIM/eSIM-rooted, hardware-backed authentication layer is becoming strategically positioned for the post-SMS-OTP world. It is written for telecom operators, banks, regulators, fintechs, and enterprise identity teams thinking about the next-generation authentication substrate.

Why SMS OTP Is Becoming a Global Risk Concern

The fundamental weakness of SMS-delivered one-time passwords is structural, not implementation-specific. The authentication value becomes visible plaintext on the user's device at some point in the flow — inside the messaging inbox, on the lock-screen preview, in the notification shade, or on the screen of a remote-support tool. From that moment the security of the authentication is no longer a property of the protocol; it is a property of every actor and every piece of software that can observe the user's messaging surface.

The attack surface is well documented across the public security record:

SIM-swap fraud — duplicate SIMs issued through social engineering of operator KYC or compromised retail outlets reroute the OTP to the attacker.
SS7 and signalling-network exploitation — researched and demonstrated for over a decade, periodically resurfaced as banking-grade authentication is brought up to date.
Inbox-reading and SMS-forwarder malware — Android applications that hold SMS or accessibility permissions silently exfiltrate inbox content to an attacker-controlled server.
Remote-access and screen-sharing scams — AnyDesk, TeamViewer, and "support" applications installed under social-engineering pretexts let an attacker observe the OTP as it arrives.
Notification-listener abuse — apps with notification access (often granted for legitimate reasons such as wearables) capture lock-screen OTP previews.
Direct social engineering — by far the largest single pattern in retail-customer fraud, simply persuading the user to share the code that just arrived in their inbox.
Mule-account routing — once any of the above succeeds, the proceeds are rapidly fanned out across networks of mule accounts faster than recovery can move.

None of these patterns require breaking SMS as a protocol. They exploit the fact that the authentication secret is, by design, readable text on a software surface that was never engineered to be a security boundary. That is why the conversation has shifted from "tighten SMS delivery" to "move the secret off the inbox surface entirely".

Where the Regulatory and Industry Direction Is Moving

Four jurisdictions illustrate the direction. They differ in pace and instrument — central-bank mandate, federal-agency advisory, regional payments directive, sectoral circular — but the destination is the same: device-bound, phishing-resistant, hardware-anchored authentication, away from plaintext SMS.

United Arab Emirates — Central Bank phase-out by March 2026

The Central Bank of the UAE (CBUAE) has signalled a phased elimination of SMS and email OTP authentication for licensed financial institutions, with the transition expected to conclude in March 2026. The published direction favours app-based authentication, biometric verification, and stronger cryptographic methods anchored to the device. The CBUAE position is significant because it operationalises — at central-bank policy level — what has previously been an industry best-practice argument.

United States — FBI and CISA warnings against SMS-based authentication

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have both publicly cautioned against reliance on SMS-based authentication, citing escalating cyber threats, SIM-swap fraud, telecom interception risks, and phishing-driven account takeovers. The agencies' recommended direction is consistent: phishing-resistant multi-factor authentication, such as FIDO2-based authenticators and passkeys, for high-value access. SMS, while still better than no second factor, is no longer characterised as a defensible primary control for sensitive workflows.

European Union — PSD3, Strong Customer Authentication, and the passkey turn

The European Union's evolving payments framework — the proposed Payment Services Directive 3 (PSD3) and the Payment Services Regulation alongside it — extends the Strong Customer Authentication (SCA) requirements of PSD2 toward phishing-resistant, device-bound credentials. The direction is visible in the actual product behaviour of European banks and fintechs: in-app approvals, passkey enrolment, biometric verification, and cryptographically anchored credentials are becoming the default. SMS OTP is increasingly used as a fallback rather than the primary factor.

India — RBI Authentication Directions, 2025

The Reserve Bank of India's Authentication Directions, 2025 extend the country's two-factor authentication framework beyond SMS OTP, requiring regulated entities to support device-bound alternatives for domestic digital payment transactions over a transition period. The RBI's surrounding posture — the January 2025 circular on financial frauds perpetrated via voice calls and SMS, and the Master Direction on Cyber Resilience and Digital Payment Security Controls — places the authentication-modernisation conversation firmly inside the regulator's frame. We covered the India-specific picture in depth in a separate article on SMS OTP fraud in India; the structural direction is consistent with the international movement.

Global banking and fintech — SMS OTP as a "compliance liability"

Industry-wide guidance from banking and fintech security teams now openly characterises SMS OTP as a compliance liability rather than a modern security control. Migration paths in real deployments cluster around the same shortlist:

Device-bound, in-app approvals.
Biometrics — both platform (TouchID / FaceID / Android BiometricPrompt) and hardware-isolated.
Passkeys and FIDO2 / WebAuthn credentials.
Secure-element-anchored cryptographic credentials.
Risk-adaptive authentication engines that lift or lower friction based on behavioural and device-trust signals.

Major identity platforms reinforce the direction. Microsoft, for example, has publicly announced the gradual phase-out of SMS-based authentication for account sign-in and recovery, in favour of passwordless authentication and passkeys. The signal from a platform serving billions of consumer and enterprise identities matters as a leading indicator of where the broader ecosystem is heading.

What Is Replacing SMS OTP

The successor stack is not a single technology — it is a small family of credential models that share two structural properties: the secret never leaves a tamper-resistant boundary in usable form, and the authentication assertion is cryptographically bound to a device the user actually possesses. Specifically:

Hardware-backed credentials. Anchored in a Secure Element, eUICC, Trusted Platform Module, secure enclave, or equivalent. The credential is generated, stored, and used inside the hardware boundary; the operating system can request a signature but cannot extract the key.
FIDO2 / WebAuthn and passkeys. An open, phishing-resistant standard for public-key authentication. The relying party never sees a shared secret; the device proves possession of the credential via a cryptographic challenge bound to the origin.
Biometric verification — handled inside the hardware enclave on the device, with only a yes/no signal exposed to the OS.
Risk-aware adaptive authentication — additional signals (device identity, behavioural patterns, contextual risk) layered on top of a hardware-anchored credential, so the right level of friction is applied to the right transaction.
SIM/eSIM-rooted authentication. The SIM or eSIM is already a tamper-resistant secure element governed by operator-grade cryptographic standards. Authentication processed inside the SIM/eSIM boundary inherits those properties without requiring a separate token or hardware key.

Why Hardware-Backed Authentication Is Structurally Different

The shift is not about replacing one credential format with another. It is about moving the trust boundary. The table below summarises the structural difference between the two models on the dimensions that matter for fraud resilience and audit posture.

Dimension	SMS OTP	Hardware-backed authentication
Where the secret lives	Plaintext on the device messaging surface	Inside a tamper-resistant hardware boundary
User visibility of the secret	Yes — readable in inbox and notifications	No — the secret never leaves hardware in usable form
Phishing resistance	Low — the code can be read aloud, forwarded, or screenshotted	High — challenge-response is bound to origin or device, no transferable secret
SIM-swap resilience	Vulnerable — credential follows the SIM, not the user	Resilient — credential is bound to a specific hardware element, not the phone number
Malware exposure	Inbox-readers, notification-listeners, accessibility-services all expose the code	OS-level malware cannot extract the credential from the hardware boundary
Audit narrative	"An SMS reached a phone"	"A specific hardware credential signed a transaction-bound challenge"
Regulatory direction	Being phased out / restricted across UAE, US, EU, India	Increasingly favoured / mandated in the same jurisdictions

The properties on the right-hand column are not aspirational — they are how passkeys, FIDO2 authenticators, secure-element-anchored credentials, and SIM/eSIM-resident applets already operate when designed correctly. The question is which of those substrates is the right fit for which deployment.

Why SIM and eSIM Are Strategically Positioned

Among the family of hardware-backed credentials, SIM and eSIM occupy a distinctive position. They are tamper-resistant secure elements that:

Already sit inside every mobile device — no separate token, no enrolment hardware, no parallel distribution channel.
Are already bound to operator identity infrastructure — KYC, billing, signalling, and network-level identity all anchor to the same hardware root.
Are engineered to operator-grade cryptographic standards under widely accepted secure-element conventions — eUICC remote SIM provisioning (RSP), SIM-resident applet conventions, and operator-controlled identity binding. We covered the engineering substrate in eSIM vs eUICC vs iSIM and the platform layer in our eSIM/eUICC capability page.
Map naturally onto markets where mobile-number identity is the dominant credential for banking, payments, government services, and citizen-facing applications.
Bring the telecom operator into the trust model as a participant — not as a delivery medium that is bypassed.

That last property is strategically important. A passkey on a phone is a credential between the user and the relying party; the operator is incidental. A SIM/eSIM-rooted credential places the operator inside the trust path — relevant where the operator's identity infrastructure, regulatory posture, and national-scale reach are part of the value the architecture is supposed to deliver. For background on the engineering side, see hardware-backed identity and the telecom-authentication-meets-enterprise-PKI piece.

The Future Shape of Authentication Infrastructure

The direction of travel across the next several years is not difficult to read:

Device identity becomes load-bearing. The credential is bound to the device — and to a specific tamper-resistant element inside the device — rather than to the phone number or the inbox.
Cryptographic challenge-response replaces shared secrets. Both at the protocol level (passkeys, FIDO2, WebAuthn) and at the operator-integrated level (SIM/eSIM-resident applets).
Biometrics live inside the secure enclave. What the relying party sees is the cryptographic assertion — not the biometric template.
Risk-aware decisioning sits on top, not underneath. The hardware-anchored credential is the foundation; behavioural and contextual signals shape the level of friction.
Telecom-integrated trust becomes a category. SIM/eSIM-resident authentication, operator-collaborative architectures, and network-attested device identity become a recognised substrate alongside passkeys and platform credentials.

This is the architecture the next decade of digital identity is being designed against — and the substrate the modern banking, payments, telecom, and enterprise-identity ecosystems are converging toward.

Where AmbiSecure and Keyra Fit

The AmbiSecure SIM-Auth Platform is developing a telecom-grade authentication architecture built around the SIM/eSIM as the hardware trust anchor. Authentication is processed inside the tamper-resistant secure-element boundary already present on the SIM/eSIM, rather than delivered as plaintext to the device messaging surface. The relying party (bank, fintech, government service, enterprise identity team), the operator's infrastructure, and the SIM/eSIM identity layer participate in an authenticated flow without surfacing a code on the user's screen for malware or social engineering to harvest. The capability surfaces are documented across the SIM-based authentication, eSIM / eUICC, secure elements, telecom integration, and trust-chain architecture pages on this site.

The platform is brought together in collaboration with Keyra on next-generation authentication infrastructure, digital identity systems, secure hardware, eSIM-based trust models, telecom-grade identity, and phishing-resistant authentication architectures. Keyra's role is capability alignment on the trust-architecture and identity surface; the case-study page profiles Keyra as an execution-evidence proof point for the broader engineering substrate.

The substrate behind this work has carried identity and trust products through to public deployment in adjacent identity and infrastructure domains, with active engagement across European, African, and Middle Eastern markets, and an India-focused deployment posture aligned with the RBI's direction beyond SMS OTP. The implementation details — protocol design, applet behaviour, key custody, and operator-collaboration mechanics — are intended to be worked through with operator engineering and security teams, inside operator-controlled environments, on operator terms.

Conclusion

The global direction is unambiguous. The UAE Central Bank has set a 2026 horizon for SMS-OTP retirement in licensed financial institutions. The FBI and CISA have publicly cautioned against reliance on SMS authentication for high-value access. The EU's PSD3 framework is steering European banking and fintech toward phishing-resistant, device-bound credentials. The RBI's 2025 Authentication Directions have moved India's framework explicitly beyond SMS OTP. Microsoft, serving billions of consumer and enterprise identities, has begun phasing SMS out of its own account flows in favour of passkeys and passwordless authentication.

SMS OTP is not disappearing tomorrow. But the strategic direction has been set. The institutions building the next decade of digital trust are designing against a hardware-backed, device-bound, phishing-resistant substrate — and the SIM/eSIM, already deployed at national scale and already engineered to operator-grade cryptographic standards, is one of the credible foundations of that substrate. For telecom operators, banks, regulators, and enterprise identity teams thinking about where to invest authentication-modernisation budget, this is the architecture worth understanding.

Frequently Asked Questions

Why are regulators moving authentication beyond SMS OTP?

Public regulatory direction across the UAE, the United States, the European Union, and India treats SMS-delivered one-time passwords as a structurally weak authentication factor — exposed to SIM-swap fraud, interception malware, social engineering, and lock-screen disclosure. The current regulatory direction in each of these jurisdictions favours device-bound, hardware-backed, phishing-resistant alternatives.

What is the UAE Central Bank doing about SMS OTP?

The Central Bank of the UAE has signalled a phase-out of SMS and email OTP authentication for licensed financial institutions by March 2026, in favour of application-based authentication, biometrics, and stronger cryptographic methods. The direction is broadly aligned with global movement toward phishing-resistant authentication.

What have the FBI and CISA said about SMS-based authentication?

Both the FBI and CISA have publicly cautioned against reliance on SMS-based authentication, citing escalating cyber threats, SIM-swap fraud, telecom interception risks, and phishing-driven account takeovers. The agencies' direction favours phishing-resistant multi-factor authentication — including FIDO2 and passkeys — for high-value access.

How does the EU's PSD3 direction affect authentication?

The European Union's Payment Services Directive 3 and the surrounding Strong Customer Authentication framework are driving the market toward phishing-resistant, device-bound authentication models — including passkeys, biometric verification, and cryptographically anchored credentials. The direction is visible across European banking and fintech ecosystems.

What does "hardware-backed authentication" actually mean?

Hardware-backed authentication anchors the credential inside a tamper-resistant chip — a Secure Element, eUICC, TPM, or equivalent — so the secret never leaves the hardware boundary in usable form. The device produces a cryptographic challenge-response that proves possession of the credential without exposing it to the operating system, the messaging inbox, or the user.

Where do SIM and eSIM fit in this transition?

The SIM and eSIM are tamper-resistant secure elements that already sit inside every mobile device, are already governed by operator-grade cryptographic standards, and are already bound to the operator's identity infrastructure. They make a natural trust anchor for hardware-backed authentication — particularly in markets where mobile-number identity is the dominant credential and where the authentication trust layer is most valuable when built locally with the operator.

SMS OTP Hardware-backed authentication SIM authentication eSIM FIDO2 Passkeys WebAuthn Phishing-resistant MFA CBUAE PSD3 RBI Telecom-grade identity