NexSms官方博客
The Facts Already in Motion: Zscaler Retires SMS OTP, NIST Lists It as a Restricted Authenticator
On August 7, 2026, Zscaler officially ended support for SMS OTP as an MFA method in its Authentication Service (source: Zscaler Help Portal, "End-of-Support for SMS OTP Authentication in Authentication Service"), requiring enterprise users to migrate to TOTP or FIDO2. Meanwhile, NIST Special Publication 800-63B (August 15, 2025 edition) had already classified OTPs delivered via PSTN/SMS as "Restricted Authenticators," mandating that service providers inform users of risks, offer non-restricted alternatives, and prepare migration plans.
This is not a blanket ban on SMS verification codes, but a clear signal of tightened standards and vendor implementation. For individuals and cross-border teams still relying on SMS codes, the end of SMS OTP support is just the beginning—you need to reassess authentication methods for every account and prioritize SIM swap attack protection.
The Full Chain of a SIM Swap Attack: What Happens After Your Number Is Transferred
The path of a SIM swap attack is not complicated: attackers use social engineering to transfer your phone number to a SIM card they control. CISA, in its "Mobile Communications Best Practice Guidance" (March 13, 2026), pointed out that SMS-based verification channels are highly susceptible to SIM swap and social engineering transfer hijacking; other transfer methods have been reported in public media, but this article makes no assertions about them.
Once the number is transferred, attackers can use SMS verification codes to reset your email, social media accounts, and even bank account passwords, causing cascading losses. This is why the risk of SMS code interception cannot be ignored: the SMS channel inherently has the weakness of number ownership being tampered with.
Why Protection Focuses on the Number Layer: The Cascade Failure of Using One Primary Number for All Verification
Many cross-border operators habitually use a single primary number to bind all overseas platforms, banks, and social accounts. If this primary number is SIM-swapped, all accounts relying on SMS verification become exposed simultaneously—after the primary number is transferred, attackers can pick off accounts one by one, and your identity verification system collapses instantly.
CISA's advice is to "minimize the exposure of your primary number": do not attach all verifications to one number. The core of SIM swap attack protection is not just upgrading authentication methods, but first reducing the primary number's exposure. Even if you cannot immediately migrate all accounts to TOTP/FIDO2, separating SMS verification needs from the primary number to an isolated number can significantly reduce the risk of total collapse.
Account Tiering: Which Accounts Must Leave SMS, and Which Can Only Stay on SMS
Based on account value and sensitivity, you can categorize accounts into four tiers:
| Account Type | Typical Examples | Authentication and Carriage Actions |
|---|---|---|
| Financial | Banks, payment platforms, crypto exchanges | Must prioritize migrating to TOTP or FIDO2; if the platform only supports SMS, consider abandoning or switching platforms |
| Identity Hubs | Primary email, social media, cloud services | Must enable TOTP or hardware keys, as these are springboards for attackers to access other accounts |
| Business Operations | Cross-border e-commerce stores, ad accounts, developer accounts | If the account is a recovery channel for other accounts, or requires cross-timezone collaboration to receive codes, prioritize migrating to TOTP; otherwise, rebind to an isolated number |
| One-time Registration | Temporary logins, promotional account registrations | If cross-timezone collaboration is needed for receiving codes, or for one-time use, SMS can continue, but use an isolated number to avoid occupying the primary number |
NIST SP 800-63B requires systems using restricted authenticators to inform users of risks, offer non-restricted alternatives, and prepare migration plans; this requirement applies to digital identity systems that follow the guideline. Whether ordinary commercial platforms offer TOTP/FIDO2 depends on their own policies, so in practice you should check each platform's security settings page individually.
Number Reassignment: What Short-lived Disposable Numbers and Renewable Long-term Local Numbers Each Handle
For accounts that still must use SMS verification, it is recommended to remove the carriage number from the primary number. CISA suggests reducing the primary number's exposure, and number isolation is the most direct way to implement this advice.
- Short-lived disposable numbers: Suitable for one-time registrations, trials, temporary verifications. Dispose after use to avoid residual risks from long-term binding.
- Renewable long-term local numbers: Suitable for business accounts requiring long-term login and password recovery. These numbers must be local and continuously renewable; otherwise, carriers may reclaim them, causing your account recovery channel to fail. For example, if you forget to renew a long-term number and it is reclaimed, an attacker could re-register that number and receive your verification codes, hijacking the recovery channel; therefore, set up auto-renewal or expiration reminders.
Professional services can assist with number isolation. When selecting tools based on the above points, NexSMS offers multi-country number selection, short-lived numbers, and renewable long-term local numbers, with web-based code reception and developer APIs. It should be noted that such services serve to "reduce primary number exposure" and do not change the security nature of the SMS protocol itself, nor can they immunize against all attacks, but they effectively prevent total collapse of the primary number.
If a SIM Swap Has Already Happened: Loss Mitigation Sequence and Preset Recovery Paths
If your phone number has been SIM-swapped, your reaction speed is critical. Remember this loss mitigation sequence:
- Contact your carrier immediately: Freeze the number or restore ownership, prioritizing carrier customer service or physical stores. If immediate restoration is not possible, temporarily disable SMS forwarding on that number to prevent continuous code interception.
- Change passwords by value order: Start with financial accounts, change passwords, and revoke all sessions. Financial accounts are prioritized because financial loss is irreversible and attackers often attempt transfers first; after changing passwords, immediately revoke all sessions to prevent attackers from maintaining logged-in states.
- Check binding information: Confirm whether attackers have altered your recovery email, phone, or payment methods. Also check the forwarding rules and recovery options of your recovery email, to prevent attackers from indirectly controlling other accounts via email.
- Replace recovery channels: For accounts with SMS as the only recovery method, switch to TOTP or rebind to an isolated number as soon as possible. If rebinding is temporarily impossible, temporarily disable the SMS recovery function for that account and increase login verification strength.
These steps should be rehearsed in advance, with contact numbers, account lists, and operational sequences documented, not improvised in the heat of the moment.
Implementing the Number Isolation Layer: Country Selection, Web Code Reception, and API Reception Practices
When building a number isolation layer, note the following:
- Country selection: Choose a number from the platform's region, e.g., a US number for US accounts, to improve reception success rates.
- Web code reception and APIs: Individuals or small teams can use a web dashboard to manually view codes; developers or teams can use APIs to automatically receive and distribute codes, improving efficiency.
- Number-account mapping: Record which accounts each number is bound to, avoid confusion, and set renewal reminders for long-term numbers.
When selecting tools based on the above three points, NexSMS offers multi-country number selection, short-lived numbers, and renewable long-term local numbers, with web code reception and developer APIs. It addresses the issue of over-exposed primary numbers, not as a replacement for cryptographic protocols, nor does it change the security nature of the SMS protocol, nor can it immunize against SIM swap. Additionally, such services are only for receiving legitimate business verification SMS and must not be used to bypass platform identity verification or risk control rules.
Pre-Launch Self-Checklist
After completing the above adjustments, please check against the following list:
- [ ] Has a PIN and anti-tamper lock been set on your carrier account?
- [ ] Which accounts remain bound to the primary number? Has it been emptied as much as possible?
- [ ] Have all accounts that support TOTP/FIDO2 been migrated?
- [ ] Have accounts still using SMS been rebound to isolated numbers?
- [ ] Have renewal reminders for long-term numbers been set?
- [ ] Has a post-SIM-swap loss mitigation document been created?
SIM swap attack protection is not a one-time action but a continuous optimization process. Spend half an hour listing the accounts bound to your primary number, categorize them, migrate high-risk accounts to TOTP/FIDO2, and build an isolation layer for the remaining SMS accounts—you can significantly enhance the resilience of your account security.
Comments(0)