SMS OTP Security vs. Passkeys: Which Is More Reliable? Choose by Account Tier

Bundling all core asset accounts to a single number that is easily reclaimed by the carrier can cause all defenses to collapse simultaneously in the event of a SIM swap attack. The correct approach is not to blindly abandon certain technologies, but to configure layers based on account value and the stability of number control.

The same SMS delivered to a shared pool number versus a dedicated long-term renewable number yields different control stability; services like NexSMS distinguish between short-term numbers and renewable long-term local numbers precisely to match this need for long-term possession of the verification entry point.

The real weakness of SMS OTP lies in number control

Many people discussing SMS OTP security often focus on whether the six-digit code is complex enough or whether its validity period is too short. In reality, these technical parameters are not decisive. SMS verification codes are essentially temporary tokens whose security fully depends on "who controls this number at this moment" and "whether the number can be intercepted by a third party."

If the verification entry point is tied to a number in a shared pool, lacking transparent qualifications, or easily reclaimed by the carrier, even high encryption strength won't help if an attacker gains control of the number through social engineering (e.g., SIM swap) and intercepts all verification codes. Conversely, if the number is personally owned long-term with strict identity protection, SMS as a second factor still offers considerable protection. Therefore, the key is not "whether to disable SMS" but "what number the verification entry point for this account is attached to, and whether there is a stronger credential as a fallback."

Why SMS OTP is classified as a restricted authenticator

The U.S. National Institute of Standards and Technology (NIST) SP 800-63-4 standard explicitly classifies SMS OTP delivered via PSTN/telecom networks as a "Restricted Authenticator." This classification does not prohibit its use but imposes strict limitations on its applicable scenarios. The standard requires that any organization continuing to use SMS verification must also provide unrestricted alternative credentials (such as Passkeys/FIDO2) and implement mandatory risk mitigation measures against SIM swapping and man-in-the-middle attacks.

The scope of this document primarily targets compliance benchmarks on the institutional side, aiming to push the industry from relying solely on telecom networks toward multi-factor integration. For ordinary users, this means more strong authentication options will become available, and SMS may be relegated to a backup role, but it won't disappear immediately. Understanding this helps us realize that policy guidance is about adding choices, not taking away rights.

Coverage differences of three credential types across attack chains

To visually compare the effective boundaries of different verification methods, we break down common attack chains into three links: number control transfer, transmission and phishing relay, and terminal/credential theft. The table below shows the defensive capabilities of three mainstream credentials in each link:

It's clear that whether SMS codes or authenticator apps are more secure depends on the threat model. Authenticator apps operate independently of the carrier channel, solving number hijacking, but they can still be compromised in real-time relay attacks against advanced phishing sites. Passkeys, by binding to the site's domain, effectively block forwarding phishing, but their recovery paths are highly dependent on device state and cloud sync, so no absolutely perfect solution exists.

Number attributes determine actual security level

Even when receiving SMS, the nature of the number that carries it determines the actual security level. In recent years, global telecom regulation has tightened, particularly the FCC's proposed Robocall Mitigation Scorecard in September 2026 and enhanced KYUP (Know-Your-Upstream-Provider) reviews, which are accelerating the removal of low-quality shared number sources lacking transparent numbering qualifications.

Increased compliance pressure on upstream lines means that cheap SMS receiving platforms relying on abuse-prone pools will face frequent disconnections and residual binding risks. If an account's verification number belongs to such unstable shared resources, its SMS OTP security is nonexistent. In contrast, dedicated, renewable long-term local numbers with full identity authentication differ fundamentally in control stability. When selecting a number, users should prioritize attributes that prevent easy re-receipt by third parties, which is more fundamental and critical than simply changing verification technology. For specific mechanisms regarding whether virtual numbers can be reclaimed by carriers, policy differences in the number's jurisdiction often apply.

Account tiering and verification strategy recommendations

Based on the above analysis, we can divide accounts into three tiers and adopt different verification strategies. Tiering essentially balances security and recoverability: the stronger the primary credential, the harder recovery tends to be.

For the question of what to do for accounts that only support SMS verification, the answer is not to forcefully disable SMS (as you might lose access) but to harden the security of the carrying number. For example, avoid exposing the number publicly, increase barriers for carrier-side changes, or migrate it to a reputable long-term number pool. Additionally, be wary of the reverse exception: if you completely disable SMS options, and the passkey device is lost or cloud sync fails, your recovery chain may break due to lack of a backup channel. Therefore, retaining a relatively secure SMS backup channel is often a necessary compromise.

Current status of carrier network-level silent verification

Another technological route being advanced is the GSMA Open Gateway. Currently, this system connects over 86 mobile operator groups and more than 300 communication networks, covering over 80% of global cellular connections. Its CAMARA Number Verification API v2 and SIM Swap API aim to perform silent verification at the network level, thereby avoiding eavesdropping risks inherent in plaintext SMS transmission.

However, this technology is still in the early stages of commercial deployment. The rollout schedules of major cross-border applications in specific countries have not been publicly disclosed, and for cross-border and roaming scenarios, traditional SMS and email OTP remain mainstream. Therefore, it should be viewed more as a future trend indicator rather than a mature tool that can immediately replace existing solutions. Enterprises planning long-term identity architecture can monitor these developments but should not overly rely on network-level capabilities that are not yet widely available.

FAQ

If I lose my passkey after changing devices, can I still log in with SMS?

It depends on platform settings. Most platforms supporting passkeys allow configuring backup methods like SMS or email. But if you disabled these backup channels during setup and lose the primary device, you may risk losing access to your account. It is recommended to keep at least one independent backup verification method.

Should I disable SMS options for daily accounts?

It's not advisable to "one-size-fits-all" disable. For high-value accounts, downgrade SMS to a backup channel rather than the primary verification method; for low-risk accounts that only support SMS, ensure the stability of the carrying number. The key is to establish a hierarchy: strong credentials first, weak credentials second, rather than a simple either-or.

Is an authenticator app more secure than SMS?

In terms of preventing SIM hijacking, authenticator apps are more secure because they don't rely on telecom networks. However, against real-time phishing, both have limitations. Overall, authenticator apps provide a higher baseline security than SMS, suitable for most daily scenarios, but still not as anti-phishing as passkeys.

It is recommended that readers first rank their verification entry points by account value, moving root accounts to unrestricted credentials, and migrating SMS-only accounts to numbers they can hold long-term; if you need to choose by country and distinguish between short-term registration numbers and renewable long-term local numbers, you can configure them separately on NexSMS based on use case, avoiding putting all verification entry points on a single number.