The short answer
NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
Key takeaways
- SMS and voice OTP remain permitted under Revision 4, but as restricted authenticators.
- Synced passkeys are accepted at AAL2 as a phishing-resistant option.
- US banks aren’t directly bound by NIST, but examiners and auditors use it as a benchmark.
- Several markets abroad have already ordered banks off SMS codes for some transactions.
What changed in NIST SP 800-63-4?
NIST’s Digital Identity Guidelines are the reference US agencies must follow and that banks, auditors and examiners reach for when they argue about authentication. Revision 4, finalized in 2025, is split into three volumes: identity proofing (63A), authentication (63B) and federation (63C).[1]
For SMS, the headline is continuity. Codes sent over the phone network stay on the list of allowed authenticators, in the same “restricted” category NIST created in Revision 3. What’s new is the alternative: Revision 4 explicitly accommodates synced passkeys, the kind stored in Apple, Google or password-manager accounts, and treats them as phishing-resistant.[2]
What does “restricted” actually require?
An organization that keeps offering SMS or voice codes takes on four obligations:[1]
- Offer an alternative that isn’t restricted, so no customer is stuck with SMS.
- Tell users the risks of the restricted option in plain language.
- Assess the risk to users and the organization of continuing to allow it.
- Keep a migration plan in case the authenticator is removed in a future revision.
How do the alternatives compare?
| Method | Phishing-resistant? | NIST 800-63B-4 |
|---|---|---|
| SMS or voice OTP | No | Restricted |
| Authenticator app code (TOTP) | No | Allowed at AAL2 |
| Synced passkey | Yes | Allowed at AAL2 |
| Hardware security key (FIDO2) | Yes | Eligible for AAL3 |
| Carrier / SIM-based verification | [Editorial: confirm] | [Editorial: confirm classification] |
Will the US follow the UAE and ban SMS codes?
Probably not by decree. US banking regulators rarely name a technology, and the FFIEC’s 2021 authentication guidance is written in terms of risk, not methods.[4] The pressure is arriving from other directions: NIST’s conditions, the FCC’s 2023 SIM-swap and port-out rules for carriers,[3] and a growing list of markets where the codes are already gone.
- 2022: Malaysia’s central bank directs banks off SMS OTP.
- Jul 2024: Singapore banks begin phasing out OTP logins for customers with digital tokens.[5]
- 2025: NIST finalizes SP 800-63-4.[1]
- Mar 2026: The UAE completes its SMS and email OTP phase-out.[7]
- Apr 2026: India’s RBI Authentication Directions take effect.
- Jun 2026: The Philippines bars SMS and email OTP for high-risk transactions.[6]
[Expert quote: from a named bank CISO or head of fraud, gathered in original reporting.]
What should a bank do this quarter?
- Inventory every flow that still sends a code: login, step-up, password reset, new payees.
- Write the risk assessment NIST asks for, and date it.
- Offer a phishing-resistant option, passkeys first, and track adoption.
- Start with account recovery and new-payee setup, where SIM-swap fraud tends to cash out.
Frequently asked questions
Does NIST 800-63-4 ban SMS OTP?
No. It classifies SMS and voice codes as restricted: allowed, with conditions.
Do US banks have to follow NIST 800-63?
Not directly. The guidelines are written for federal agencies, but examiners and auditors often use them as the benchmark.
Is email OTP safer than SMS?
Not by much. Email codes can be phished the same way, and the UAE and Philippine rules phase out both together.
What are banks replacing SMS OTP with?
Mostly passkeys, approvals inside the bank’s own app, and network-based checks run with the customer’s mobile carrier.
Sources
- NIST. SP 800-63B-4: Authentication and Authenticator Management.
- FIDO Alliance. NIST cites phishing resistance of synced passkeys in digital identity guidelines update.
- Federal Register. Protecting Consumers from SIM Swap and Port-Out Fraud (FCC 23-95), Dec 8, 2023.
- FFIEC. Authentication and Access to Financial Institution Services and Systems, Aug 11, 2021.
- Monetary Authority of Singapore. Banks in Singapore to strengthen resilience against phishing scams, Jul 9, 2024.
- GMA News. No more SMS, email OTPs for high-risk financial transactions starting June 25.
- The Paypers. UAE banks cancel OTPs, switching to in-app verification.
- Added the Philippines’ BSP Circular 1213 to the timeline.
- Published.