SIM Swap Is Killing Trust in SMS

SMS OTP has become one of the most common ways for websites and apps to verify a phone number. The model is simple: enter your phone number, receive an SMS, enter the code, verified. It is convenient, familiar, and works almost everywhere.

But there is a fundamental assumption behind it: whoever controls the phone number controls the SMS messages sent to it. SIM swap attacks demonstrate why that assumption is increasingly problematic.

What is a SIM swap?

A SIM swap happens when an attacker convinces a mobile operator to move a victim's phone number onto a SIM card controlled by the attacker. Once the transfer is complete, calls and SMS messages intended for the victim can reach the attacker instead.

Europol and ENISA both describe SIM swapping as a way attackers can take over a phone number and then use intercepted messages to access other services. Europol / ENISA

The attack can look like this:

This is particularly dangerous because the attacker doesn't necessarily need to compromise the target application itself. They can attack the authentication channel.

The problem with SMS OTP

SMS OTP is often described as proof that a user controls a phone number. Strictly speaking, it proves something narrower:

That distinction matters. A phone number is not a physical device. It is an identity maintained by a telecom operator and associated with a SIM or eSIM. When that association changes, the authentication channel changes with it.

The European Payments Council explicitly identifies SIM swap and duplicate SIM fraud as mechanisms that allow attackers to obtain OTPs sent by financial institutions. European Payments Council

The FCC has similarly noted that fraudulent SIM swaps can make SMS-based authentication vulnerable because the attacker can receive the authentication messages. FCC Docs

So the traditional flow creates an interesting dependency:

What if we simply stop using SMS?

For high-security applications, moving away from SMS can make sense. Authenticator apps, passkeys and hardware security keys can provide stronger authentication mechanisms.

But SMS remains extremely attractive for many products because it has three major advantages:

• Almost everyone knows how to use it.
• It requires no app installation.
• It works across a huge range of devices and countries.

The question therefore isn't necessarily:

"How do we eliminate phone verification?"

It can instead be:

"How do we verify control of a phone account without sending a secret through SMS?"

That's where reverse OTP comes in.

Reverse OTP: let the user send the proof

Traditional OTP works like this:

The application generates a secret and sends it to the user's phone. Reverse OTP reverses the direction:

The application generates a unique verification token and gives the user a pre-filled message. For example:

The user taps the button. Their messaging application opens with the message already filled in, and they send it. The service checks the sender and the token. Phone verified.

There is no OTP to read. There is no code to copy. There is no SMS containing an authentication secret that needs to be intercepted.

Why this changes the security model

That can be a meaningful improvement.

An attacker who performs a SIM swap does not automatically gain access to an already-authenticated WhatsApp account on the victim's device. The legitimate user's existing messaging session can remain active on their device even after the underlying mobile number has been transferred.

This creates an important separation between control of the phone number and control of the messaging account/device session. That separation is precisely what SMS OTP lacks.

Reverse OTP vs. SMS OTP

Reverse OTP therefore isn't simply another way to send an OTP. It changes what is being verified.

A better mental model

Traditional phone verification asks:

"Can you receive a message sent to this number?"

Reverse verification asks:

"Can you send a message from the account associated with this identity?"

That distinction is particularly useful when the goal is proof of control, rather than simply delivering a secret.

But reverse OTP isn't magic

Some messaging services also use the phone number as part of their own account recovery or registration mechanisms. A SIM swap can therefore sometimes become a stepping stone toward messaging-account takeover.

The security properties depend on the messaging platform, its account/session model, and the exact implementation.

This is why reverse OTP should be understood as reducing reliance on SMS, not as a universal replacement for every authentication factor. For sensitive accounts, it can also be combined with stronger authentication mechanisms such as passkeys or authenticator-based MFA.

The bigger opportunity: stop treating SMS as the only phone-verification channel

The mobile number is increasingly becoming an abstraction. Users may interact through:

Yet many verification systems still assume that the only way to prove control of a phone number is to send an SMS containing a six-digit code. That's an unnecessarily narrow model.

Instead of asking:

"Which channel can deliver an OTP to this number?"

we can ask:

"Which channel can provide reliable evidence that this user controls the communication identity associated with the number?"

That opens the door to multiple verification flows.

Phone verification without the usual OTP

Reverse OTP is one example of this new approach. The user doesn't have to:

1. wait for an SMS,
2. open the message,
3. find the code,
4. return to the application,
5. type six digits.

They can simply tap:

Their messaging application opens with a pre-filled verification message. They send it. The server validates the message. Done.

For users, it can be simpler. For developers, it can remove SMS delivery costs and some of the operational problems associated with SMS OTP. And from a security perspective, it provides an alternative to putting the authentication secret into the SMS channel.

The future of phone verification is not necessarily another OTP

SMS OTP solved an important problem at a time when the phone number was the most universal digital identifier available. But the authentication landscape has changed.

SIM swaps, number portability, phishing, SMS interception and account-recovery attacks all demonstrate the limitations of treating a phone number as a perfect proxy for identity. Europol

The next generation of phone verification doesn't necessarily need to send a better OTP. It can change the direction of verification altogether.

Instead of sending users a secret, let users send a proof. That's the idea behind Reverse OTP.

And it is one of the ways phone verification can become simpler, cheaper and less dependent on the weaknesses of SMS.