Just in case anyone is wondering why so many banks and wallets around the world continue to rely on SMS OTPs for 2FA. Lets take a look from their perspective:

Just in case anyone is wondering why so many banks and wallets around the world continue to rely on SMS OTPs for 2FA. Lets take a look from their perspective: - Any type of hardware device screams cost. Not just the device cost. The distribution cost, support cost, replacement cost, costs related to the education of users that can barely find their way around a computer/phone. - Requesting the user to install additional 3rd party applications is also out the window. Compliance, Confusion. Requesting them to go through a process to set up some key with google also due to the same reasons. At least until it manages to become part of the sign-up process on android and the number of older android versions is <5%. And it works on all the flavours of android (think cheap chinese handsets). And central banks are ok with it. - Just using a mobile banking application? Shake the phone to verify? Works when you are using it to verify an internet banking session. Doesn't when someone has downloaded a mobile banking app and knows your PIN. This is the reason why SMS OTPs were introduced on banking apps in the first place. The second factor wasn't the device itself, it was possession of the SIM. >> The problem with sending people codes over SMS is that SMS is trivial to spoof and intercept. Its not that trivial to spoof an SMS at least through the carriers Ive worked with. Alphanumeric codes are locked down and banks use these. Ditto with interception. Not fort knox by any means (any telco engineer can read SMS, as can prob numerous people in the middle if they really tried), but its expensive and not very scalable. And yes, there have been examples of fraud. But note literally hundreds of billions of dollars is secured by 6 digit pins and SMS OTPs worldwide and the banking system hasn't imploded. >> It's trivial to port/sim swap/steal someone's phone number Sort of. It may be trivial to do these things, but it's not that scalable. And thats the reason it banking systems using SMS 2FA dont all fall over due to fraud. Also in many countries SIM cards are now linked to national IDs, leading these particular vectors to be less scalable. >> begin phasing it out immediately. Finally, id never rely on SMS OTP. I agree completely they need to go. And so do banks! They spend millions on them each year. They arrive late. They rarely work when users are abroad. Everyone would be glad to see the back of them. But its not something possible to just switch off. At best we can push to support better forms of authentication to enable advanced users to migrate. While layering in further controls on top of SMS OTPs to minimise the impact of its insecurity until better forms of authentication are widespread. PS Im not sure what happened to Dorsey, but if twitter are resetting passwords via SMS then its probably deserved!