Incognito Cat

Are Companies Negligent for Still Using SMS OTPs?

Are Companies Negligent for Still Using SMS OTPs?

Picture this: You’re sipping your morning coffee when your phone screen flashes "No SIM - Emergency Calls Only." Your stomach sinks. You try logging into your bank app, but the password fails. Same with your email. Nothing works. Then it hits you: someone else controls your digital life.

This isn’t just a scary story. It happens. In 2018, former Apple engineer Rob Ross lost his life savings in minutes after a SIM swap, as reported in Cybercrime Magazine’s "Former Apple Engineer Is The Victim Of A Million Dollar SIM Card Hack". A 75-year-old from Palm Beach lost over $200,000 when a fake AT&T rep tricked him into sharing a text code, according to Hoodline’s "Palm Beach County Woman Charged in Nationwide SIM-Swap Scam". Search "SIM swap victim" on Google, and the list grows. It’s a worldwide problem.

Worse yet, U.S. banks often leave victims empty-handed. ConsumerReports explains in "Sophisticated wire transfer scams targeting bank customers becoming more common" that the Electronic Funds Transfer Act doesn’t make banks refund losses from "authorized" fraud. The FBI’s 2024 Internet Crime Report shows SIM swap losses hit $25 million, and that’s only what’s reported. Many people, especially seniors, stay quiet about it.

What’s driving this mess? Let’s break it down with two big questions: What’s a SIM swap? And how does it drain your bank account?

What Is a SIM Swap?

Your SIM card, or its digital version called an eSIM, is like an ID badge for your phone. It ties your number to your device and carrier. A SIM swap happens when a thief steals that badge, moving your phone number to their device. The first clue? Your phone goes dead, showing "Emergency Calls Only."

How do they pull it off? Three main tricks:

Once they have your number, they hold the keys to your life. Why? Because banks rely on something shaky.

The Weak Spot: SMS OTPs

Banks use SMS-based One-Time Passwords (OTPs) for logins, transfers, and password resets. You’ve done it: type your username and password, get a code texted to your phone, then enter it online. Easy, right? Also risky. If a thief grabs your number through a SIM swap, they get that code too. Then your accounts empty out, and you’re stuck watching it happen.

It’s crazy. Your phone number turns into a weak link, like a flimsy lock on a treasure chest. The $25 million lost in 2024 shows this isn’t just a theory. Still, banks cling to SMS OTPs, blaming old systems, high costs, or people not liking change. Those reasons feel weak when your money disappears, and banks can shrug it off, saying "you approved it" under the Electronic Funds Transfer Act. Act quick, and you might save your cash. Most don’t.

Let’s dig deeper into why SMS OTPs are so vulnerable.

What Is an SMS, Anyway?

Think of your phone as a walkie-talkie, always quietly checking in with the nearest cell tower, saying, “I’m here!” These check-ins are called pings. They keep your phone connected for calls and texts.

A ping is like a small envelope with extra space. An SMS, or text message, is a short note that fits in that space. Instead of sending a fresh envelope, your phone slips the text into a ping it’s already sending. The tower grabs it, spots the message, and sends it to your friend.

This setup lets us send quick texts using what’s already there. But there’s a huge problem most people miss.

SMS Isn’t Safe

SMS wasn’t built to be secure. It was made for convenience. Texts are plain messages, not locked or scrambled for just you and the recipient. Carriers can read them and often save them. By design, anyone with access can peek.

Plus, texts travel using Signalling System No. 7 (SS7), a system from the 1970s meant for starting and ending calls across the global phone network. It lets you call anywhere, from next door to the other side of the world. But SS7 isn’t secure by today’s standards. A clever crook can watch, grab, or redirect your SMS OTP using an SS7 attack, without even touching your carrier or phone.

So, a key part of bank security rides on an unlocked message sent over a public road. Sound safe to you?

How Does a Bank Send an SMS?

SMS uses old phone systems, not the internet. To send a text, banks need a middleman called a gateway. Here’s the simple path an SMS OTP takes:

  1. Bank makes a code.
  2. Sends it to an SMS Gateway Provider.
  3. Gateway pushes it through the global telecom network (SS7).
  4. Carrier drops it on your phone.

This unscrambled code passes through lots of hands. At any step, a skilled hacker can snatch it in a smart attack. The bigger the prize, the trickier they get.

Are Companies Negligent?

By 2025, we have stronger, safer ways to log in, used even by tiny websites. Sticking to SMS OTPs feels careless. The SIM swap danger isn’t new; experts have warned about it forever. Countries like the UAE, Singapore, and India are dropping SMS OTPs. Groups like FINRA and the USPTO are too. Better choices are out there:

Banks dragging their feet isn’t just slow. It’s reckless.

Take Charge and Push for Change

For You: Protect Yourself Now

For Banks: Step Up

The Final Word

In 2025, using SMS OTPs isn’t just old-school. It’s a bet with your money on the line. You can guard yourself, but banks need to do better. Tell your lawmakers to push for rules that fit today’s risks.

Remember, we may not have anything to hide, but everything to protect.

Are Companies Negligent for Still Using SMS OTPs?

#DigitalPrivacy #Privacy #SIM #SIMSWAP #SMS #SMSOTP