SMS-based one-time passwords (OTP) have been a staple of two-factor authentication (2FA) for years. But as cyberattacks grow more sophisticated, SMS OTP is proving dangerously fragile. SIM swapping, phishing sites that steal codes in real time, and malware that reads text messages all compromise the security of SMS-delivered codes.
This article explains why SMS OTP is being phased out by regulators and security experts, how TOTP (Time-based One-Time Password) authenticator apps solve these vulnerabilities, and how to migrate your accounts to a more secure setup.
The Security Failures of SMS OTP
SMS OTP suffers from several fundamental weaknesses:
- SIM swapping: Attackers trick mobile carriers into transferring your phone number to their SIM card, then receive your OTP codes.
- Phishing: Fake login pages capture the OTP code as you type it and forward it to the attacker in real time.
- Malware: Trojan apps on your phone can intercept SMS messages and forward them to a remote server.
- Social engineering: Attackers impersonate banks or support agents to trick you into revealing the code.
Regulators worldwide are taking notice. In 2025, the Hong Kong Securities and Futures Commission (SFC) ordered brokers and virtual asset trading platforms to stop using SMS OTP for customer login and device binding, requiring phishing-resistant methods like passkeys or device binding. Singapore's MAS and Malaysia's BNM have issued similar guidance.
Why TOTP Authenticator Apps Are Better
TOTP (RFC 6238) generates a time-limited, six-digit code from a shared secret key stored on your device. The code refreshes every 30 seconds and is computed locally — never transmitted over a network. This eliminates the attack vectors that plague SMS:
| Threat | SMS OTP | TOTP Authenticator |
|---|---|---|
| SIM swapping | Vulnerable | Immune (key stored on device, not SIM) |
| Phishing | Code can be captured in real time | Code is ephemeral, but still phishable if user types it into fake site |
| Malware/SMS intercept | Vulnerable | Immune (no SMS involved) |
| Network interception | Vulnerable (SS7 flaws) | Immune (code generated locally) |
| Device theft | Code can be read from SMS inbox | Protected by device PIN/biometric |
While TOTP is not completely phishing-proof (a user can still be tricked into typing the code on a fake site), it eliminates remote interception and SIM-based attacks. Combined with device binding or passkeys, it forms a much stronger barrier.
How TOTP Works Under the Hood
TOTP is based on a shared secret key (usually a Base32-encoded string) and the current Unix time. The algorithm computes an HMAC-SHA1 hash of the time counter (number of 30-second intervals since epoch), truncates it, and extracts a 6-8 digit code.
The key is exchanged when you first set up 2FA — typically via a QR code that encodes an otpauth:// URI:
otpauth://totp/Example:user@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30
Your authenticator app stores this secret. Every 30 seconds, it recomputes the code. The server does the same, and if they match, you're authenticated.
Practical Migration: From SMS to TOTP
Here's how to migrate your accounts from SMS OTP to an authenticator app:
- Install an authenticator app: Google Authenticator, Microsoft Authenticator, Authy, or 2FAS are popular choices. For open-source, try Aegis (Android) or Raivo OTP (iOS).
- For each account: Go to security settings → enable 2FA → choose "Authenticator app" instead of "SMS". Scan the QR code with your app.
- Back up your secrets: Most apps allow encrypted backup. Authy syncs across devices; Microsoft Authenticator backs up to iCloud/Google account. Write down the recovery codes provided by each service.
- Test before disabling SMS: Keep SMS as a fallback until you've confirmed TOTP works.
- Remove SMS option: Once TOTP is stable, disable SMS 2FA entirely.
Worked Example: Securing a GitHub Account
Let's walk through migrating GitHub from SMS to TOTP:
- Go to GitHub Settings → Password and authentication → Two-factor authentication.
- Click "Enable two-factor authentication".
- Under "Authenticator app", click "Set up using an app".
- GitHub displays a QR code. Open your authenticator app and tap "+" to scan it.
- The app adds an entry named "GitHub: yourusername" and begins generating 6-digit codes.
- Enter the current code from your app into GitHub's verification field.
- GitHub shows a set of recovery codes — save them somewhere safe (password manager or printed).
- Confirm by entering another code from the app.
- Now go back to security settings and remove the SMS option if it was previously enabled.
Your GitHub account now uses TOTP instead of SMS. The secret is stored only on your phone and GitHub's server — never transmitted over SMS.
Common Pitfalls
- Losing your phone without backup: If you don't back up your TOTP secrets, you'll be locked out of accounts. Always save recovery codes or use an app with cloud backup.
- Clock drift: TOTP relies on accurate time. If your device's clock is off by more than a few seconds, codes won't match. Most apps auto-sync, but check if codes fail consistently.
- Using the same secret on multiple devices: Sharing the same TOTP secret across phones is convenient but reduces security. Use app-specific backup methods instead.
- Phishing still works: TOTP codes can be stolen if you type them into a fake website. Always verify the URL before entering any code.
- Not disabling SMS after migration: Leaving SMS as a fallback weakens your security. Attackers can still SIM-swap and request SMS codes.
FAQ
Can TOTP be hacked?
TOTP secrets are stored locally on your device. If an attacker gains physical access to your unlocked phone, they could export the secrets. Otherwise, remote attacks are very difficult. Phishing remains the biggest threat — never enter a TOTP code on a site you didn't intentionally navigate to.
What happens if I lose my phone?
If you backed up your recovery codes or used an app with encrypted cloud sync (e.g., Authy, Microsoft Authenticator), you can restore access. Without backup, you'll need to contact each service's support to prove your identity and disable 2FA.
Is TOTP better than push notifications?
Push-based 2FA (e.g., Duo, Microsoft Authenticator push) is generally more phishing-resistant because you approve a login request rather than typing a code. However, TOTP is still far more secure than SMS and works offline.
Should I use a hardware security key instead?
Hardware keys (FIDO2/WebAuthn) offer the strongest protection — they are immune to phishing and require physical possession. But they cost money and may not be supported everywhere. TOTP is a good balance of security and convenience.
How do I migrate from one authenticator app to another?
Most apps allow exporting secrets as a QR code or otpauth:// URI. In Google Authenticator, use "Transfer accounts" → "Export accounts". In Microsoft Authenticator, you can back up to iCloud/Google and restore on the new app. Alternatively, manually re-add each account by scanning the original QR code from the service's security settings.
Conclusion
SMS OTP is a dying standard. Its vulnerabilities are well-documented, and regulators are pushing for stronger methods. Migrating to a TOTP authenticator app is a simple, free step that dramatically improves your account security. Try it in our OTP Generator to generate and verify TOTP codes right in your browser.
Remember: no single security measure is perfect. Combine TOTP with strong passwords, device binding, and a healthy skepticism of unsolicited requests. Your accounts will be much safer.