It's apt to talk about SMS one-time passwords (SMS - OTP) on the 30th anniversary of the first SMS sent. Since then, we have sent SMS to the tune of 6 billion messages a day. SMS has truly stood the test of time with its simplicity and robustness as a messaging medium.
A large proportion of those messages sent every day are SMS one-time passwords. These messages typically contain a 6-8 digit code sent every time we sign in or transact, most prevalent in our internet banking experiences as an example.
Unfortunately, with the prevalence of SMS, we have seen the rise of SMS one-time password fraud. The most damaging in 2022 is Sim Swap Fraud. During the pandemic, Sim Swap fraud rose by 400%, and over $100 million worth of funds were extracted by cybercriminals.
What is Sim Swap Fraud?
SIM swapping occurs when scammers contact your phone's carrier and trick them into activating a SIM card owned by the fraudsters. When this happens, the scammers gain control of your phone number. Anyone dialling or texting this number will be connected to the scammer's device rather than your smartphone.
SMS is not secure anymore
Because of this inherent vulnerability with SMS and the fact that SMS is transmitted without encryption and easily intercepted, the National Institute of Standards and Technology has issued a deprecation notice for SMS as an authentication factor as far back as 2017.
In 2022, we are still seeing the impact of such risks associated with SMS with the most recent Twilio breach, which affected over 130 organizations, validating the guidance issued in 2017 by NIST.
We need an upgrade path out of SMS OTPs
It's now clearly untenable to keep relying on SMS as a means of authentication, which naturally begs the question of how to move away from using SMS. Because of its sheer scale and proliferation, this has become our generation's Y2k moment. Inaction will cause the risk posed by SMS to snowball. We've come up with some strategies on how we can start addressing these risks.
Give your users choice
Consumers are now screaming out for alternatives. Savvy digital natives are quickly realizing the risks associated with SMS and asking for secure alternatives.
Although there is a strong argument because of the perceived customer experience advantage that SMS provides, and the argument that it's better than not providing any form of step-up authentication. The risks now far outweigh the benefits, and with the rapid rise of authentication factors such as Authenticator Apps (Time-based One Time Passwords/TOTP) and browser-based biometrics, there are great alternatives that consumers are now accustomed to.
If completely removing SMS is not an option, the next best thing to do is to give your users a choice, a TOTP authenticator app at the least.
If SMS is your only option, protect and educate your customers
If there is no upgrade path or opportunity to provide choice, then there are great tools to ensure that Sim Swap fraud is mitigated.
One way to protect your customers is using a Sim Swap time stamp. Telco providers are now providing data in real-time of when Sim Swaps occur for a given phone number. When paired with logic like detecting a new device, your platform can add additional steps to verify the customer further.
Start Now
There is no time like the present, and the key is to find an upgrade path that can be injected into your current app without a massive migration effort or engineering lift.
How can Authsignal help?
Authsignal provides passwordless alternatives to SMS One time passwords, like Authenticator Apps and FIDO2/Biometrics. These authenticator types come with pre-built flows that follow user experience best practices, so you can spend more time building features that you value and sleep easy knowing that your customer's accounts are secure with Authsignal.
Our rules engine, when paired with data points like Sim Swap timestamps, can easily change the authentication flows for your customers to provide an extra layer of risk mitigation without sacrificing the customer experience.
Our SDKs and APIs allow you to easily pick and augment any flow in your customer journeys without requiring considerable migration efforts and significant code changes. Check out our developer documentation to see how easy it is to add Authsignal into your app.
#simswapfraud #Authsignal #Passwordlessauthentication #simswapscam
.avif)
.avif)
.avif)