NIST’s updated Digital Identity Guidelines (SP 800-63B-4) formally classify SMS/PSTN one-time passcodes as a restricted authenticator. This is the first time NIST has created an explicit “restricted” category, which comes with new obligations for any organization that continues to use these methods.
While SMS OTP is still allowed, the bar for using it has been raised. If you rely on SMS for multi-factor authentication, you now need to meet specific conditions and to mitigate its well-known risks like SIM swaps, number porting, device theft, and MITM/relay attacks. Many organizations are now looking for ways to keep using SMS without taking on unnecessary risk.
What “restricted” means in Rev 4
Under § 3.1.3.3 and § 3.2.9, the use of the PSTN for out-of-band authentication (including SMS OTP) is considered restricted. At the time of publication, it is the only method in this category. Being restricted means you can still use it if you:
- Offer at least one unrestricted alternative that meets the required AAL and notice users about the risks and the availability of alternatives.
- Address these risks in your risk assessment and maintain a migration plan in case the method becomes unacceptable in the future.
- Implement risk-mittigation solutions to detect and prevent interception, SIM swap, device theft, number porting attacks, and abnormal user behavior.
Provided that you comply with the above checklist, you can continue using SMS OTP while reducing your exposure. This is where TypingDNA’s SMS+ comes in. It adds a transparent typing check so the OTP is revealed only to a verified user, directly addressing the risks in point 3 by mitigating SIM swap, device theft, number porting, and interception or MITM attacks.
Why NIST took this step
In SP 800-63B Rev 3, SMS OTP was allowed with cautions, and NIST initially indicated that the SMS OTP/PSTN method would be completely unsupported starting with Rev 4. This proved impractical due to the large number of organizations, including federal agencies, that rely on SMS and have no immediate alternative to secure user accounts. As a result, Rev 4 instead formalizes a second-class status for SMS OTP/PSTN (calling it “restricted authenticators”), making clear that 1. it can still be used while 2. its weaknesses are significant enough to require additional conditions.
Practical steps to comply and reduce risk
- Mitigate the risks directly: Implement layered security so that even if an attacker receives the SMS, they cannot use the OTP without passing an additional verification step. TypingDNA SMS+ adds an inherence check and encrypts the OTP so it is revealed only after verification, addressing threats like SIM swap, device theft, MITM attacks, and interception.
- Harden your SMS flow: Use short-lived, single-use codes. Throttle attempts. Block delivery to known VoIP numbers. Run SIM swap and number porting checks before sending codes, and increase security if such events are detected. While IAM platforms or SMS providers may handle some of these checks (often via Camara APIs), detection alone cannot confirm malicious intent, so blocking by itself is not a complete solution.
- Provide an optional alternative: Offer an app-based OTP, push notification, or hardware key option and make it visible to users.
- Add clear user notices: At enrollment, recovery, and number-change screens, explain the risks of SMS OTP and that an alternative is available.
- Treat number changes seriously: Follow the same binding process as when first adding an authenticator.
How TypingDNA SMS+ helps
SMS+ is a drop-in upgrade to your existing SMS OTP. Instead of sending the code in plain text, you send a secure link. The user types 2–3 words directly in their phone browser (no apps), and if their typing matches their previous typing behavior, the code is revealed. With deeper integrations, the user doesn’t even have to further enter the code after verification.
Why it matters:
- Keeps your current IAM flow and user experience. No changes to the IAM flow.
- Reduces risk from SIM swap, theft, and relays. An attacker who gets the SMS still cannot see the code without passing the typing check.
- Supports § 3.2.9 requirements while you offer alternatives and maintain a migration plan.
TypingDNA SMS+ can be self-hosted and is 100% customizable to look and feel the way you want to, it integrates in your IAM as a custom SMS provider, allowing the client to add their own SMS provider within SMS+ config.
Availability: In private preview for selected clients only. Contact us for a demo and request access.
Key takeaways
- SMS OTP is now explicitly restricted under NIST SP 800-63B-4.
- Using it requires offering alternatives, informing users, mittigate risks, updating risk assessments, and maintaining a migration plan.
- Hardening your SMS flow and adding layered security like TypingDNA SMS+ can reduce exposure while you transition.
- There is no need to start from scratch. TypingDNA SMS+ can be integrated quickly to secure the SMS channel you already use.
Related to NIST SP 800-63B Rev 4
NIST SP 800-63B Rev 4 also introduced Section 5.3 Session Monitoring, which we help solve through the use of our continuous authentication tech (TypingDNA ActiveLock, our AI desktop agent), covered in detail here: NIST SP 800-63B Rev 4: Session Monitoring and TypingDNA ActiveLock.