The OTP Economy: Codes, Fraud and Passkeys 2026

By the Connect Media Editorial Team · Published 13 October 2026 · Methodology · Sources

Somewhere in the world, millions of times a minute, a phone buzzes with six digits: Your verification code is 482913. One-time passwords (OTPs) sent by SMS protect bank logins in Nairobi, ride-hailing sign-ups in Jakarta and tax portals in Europe. They are one of the biggest uses of business SMS on earth. They are also the target of two industrial-scale frauds, and the subject of a slow global shift towards passkeys. This report follows the money.

Key findings

1. Why the world runs on six digits

SMS OTPs won because they need nothing: no app, no smartphone, no data bundle, no training. Any of the world’s billions of phone numbers can receive one. That universality is why banks, mobile money services, governments and apps adopted them as the default second factor, and why OTPs became one of the largest categories of application-to-person (A2P) SMS. The same strengths make them a target.

2. Fraud one: fake traffic (SMS pumping)

In artificially inflated traffic (AIT), criminals use bots to request OTPs to thousands of numbers they control, often premium or high-cost international ranges. The business pays to send every code; somewhere along the route, a party paid per message shares the revenue with the fraudster. Nobody ever logs in.

The Mobile Ecosystem Forum (MEF) says businesses lost US$1.6 billion to AIT in 2023 alone, and that fake traffic makes up between 5% and 40% of international A2P SMS depending on the region [1]. Analysts at Mobilesquared put losses at US$2.4 billion over 2022–2024 [2]. In February 2023, Elon Musk said Twitter (now X) had been losing about US$60 million a year to fake 2FA text messages, one reason it restricted SMS two-factor login to paying users. Meanwhile, some operators have more than doubled their international SMS termination rates since 2021, partly in response to this kind of fraud, which raises costs for every legitimate sender [3].

3. Fraud two: stealing the number (SIM swap)

The second attack goes after the person, not the business. In a SIM swap, a criminal persuades or bribes someone to move a victim’s number to a new SIM. Every OTP then goes to the attacker, who resets passwords and empties accounts. It happens everywhere:

• United Kingdom. Unauthorised SIM swaps reported to the fraud database Cifas rose by 1,055% in 2024, to nearly 3,000 cases from 289 the year before [4].
• United States. The FBI’s Internet Crime Complaint Center recorded about US$72.7 million in SIM-swap losses in 2022, US$48.8 million in 2023 and about US$26 million from 982 complaints in 2024 [5]. Analysts disagree on whether the fall reflects better carrier controls or changes in reporting.
• Kenya. INTERPOL reports KSh 491.6 million (US$3.8 million) stolen through SIM-swap fraud in 2025, with cases up 327%. Our SMS fraud in Kenya report has the detail.

4. What comes after the code?

Passkeys, built on standards from the FIDO Alliance, replace passwords and codes with a cryptographic key stored on the phone and unlocked with a fingerprint, face or PIN. They cannot be phished or SIM-swapped. In 2025, 48% of the top 100 websites reviewed by FIDO offered them [6]. US guidance from NIST has long classed SMS as a “restricted” authenticator for high-security uses.

But passkeys need a reasonably modern smartphone, and as our report on who is still offline shows, billions of people do not have one. In much of Africa and South Asia, the SMS code will remain the main second factor for years. The realistic future is layered: passkeys where possible, SMS as the universal fallback, and network checks (such as whether a SIM was recently swapped) behind both.

5. Checklist for businesses that send OTPs

• Rate-limit code requests per number, per IP address and per country. Pumping attacks rely on volume.
• Block countries you do not serve. Most AIT goes to expensive international ranges.
• Watch the conversion rate. If codes sent rise but successful logins do not, you are being pumped.
• Keep codes short-lived (5 minutes or less) and never put them in a link.
• Say who you are and what not to do: “Never share this code. We will never call you to ask for it.”
• Use a registered sender ID so customers learn what your genuine messages look like.
• Offer passkeys to smartphone users and keep SMS as the fallback for everyone else.

Methodology

This report draws on industry-body estimates (MEF, Mobilesquared, FIDO Alliance), national fraud data (Cifas, FBI IC3, INTERPOL) and press coverage of them. Several figures reached us through secondary reporting rather than the original documents, and we say so where that is the case. Fraud estimates use different methods and periods and should not be added together.

Sources

1. Mobile Ecosystem Forum, “AIT in A2P messaging: the silent predator”, January 2025. mobileecosystemforum.com
2. Mobile Ecosystem Forum, Anti-Fraud Yearbook 2024. mobileecosystemforum.com
3. Rethink Research, “Higher transit costs, MNO indifference blamed for rising messaging fraud”. rethinkresearch.biz
4. Mobile ID World, “UK SIM swap fraud surges 1,055% in 2024”. mobileidworld.com
5. DeepStrike, “SIM swap scam statistics 2025” (summarising FBI IC3 reports). deepstrike.io
6. Descope, “2025 FIDO report”. descope.com