Australian Banking Moves Beyond SMS OTP: Passkeys, Scams Prevention and Stronger Authentication

For years, the SMS OTP has been an almost invisible part of banking in Australia. Log in, wait for the code, enter the numbers and continue.

That familiar experience is now changing.

A growing number of Australian banks are moving away from SMS OTPs for everyday banking security, led by digital banks such as Ubank introducing passkeys as an alternative to passwords and SMS codes, against a backdrop of new scam-prevention regulation targeting banks, telcos and digital platforms.

Instead of asking customers to receive and manually enter a code, banks are increasingly exploring passkeys, biometrics and other authentication methods that can provide stronger protection against phishing and other account takeover risks.

This reflects a broader shift in how banks approach login security: from codes that customers manually enter towards authentication methods tied more closely to a trusted device, banking app or biometric factor.

For banks and fintechs, the question is no longer simply how to deliver an SMS OTP reliably. It is how to choose authentication methods that strengthen security without adding unnecessary friction to the customer experience.

Why is Australian Banking Moving Away From SMS OTP?

SMS OTP has long been used as a second authentication factor in banking because it is familiar, widely supported and relatively easy for customers to use. It remains a recognised authentication factor within many banks’ multi-factor authentication (MFA) setups.

The challenge is what happens if a customer is tricked into handing over the code.

A customer may receive a genuine OTP by SMS, then enter it into a phishing website believing they are logging into their bank. Scammers can also use social engineering to persuade customers to disclose an OTP over the phone or through messaging platforms.

As phishing tactics become more sophisticated, bank login security in Australia is shifting towards authentication methods that are harder for customers to accidentally expose.

This is one of the concerns driving Australian banks such as Ubank to move away from OTP-based login in favour of passkeys and device-bound authentication. With passkey and device-bound authentication, customers can approve a login directly through their mobile device instead of manually entering an OTP that could be intercepted, copied or disclosed to a scammer.

That does not mean SMS OTP is inherently insecure or that SMS no longer has a role in banking. The broader shift is about matching the authentication method to the risk of the action being performed, and finding ways to make stronger security a natural part of the customer experience.

How Are Australian Banks Moving Beyond SMS OTP?

Unlike Singapore, Australia does not currently have a single regulator mandate requiring banks to phase out SMS OTP for login. Instead, the shift away from SMS OTP in Australian banking has largely been industry-led.

Ubank, the NAB-owned digital bank, became the first Australian bank to launch passkeys, introducing them in August 2024 as a passwordless way for customers to log in using their device’s biometric or screen-lock authentication instead of a password or SMS code. Ubank extended passkeys to online banking in October 2025, and has reported that around 90% of its digitally active app users now use passkeys rather than passwords or SMS codes to log in.

NAB, Ubank’s parent, has stated a broader industry ambition to phase out passwords and SMS codes in favour of passkeys and biometrics over roughly the next five years.

Importantly, this is not a blanket regulatory ban on SMS OTP across Australian banking. It is a shift being driven by individual banks adopting stronger authentication methods, rather than a directive applying uniformly across every institution overnight.

The change is also unfolding against a wider regulatory backdrop. The Scams Prevention Framework Act 2025 received royal assent on 20 February 2025 and commenced the following day, designating banks, telecommunications providers and digital platforms as regulated sectors with obligations to prevent, detect, disrupt and report scams. Enforced by the Australian Competition and Consumer Commission (ACCC) through its National Anti-Scam Centre, the framework is expected to be in full effect by 31 March 2027, with penalties of up to $50 million for non-compliance. The framework does not itself mandate passkeys or ban SMS OTP, but it creates significant regulatory pressure for banks to strengthen authentication and anti-scam controls across the board.

Together, Ubank and NAB’s passkey rollout and the Scams Prevention Framework point to a broader shift in Australian bank login security: authentication moving beyond codes that customers can be tricked into sharing, towards methods that provide stronger links between the customer, their trusted device and the authentication process.

For banks and fintechs, the takeaway is not simply to replace SMS OTP with the latest technology. It is to consider how each authentication method performs against the risks of the specific action, while keeping the experience straightforward for customers.

What Does This Mean for Australian Banks?

The direction is clear: bank authentication is becoming more device-bound, risk-based and layered.

Instead of relying on customers to receive a code and manually enter it, banks can use authentication factors that are more closely tied to a trusted device, app or verified identity.

Depending on the customer journey and level of risk, these may include:

• Passkeys
• Device-bound authentication
• Biometrics
• Face verification
• Passwordless authentication
• Step-up authentication for higher-risk actions
• Transaction signing

There is no single authentication method that fits every banking scenario. The right combination depends on the bank’s risk model, customer journey and regulatory obligations.

This is also where passwordless authentication in Australia fits into the broader shift. By reducing reliance on passwords and manually entered OTPs, passwordless approaches can give customers a simpler way to prove their identity while enabling banks to use stronger, device- or identity-based authentication behind the scenes.

The goal is not simply to remove the OTP. It is to make authentication harder for scammers to compromise without making it harder for customers to use their bank.

Is SMS OTP Being Phased Out Completely in Australian Banking?

Ubank and NAB’s passkey rollout, and the broader industry shift it represents, has specifically targeted login and other routine authentication journeys. It does not mean that SMS OTPs are disappearing from every Australian banking or financial-services use case overnight, or that every bank is moving at the same pace.

SMS OTPs can still be relevant in certain verification and authentication journeys, particularly where customers need a broadly accessible authentication method or have not activated another option.

At the same time, major Australian banks have been implementing additional measures such as in-app controls, biometric verification and passkeys to strengthen protection against scams.

A more useful way to think about the change is that SMS OTP is moving away from being the default authentication mechanism towards being one component within a broader, risk-based authentication strategy.

The wider shift also comes as Australia continues to strengthen its anti-scam measures more broadly, with the Scams Prevention Framework adding new obligations for banks, telcos and digital platforms to prevent, detect, disrupt and report scams. While the reduction in SMS OTP reliance cannot be attributed to any single measure, it reflects a broader effort across the industry to strengthen safeguards around digital banking and reduce customers’ exposure to scams.

What Authentication Methods are Replacing SMS OTP in Australian Banking?

There is no single replacement for SMS OTP across every banking journey. Instead, banks can combine several authentication factors depending on the level of risk.

The important distinction is that these methods are not interchangeable. A bank choosing an authentication method needs to consider the authentication factor, the risk of compromise, the customer journey and the specific action being authorised.

For financial institutions looking to reduce reliance on manually entered OTPs, Silent Mobile Authentication offers another approach to verifying mobile users. 8×8 CPaaS Silent Mobile Authentication can verify a user’s mobile number without requiring them to manually enter an OTP, helping reduce friction while adding another layer to the authentication journey.

How Does Silent Mobile Authentication Work?

Silent Mobile Authentication verifies a user’s mobile number through the mobile network without requiring them to manually enter an OTP.

In a typical journey, a customer starts a login, registration or verification process on their mobile device. Instead of receiving a code and typing it into a form, the authentication flow can use network-based verification to confirm that the mobile number is associated with the device being used.

This can remove a familiar point of friction:

Enter mobile number → wait for SMS → retrieve OTP → enter OTP → continue

With silent authentication, eligible users can move through the verification process with fewer manual steps, without having to retrieve and enter a one-time code.

For banks and fintechs, this can be useful for mobile onboarding, account access and step-up authentication, particularly in journeys where verifying possession of the customer’s mobile number is an important part of the authentication process.

Silent Mobile Authentication should not, however, be treated as a universal replacement for every authentication factor. Financial institutions still need to assess how it fits into their broader authentication architecture, risk model and applicable security requirements.

Is Silent Mobile Authentication more secure than SMS OTP?

Not necessarily in every situation. Silent Mobile Authentication and SMS OTP use different approaches to authentication, so their security should be assessed based on the specific implementation, risk level and authentication factors involved.

With SMS OTP, the point of weakness lies in a scammer’s ability to potentially trick the customer into entering or disclosing the code through a phishing site, phone call or messaging platform.

Silent Mobile Authentication can remove that manual code-entry step. By verifying the mobile number through the mobile network, it can reduce exposure to phishing attacks that rely on persuading customers to reveal an OTP.

That does not make Silent Mobile Authentication a complete security solution on its own. Australian banks should assess it as part of a broader, layered authentication architecture, taking into account the risk of the action, the factors being used and the applicable security requirements.

This is consistent with the broader principle behind multi-factor authentication (MFA): using two or more unique and independent authentication factors, with examples including OTPs, biometrics, device identity and digital certificates.

The key takeaway is therefore not that one technology is universally “more secure” than another. It is about choosing authentication factors that address the relevant risks while making the customer journey as secure and seamless as possible.

How Should Australian Banks Approach Authentication After the SMS OTP Shift?

The shift away from SMS OTP for bank-account login does not mean banks need to replace it with a single new technology. A stronger approach is to match authentication to the risk, customer journey and action being protected.

A bank could use different authentication layers for different scenarios:

What Should Banks Consider When Choosing an Authentication Solution?

Moving beyond SMS OTP in Australian banking is not simply a technology replacement exercise. Banks should evaluate how an authentication solution fits into their existing identity, security and customer-experience architecture.

Key considerations include:

• Security: Does the method reduce exposure to phishing, credential theft and social engineering?
• Authentication factors: Can it work alongside other independent factors where MFA is required?
• Customer experience: How many steps does the customer need to complete, and how much manual input is involved?
• Device coverage: Does it work reliably across the devices and mobile networks used by the bank’s customers?
• Integration: Can it connect with existing CIAM, identity, fraud and banking systems?
• Risk-based authentication: Can stronger authentication methods be triggered when a login, transaction or other action presents higher risk?
• Fallback: What happens if the customer’s primary authentication method is unavailable?
• Monitoring: Can the bank monitor authentication attempts, failures and suspicious activity?

The goal is not to eliminate SMS overnight, but to build an authentication architecture in which the most appropriate method is used for each customer and risk scenario.

A layered approach can combine different authentication methods based on the risk and customer journey. 8×8 CPaaS and Descope CIAM, for example, can support mobile authentication, passwordless login and risk-based multi-factor authentication as part of a broader customer identity strategy.

How Can 8×8 CPaaS Support Stronger Authentication for Financial Services in Australia?

For banks, insurers and fintechs, authentication needs to balance security with a customer experience that feels fast and intuitive. 8×8 CPaaS brings together mobile authentication and identity capabilities that can help financial institutions reduce reliance on manual verification while building more flexible authentication journeys.

• Silent Mobile Authentication

  8×8 CPaaS Silent Mobile Authentication verifies a customer’s mobile number through the mobile network without requiring them to manually enter an SMS OTP.

  For journeys where every additional step can create friction, silent authentication can make mobile verification faster and less visible to the customer, without requiring them to retrieve and enter a one-time code.

   

• Descope CIAM

  

  Descope CIAM is a no-code customer authentication and identity management platform that helps financial institutions secure customer-facing applications and journeys.

  With Descope CIAM, banks, insurers and fintechs can:

  • Secure customer authentication: Manage login, access control and identity across customer-facing applications.
  • Simplify onboarding: Create smoother registration and account setup journeys while supporting identity verification.
  • Enable passwordless authentication: Support methods such as magic links, social logins and OTPs to reduce reliance on passwords.
  • Strengthen multi-factor authentication: Configure risk-based MFA, bot protection and step-up controls for higher-risk journeys.
  • Manage authentication centrally: Integrate authentication and authorisation into existing customer journeys without building identity infrastructure from scratch.

Together, 8×8 CPaaS Silent Mobile Authentication and Descope CIAM can support a broader approach to customer authentication, combining low-friction mobile verification with configurable identity, MFA and access controls. That combination matters because it runs on the same 8×8 CPaaS infrastructure a bank may already use for SMS OTP, voice and other customer communications, with Omni Shield’s fraud monitoring covering the verification traffic underneath it. Rather than adding a separate identity vendor on top of an existing messaging stack, a bank can extend the same platform relationship to cover mobile authentication and CIAM.

Talk to our experts to find out how banks, insurers and fintechs in Australia can create authentication journeys that are secure, adaptable, and easier for customers to navigate, while fitting into the institution’s wider security and compliance framework.