Regulations / United States
United States: SP 800-63B-4: SMS OTP is a "restricted" authenticator
Answer NIST: SP 800-63B-4: SMS OTP is a "restricted" authenticator. Timing: Final 2025. Status on Telemetry's board: guidance (verified 2026-09-24).
RRecord
- Market
- United States
- Regulator
- NIST
- Measure
- SP 800-63B-4: SMS OTP is a "restricted" authenticator
- Timing
- Final 2025
- Status
- Guidance
- Verified
- 2026-09-24
ERegulator and standards
NIST Standards body
The US National Institute of Standards and Technology publishes the Digital Identity Guidelines, the Cybersecurity Framework and the National Vulnerability Database.
- Parent
- US Department of Commerce
- Based
- Gaithersburg, Maryland
NIST SP 800-63-4 Standard
Revision 4 of NIST's Digital Identity Guidelines, covering identity proofing (63A), authentication (63B) and federation (63C). US federal agencies must follow it, and many banks and auditors treat it as the benchmark.
- Publisher
- NIST, US Department of Commerce
- Status
- Final, 2025
- Volumes
- 63A proofing, 63B authentication, 63C federation
BBriefings
SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
Are synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.
MOther markets
- UAE Complete
- Philippines In force
- India In force
- Singapore In force
- Malaysia In force
- European Union Pending