Can I use SMS for password resets and OTPs?

Yes — you can use SMS for password resets and OTPs, but it’s generally not the most secure option.

Why SMS is risky

SMS can be vulnerable to:

• SIM swapping: an attacker takes over a phone number.
• Number port-out fraud: your number gets moved to a different carrier/device.
• Intercepted messages: via malware or some network attacks.
• Phishing/social engineering: users can be tricked into revealing codes.

When SMS is acceptable

SMS is still commonly used when:

• You need a low-friction second factor for a large user base.
• The action is low-to-medium risk.
• You have no better channel available.

Better alternatives

For stronger security, prefer:

• Authenticator apps (TOTP like Google Authenticator, Authy, Microsoft Authenticator)
• Passkeys / WebAuthn
• Email for lower-risk resets, if secured properly
• Push-based MFA with number matching or device binding

If you do use SMS

Use it with safeguards:

• Treat SMS as not a primary secure factor for high-risk accounts.
• Limit OTP validity to short lifetimes.
• Rate-limit resend attempts and verification attempts.
• Detect suspicious changes (new device, IP, location).
• Require additional verification for password resets on sensitive accounts.
• Notify users of reset/OTP requests.
• Support recovery via backup codes or stronger methods.

Practical recommendation

• For OTP/MFA: use SMS only as a fallback, not the default.
• For password resets: SMS can be used, but for important accounts, pair it with additional checks or a stronger recovery flow.

If you want, I can help you design a secure password reset / OTP flow for your app.