Is SMS OTP Ending in India? Singapore Already Killed It — and Your Fix Is Already in Your Phone

Short answer: Not by force — at least not yet. Singapore has already ordered its big banks (DBS, OCBC, UOB) to remove SMS OTP; India is moving the same direction but by nudge, not ban. RBI’s rules (effective 1 April 2026) require two-factor authentication with at least one dynamic factor and push banks to offer alternatives — while NPCI has, since 7 October 2025, allowed fingerprint/face UPI on GPay, PhonePe and Paytm (up to Rs 5,000). Biometric is safe because your fingerprint never leaves your phone. The catch: the fix is optional, and it’s sitting switched off in most people’s phones right now.

The thing you trust is the thing that’s failing you

The OTP feels like security. A secret code, just for you, expiring in minutes. What could be safer?

This: a code you can read is a code you can be tricked into sharing. A scammer doesn’t need to break a bank’s firewall. They need you to read six digits down the phone — “Sir, your KYC needs updating, tell me the OTP” — and you do the breaking for them.

The bill for that design is not small. In 2025, Indians lost roughly Rs 22,495 crore to cyber fraud across about 2.81 million complaints — up 24% in a year. Digital-arrest scams alone drew 30,000+ complaints and, by the Supreme Court’s estimate, losses near Rs 3,000 crore. A large share walked out through one door: a single OTP, shared by the victim.

What Singapore actually did — and why it worked

Singapore didn’t make the OTP “more secure.” It took the dangerous option away.

On 9 July 2024, the Monetary Authority of Singapore and the banks’ association told the big three — DBS, OCBC, UOB — to phase out SMS OTP for customers on digital tokens. The token lives inside the banking app; there’s no code to read out, so there’s nothing to phish. By 2026 the switch was largely done.

Think of it as a seatbelt. One approach: keep reminding people to buckle up, and hope. The other: the car won’t move until the belt is on. Singapore chose the car that won’t move.

Where India actually stands

Two things are true at once, and most people know neither.

One — RBI is nudging, not banning. The Authentication Directions (notified 25 September 2025, effective 1 April 2026) require two factors on every digital payment, at least one of them dynamic. Crucially, RBI did not ban OTP. It kept OTP as one option and told banks to also offer better ones: fingerprint, face, device tokens, QR approvals.

Two — the better lock is already in your phone. Since 7 October 2025, NPCI has allowed biometric UPI on Google Pay, PhonePe and Paytm — approve a payment with your fingerprint or face instead of a PIN, for now up to Rs 5,000. The safe method Singapore ran an entire migration to reach? Part of it is already installed on your phone. You just haven’t switched it on.

The fear everyone has — and why it’s the wrong one

“If my fingerprint leaks, I can’t change my finger.”

It sounds airtight. It’s also wrong. With on-device biometrics, your fingerprint never goes anywhere. Your phone’s own sensor checks you, inside the phone. Google Pay, the bank, some server in a data centre — none of them receive your fingerprint. The phone just vouches: yes, it’s them. There is no central vault of your finger to be stolen, which is precisely why you never need to “reset” it.

The thing you’re scared of isn’t happening. The thing that should worry you is quieter — and it’s about to get louder.

The scam doesn’t die. It changes shape.

When reading out a code stops working, the fraud won’t vanish — it will move. Instead of “tell me your OTP,” it becomes “just approve it.”

“Put your fingerprint to receive the money.” “There’s a request on your screen — say yes, I’ll handle the rest.” Biometrics stop the scam where you read out a code. They do nothing about the scam where you put your own finger on it.

So the real rule was never about technology. It’s one sentence, worth more than any setting:

You never approve, enter a PIN, or use a fingerprint to receive money. Only to send it. Anyone who asks otherwise is lying — always.

So, good or bad?

Good. Clearly good. A tool that was broken from the start is on its way out, and a genuinely better one — sitting in your hand — is arriving.

But one honest question remains, and it isn’t aimed at any party or at RBI. It’s about design. Singapore protected its people by removing the dangerous default. India left the old lock in place and set a better one beside it — as your choice. And when safety is left to choice, the most vulnerable — parents, grandparents, anyone who finds technology frightening — are the ones who stand at the broken door the longest.

Closing that gap isn’t the regulator’s job now. It’s yours. Today.

What to actually do

1. Turn on biometric UPI today. Open your app, enable fingerprint/face. Thirty seconds. Then do it for the people at home who can’t.
2. Never approve to receive. Treat every approval request like a stranger at your door. This one line stops half the scams cold.
3. Move past SMS OTP where you can. Wherever your bank offers a device token or passkey, use it. Less code in transit, less to steal.

Singapore changed the lock. India handed you a new key — and left it in your pocket. The only thing left is to take it out and use it.