Everyone says turn on MFA, and the questionnaire that asked has no box for which kind.
OTP is three different things wearing one name, and the one most of your users have is the one doing the least.
So, which one is protecting you?
Whichever one you've got is protecting you from password reuse.
None of the three is protecting you from phishing.
Start with the code that arrives by text
An SMS code is a one-time password in the loosest sense. The server picks six random digits, stores them, and texts them to a phone number it trusts.
The code isn't the weak part. The phone number is.
A SIM swap moves that number to a handset the attacker holds, and from then on every code lands with them.
The FCC's SIM swap rules took effect in July 2024 and make carriers authenticate the customer before a port. That helps at the margin and does nothing about a bribed store employee.
NIST put SMS and voice codes in the RESTRICTED bucket of SP 800-63B in June 2017.
Nine years later it still ticks the MFA box on every vendor questionnaire and insurance renewal I've seen.
That's the thing I keep arguing about. SMS is better than nothing. The argument is whether a form that can't tell SMS from a hardware key is measuring anything at all.
HOTP, the counter nobody chose on purpose
HOTP is RFC 4226, from December 2005. Take a shared secret and a counter, run HMAC-SHA1 over them, chop the result down to six digits.
Both sides keep the counter.
Press the button, the counter goes up, a new code comes out.
You've almost certainly used one.
The OTP slot on a YubiKey can run OATH-HOTP. The old bank fobs with a button and no clock were HOTP, or something proprietary that worked the same way.
The problem is drift.
Press the button four times in your pocket and the token's counter is four ahead of the server's. RFC 4226 handles that with a look-ahead window, and every implementation picks a different width for it.
A HOTP code also doesn't expire. Phish one at 9:00 and it's still good at noon, as long as the real user hasn't pressed the button since.
Nobody picks HOTP for a new rollout in 2026. It's what you inherit.
TOTP, the same math on a 30-second clock
TOTP is RFC 6238, May 2011, and it's HOTP with one substitution. The counter becomes the Unix time divided by 30.
That's the whole trick.
Same HMAC, same shared secret, same six digits, and no button to press because the clock is the counter.
The RFC's test vectors use SHA-1, and so does nearly every authenticator app on your phone (Google Authenticator still defaults to it). That's fine. HMAC doesn't care about SHA-1's collision problems, and nobody has shown an attack on HMAC-SHA1 that matters here.
Most servers accept one step either side, so a code is really good for about 90 seconds.
Plenty for what comes next.
The part people miss is that "shared secret" means the server has your seed. Every seed, for every user.
Twilio's Authy service found that out in July 2024, when an unauthenticated endpoint let someone pull 33 million phone numbers tied to Authy accounts.
The seeds weren't in that haul. The service holding your second factor is still a target, and last I checked Authy won't let you export your seeds out of it.
Google Authenticator added cloud sync in April 2023 and shipped it without end-to-end encryption. Convenient, and one more place your seeds live.
So which one survives a phishing kit
None of them.
Evilginx has been public since 2017.
It sits between the user and the real login page. It forwards the password, forwards the TOTP code inside the 30-second window, and keeps the session cookie that comes back.
Microsoft reported in July 2022 that one AiTM campaign had hit more than 10,000 organizations since September 2021. Those were tenants with MFA turned on.
SMS, HOTP, and TOTP all fail the same way here, because the code is something a user can type.
Anything a user can type, a user can type into the wrong page.
FIDO2 is where that stops.
The credential is bound to the origin. A key registered for login.microsoftonline.com won't sign a challenge from a lookalike domain, whatever the page says.
OMB M-22-09 required phishing-resistant MFA across federal agencies in January 2022. CISA's fact sheet from October 2022 says the same thing to everyone else.
Here's my hill.
Admins go on FIDO2 before anyone spends a meeting arguing about which authenticator app the rest of the company uses.
What I'd actually do this quarter
If you're the one answering the cyber insurance renewal this month, the MFA question is a yes or no. SMS gets you the yes.
It's still the weakest yes on the form, and the broker knows it.
Rank the work like this.
- Admins first. Anyone holding Global Administrator, Domain Admin, or the equivalent gets hardware FIDO2 keys, two each, this quarter. That's CIS Safeguard 6.5, and it's IG1, so it's on the list for the smallest companies too.
- Everyone else gets an app-based TOTP, not SMS. I honestly don't care which app. Microsoft Authenticator, Google Authenticator, the one built into 1Password, whatever your people will keep. Pick on seed export, not on logo.
- Backup codes. Google hands out 10. Print them. The lockout ticket costs more than the paper.
- Kill SMS as a fallback once the app is enrolled. An attacker who can trigger "send a code by text instead" gets to choose the weakest factor you left switched on.
One thing I don't know.
NIST called SMS restricted in 2017, and in 2026 it's still an accepted answer on nearly every form I see. I can't tell you when that changes, and I've stopped predicting it.
What I can tell you is that the OTP checkbox was never the control. The control is what the user can't be talked into typing.