tru.ID versus SMS OTPs

SMS OTP

tru.ID

Why does it matter?

Security factor

OTPs via SMS are a

possession factor

but they are easily compromised and prove only digital possession.

tru.ID is a much stronger

possession factor

that proves possession of a SIM card which has the expected number.

Possession-factor authentication is stronger than a password – but OTPs can still be stolen.

Proof of possession is usually used as a second factor to back up proof of knowledge (such as passwords). This is because knowledge can be shared or stolen.

However, an OTP or other code is not really a possession – it is still an unencoded piece of information, which can be stolen. This is exactly how SIM swap fraud operates (see below).

SIM-based authentication from tru.ID is strikingly different. Because verification is real-time and invisible to users, there’s no PIN that can be shared or stolen – and checking for recent SIM changes means tru.ID can detect SIM swap fraud.

Accompanying identity or credential

Mobile phone number

Mobile phone numbers aren't free and in many cases require a real-world identifier. They are also relatively anonymous while remaining provable.

Risk of compromise

Medium

Low

While it is possible to intercept or socially engineer communication sent to a phone number, it is virtually impossible to fake possession of the SIM card.

User effort required

High

Minimal

Any friction that disrupts the flow of signing up (or other user actions) causes users to drop off.

25-30% of users drop off at onboarding due to the poor user experience of waiting for unreliable SMS codes, which can take minutes and sometimes never arrive (learn why here.)

Verification with tru.ID is near-instant and invisible, so it feels like magic to the user.

Data Collected

Mobile phone number

None

Changing privacy laws mean collecting user data is legally complex – and anything you store is at risk of being breached.

Requires managing a user database?

Yes

Managing a user database is not only costly, but puts you at risk of data breaches.

Susceptible to Man-in-the-middle attacks?

Yes

MITM (man-in-the-middle) attacks occur when an attacker intercepts a private communication.

SMS messages are unencrypted and can be viewed or forwarded without the user’s knowledge.

Authentication with tru.ID is passwordless and requires no user action, leaving no room for MITM interception.

Susceptible to SIM Swaps?

Yes

SIM swap fraudsters impersonate a victim to receive a new SIM card which all calls and messages for the victim's number are then routed to.

Any two-factor authentication codes that are sent to the number find their way to the fraudster instead. They can then reset both passwords and associated phone numbers for the victim's accounts, thus allowing them to steal the victim’s identity and money.
‍
tru.ID is able to check whether a SIM has been changed, so you can prevent access or trigger an additional step-up security challenge in response.

tru.ID vs SMS OTPs